Icinga / icingaweb2-module-x509

Keeps track of certificates as they are deployed in a network environment.
https://icinga.com/docs/x509/latest/
GNU General Public License v2.0
107 stars 24 forks source link

Documentation (or solution) needed: Creating configuration for 1.3 using configuration management #230

Open maggu opened 11 months ago

maggu commented 11 months ago

With 1.2 and previous versions it was easy enough to create configuration for this module from external data sources. I could just transform them into INI files, for example using icingaweb2::inisection in the excellent Puppet module for Icinga Web 2.

With 1.3 it's quite clear how to add configuration through the GUI. However, I don't quite understand how I'm supposed to do it if I instead want to feed the module configuration machinally in some way. Perhaps icingacli needs to be extended to accomplish this, using export and import options like for the Director module?

The documentation mentions that "Modules may also provide sources for SNI.". That sounds as if it might solve at least part of the problem, but I'm uncertain how to proceed with it and no specifics beyond this are included as far as I can see.

Could the documentation perhaps clarify these aspects a little better for 1.3?

maggu commented 11 months ago

Ah. Just realized that SNI maps are still in INI files. Only jobs are moved to DB. But still, need to handle those as well.

yhabteab commented 11 months ago

Hi, thanks for reporting!

Unfortunately, there is no easy way to do this at the moment, given that jobs and schedules are stored separately and the schedule config is a bit more complex and quite error-prone to do it manually. Therefore, I would suggest that you continue to create the jobs INI file as before and then perform the jobs migrate command. icingacli x509 migrate jobs --author=<name>

Please note that the migrate command does not update existing jobs, but only issues SQL INSERT commands and will fail if a given job name is used twice.