It is only valid on a Puppet master server. In Puppet apply, the compiler doesn’t add certificate extensions to
More about certificate extensions
When a node requests a certificate, it can ask the CA to include some additional, permanent metadata in that cert. (Puppet agent uses the
csr_attributes.yaml file to decide what extensions to request.)
If the CA signs a certificate with extensions included, those extensions are available as trusted facts in the top-scope
$trusted variable. Your manifests or node classifier can then use those trusted facts to decide which nodes can receive which configurations.
By default, the Puppet-specific registered OIDs appear as keys with convenient short names in the
$trusted[extensions] hash, and any other OIDs appear as raw numerical IDs. You can use the
custom_trusted_oid_mapping.yaml file to map other OIDs to short names, which will replace the numerical OIDs in
The output of
puppet cert print reflects changes made in
custom_trusted_oid_mapping.yaml immediatly without requiring a restart.
For more information, see:
Limitations of OID mapping
Mapping OIDs in this file only affects the keys in the
$trusted[extensions] hash. It does not affect what an agent can request in its
csr_attributes.yaml file — anything but Puppet-specific registered extensions must still be numerical OIDs.
After restarting puppetserver once custom OID mapping values are set, you can reference variables using only the short name.
The OID mapping file is located at
$confdir/custom_trusted_oid_mapping.yaml by default. Its location is configurable with the
The location of the
confdir depends on your OS. See the confdir documentation for details.
--- oid_mapping: 188.8.131.52.4.1.343184.108.40.206.1: shortname: 'myshortname' longname: 'My Long Name' 220.127.116.11.4.1.34318.104.22.168.2: shortname: 'myothershortname' longname: 'My Other Long Name'
custom_trusted_oid_mapping.yaml must be a YAML hash containing a single key called
The value of the
oid_mapping key must be a hash whose keys are numerical OIDs. The value for each OID must be a hash with two keys:
shortnamefor the case-sensitive one-word name that will be used in the
longnamefor a more descriptive name (not currently used for anything).