Better way to delete revoked certificates?

[jwenjian]

Hi Team,

In my case, I would like to delete revoked certificates, but I cannot do it while the container is running, since it requires puppet server is stopped.

So currently I just run the command puppetserver ca delete --revoked right after the container is started but before the puppet server service is running..

I am wondering what is the better to do this, by define a custom initialize scripts in /docker-custom-entrypoint.d/? do you have any other recommendation?

Thanks in advance!

[rwaffen]

hmm complicated. but yes, i would say use /docker-custom-entrypoint.d/ or even, if this is a general problem, /docker-entrypoint.d/ 🤔

[jwenjian]

Thanks, I will try to use custom entrypoint.

And I don't know if this is the normal requirement when use puppet container, my case is I re-installed puppet agent on a machine (and lost old client certificate), in this case, I cannot make the new puppet agent with new certificate with the same clientcert connect to the puppet server, I did:

• go into puppet server container: puppetserver ca revoke --clientcert <>
• Delete old puppet server container (in k8s, it will create a new one), after the new container is created but before puppet server service not running, I do puppetserver ca delete --revoked

Then the new puppet agent works as expected.

[jwenjian]

Since I am using the https://github.com/puppetlabs/puppetserver-helm-chart, I did this by add a custom script with below helm values:

puppetserver:
  customentrypoints:
    enabled: true
    configmaps:
      delete-revoked-certs.sh: |-
        #!/bin/sh
        puppetserver ca delete --revoked