Skip to content

Commit b95e7c2

Browse files
committed
Drop ssl_verify=no on SLES
Originally SLES 12 was a PE-only agent installed from the PE server, which creates a self-signed CA, so commit 1b62f86 disabled SSL verification. Later commit 6b7fda9 extended the module for open source SLES, and we continued to disable ssl verification. Later commit 8256a2c added a guard clause unless $::operatingsystemmajrelease == '11' and $::puppet_agent::is_pe { if getvar('::puppet_agent::manage_repo') == true { which meant we only disabled ssl verification on not-PE. There's no good reason to continue doing that, so remove it.
1 parent 82573d3 commit b95e7c2

File tree

2 files changed

+5
-8
lines changed

2 files changed

+5
-8
lines changed

manifests/osfamily/suse.pp

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,6 @@
134134
# 'auto' versus X.Y.Z
135135
$_package_version = getvar('puppet_agent::master_or_package_version')
136136

137-
# In Puppet Enterprise, agent packages are served by the same server
138-
# as the master, which can be using either a self signed CA, or an external CA.
139-
# Zypper has issues with validating a self signed CA, so for now disable ssl verification.
140137
# don't leak credentials
141138
$repo_username = getvar('puppet_agent::username')
142139
$repo_password = unwrap(getvar('puppet_agent::password'))
@@ -158,7 +155,7 @@
158155
'enabled' => '1',
159156
'gpgcheck' => '1',
160157
'autorefresh' => '0',
161-
'baseurl' => "${source}?ssl_verify=no&auth=basic&credentials=PuppetcoreCreds",
158+
'baseurl' => "${source}?auth=basic&credentials=PuppetcoreCreds",
162159
'type' => 'rpm-md',
163160
}
164161

spec/classes/puppet_agent_osfamily_suse_spec.rb

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@
151151
'enabled' => '1',
152152
'gpgcheck' => '1',
153153
'autorefresh' => '0',
154-
'baseurl' => "https://yum-puppetcore.puppet.com/puppet6/sles/#{os_version}/x86_64?ssl_verify=no&auth=basic&credentials=PuppetcoreCreds",
154+
'baseurl' => "https://yum-puppetcore.puppet.com/puppet6/sles/#{os_version}/x86_64?auth=basic&credentials=PuppetcoreCreds",
155155
'type' => 'rpm-md',
156156
}.each do |setting, value|
157157
it {
@@ -203,7 +203,7 @@
203203
'path' => '/etc/zypp/repos.d/pc_repo.repo',
204204
'section' => 'pc_repo',
205205
'setting' => 'baseurl',
206-
'value' => "https://nightlies.puppet.com/yum/puppet6/sles/#{os_version}/x86_64?ssl_verify=no&auth=basic&credentials=PuppetcoreCreds",
206+
'value' => "https://nightlies.puppet.com/yum/puppet6/sles/#{os_version}/x86_64?auth=basic&credentials=PuppetcoreCreds",
207207
})
208208
}
209209
end
@@ -291,7 +291,7 @@
291291
'enabled' => '1',
292292
'gpgcheck' => '1',
293293
'autorefresh' => '0',
294-
'baseurl' => "https://master.example.vm:8140/packages/2000.0.0/sles-#{os_version}-x86_64?ssl_verify=no&auth=basic&credentials=PuppetcoreCreds",
294+
'baseurl' => "https://master.example.vm:8140/packages/2000.0.0/sles-#{os_version}-x86_64?auth=basic&credentials=PuppetcoreCreds",
295295
'type' => 'rpm-md',
296296
}.each do |setting, value|
297297
it {
@@ -341,7 +341,7 @@
341341
'path' => '/etc/zypp/repos.d/pc_repo.repo',
342342
'section' => 'pc_repo',
343343
'setting' => 'baseurl',
344-
'value' => "https://fake-sles-source.com/packages/2000.0.0/sles-#{os_version}-x86_64?ssl_verify=no&auth=basic&credentials=PuppetcoreCreds",
344+
'value' => "https://fake-sles-source.com/packages/2000.0.0/sles-#{os_version}-x86_64?auth=basic&credentials=PuppetcoreCreds",
345345
})
346346
}
347347
end

0 commit comments

Comments
 (0)