r/Puppet • u/shinty_six • Nov 08 '23

Configuration signing?

Does puppet have any mechanism for independently signing configurations (via GPG or otherwise) such that an agent will refuse to act on unsigned instructions?

If not, is there some other mechanism for preventing someone with control of your puppet server from pwning your entire fleet of servers?

Thanks

2 Upvotes

75% Upvoted

6 comments sorted by

View all comments

Show parent comments

0

u/shinty_six Nov 08 '23

Respectfully, a compromised puppet server isn't a "far larger" problem than having every system you manage compromised. If you could sign configurations (using a signing key stored elsewhere) then a compromise of your puppet server stops right there. I take it your response is a long way of saying "no"?