VSHN Puppet Environment in Docker - PuppetDB
7.2K
Docker Hub: vshn/puppet-puppetdb
PuppetDB is used for storage backend for Puppetserver. This image configures PuppetDB to be run in Docker.
| Name | Description | Default value |
|---|---|---|
| CA_SERVER | Puppet CA server to request certificate | puppetca.local |
| POSTGRES_PASSWORD | Password for Postgres user | - |
| POSTGRES_USER | Username for Postgres connection | - |
| PUPPETDB_NODETTL | PuppetDB node-ttl (default was 7d) | 30d |
| PUPPETDB_WHITELIST | Set to true to enable puppetdb whitelist | - (false) |
| PUPPETDB_MAXPOOLSIZE | maximum-pool-size database setting | 25 |
By default any valid certificate from the CA can query anything that's in the PuppetDB. This means puppet agents can query all the information for any other agent in the PuppetDB, too.
See: https://puppet.com/docs/puppetdb/5.2/configure.html#puppetdb-settings
This is a big security issue and you should limit PuppetDB access to Puppetmasters and other carefully selected systems.
Set Env PUPPETDB_WHITELIST to true and docker mount a whitelist to /etc/puppetlabs/puppetdb/certificate-whitelist
Certificates of normal puppet agents should never be on the whitelist!
ubuntu:16.04| Name | Description |
|---|---|
| 10-tls-setup.sh | Request a certificate from Puppet CA and configure PuppetDB to use it |
| 20-whitelist.sh | Configures the use of a client certificate whitelist |
Content type
Image
Digest
Size
187.5 MB
Last updated
about 5 years ago
docker pull vshn/puppet-puppetdb:6.9