custom_trusted_oid_mapping.yaml file lets you set your own short
names for certificate extension object identifiers (OIDs), which can make the
$trusted variable more
It is only valid on a Puppet master server.
In Puppet apply, the compiler doesn’t add certificate
When a node requests a certificate, it can ask the CA to include some
additional, permanent metadata in that cert. Puppet agent uses the
csr_attributes.yaml file to decide what extensions to request.
If the CA signs a certificate with extensions included, those extensions
are available as trusted facts in the top-scope
$trusted variable. Your manifests or node
classifier can then use those trusted facts to decide which nodes can receive which
By default, the
Puppet-specific registered OIDs appear as keys
with convenient short names in the
$trusted[extensions] hash, and any other OIDs appear as raw
numerical IDs. You can use the
custom_trusted_oid_mapping.yaml file to map other OIDs to short names,
which replaces the numerical OIDs in
puppetserver ca print to see
changes made in
custom_trusted_oid_mapping.yaml immediately without a restart.
Limitations of OID mapping
Mapping OIDs in this file only affects the keys in the
$trusted[extensions] hash. It does not affect what an agent
can request in its
csr_attributes.yaml file — anything but Puppet-specific registered extensions must still be numerical OIDs.
After setting custom OID mapping values and restarting puppetserver, you can reference variables using only the short name.
The OID mapping file is located at
$confdir/custom_trusted_oid_mapping.yaml by default. Its
location is configurable with the
The location of the
confdir depends on your OS. See the confdir documentation for
--- oid_mapping: 188.8.131.52.4.1.343184.108.40.206.1: shortname: 'myshortname' longname: 'My Long Name' 220.127.116.11.4.1.34318.104.22.168.2: shortname: 'myothershortname' longname: 'My Other Long Name'
custom_trusted_oid_mapping.yaml must be a YAML hash containing a single key
The value of the
oid_mapping key must be a hash whose
keys are numerical OIDs. The value for each OID must be a hash with two keys:
shortnamefor the case-sensitive one-word name that is used in the
longnamefor a more descriptive name (not used elsewhere).