C2C blog post: Automatically renewing Puppet Certificates

auth.conf

{
    name: "Allow nodes to delete their own certificates",
    match-request: {
        path: "^/puppet-ca/v1/certificate(_status|_request)?/([^/]+)$",
        type: regex,
        method: [delete]
    },
    allow: "$2",
    sort-order: 500
}

certificate.pp

class profile::puppet::certificate (
  String $psk,
) {
  file { '/etc/puppetlabs/puppet/csr_attributes.yaml':
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0440',
    content => "---\ncustom_attributes:\n  1.2.840.113549.1.9.7: '${psk}'\n",
  }
  ~> puppet_certificate { $::trusted['certname']:
    ensure               => valid,
    onrefresh            => 'regenerate',
    waitforcert          => 60,
    renewal_grace_period => 20,
    clean                => true,
  }
}