puppetlabs/puppet — pull request #1522 by phemmer (2013-03-10 20:15:19+00:00)
Title: add more control over certificate autosigning

This adds 2 features:

## csr_attributes_file ([#7243](https://projects.puppetlabs.com/issues/7243))
This adds a `csr_attributes_file` parameter to the puppet config which allows for specifying user defined attributes to be added to the CSR. The file is yaml instead of flat key/value as this allows you to have an array of values for a parameter (which is also allowed in a CSR). However if the user were to provide a hash in the yaml, or a nested array, it would probably break.

Example file:
```
---
1.3.6.1.4.1.34380.2.0: us-west-1a/i-355fb16d
1.3.6.1.4.1.34380.2.1: MYSUPERSECRETKEY
1.3.6.1.4.1.34380.3.3: puppet-dashboard-group-name
```

## autosign_command ([#7244](https://projects.puppetlabs.com/issues/7244))
This adds a `autosign_command` parameter to the puppet config which allows for running an external command to determine whether a certificate should be automatically signed or not. The command is passed the certificate name as the first argument. The command should then exit with status `0` to indicate that the certificate should be signed, and status non-0 to indicate it should not be signed.

----
I use these 2 features for autosigning CSRs that come from EC2 autoscaled instances. Each instance runs a small userdata script which adds a secret key and the name of a dashboard group to the CSR. The autosigning script then looks for the secret to verify the box is indeed mine, adds the box to the requested group in the puppet dashboard, and then exits with 0 to indicate puppet is OK to sign the cert.

----
I have not had a chance to develop any tests for these changes. It has been on my todo list, but I have received numerous requests to create this pull request. Should I get time to create the tests before anyone else I will do so, but I do not know when that would be.