Unable to use custom constant for `TicketSalt`

Hi,

we are deploying a three level Icinga cluster in our datacenter with the puppet-icinga2 module.

Due to company limitations, we need to configure sensitive strings like passwords and the ticket_salt on the signing CA master with an external password manager.

Because of restrictions with the Puppet module I’m unable to work with the default TicketSalt constant in our environment, more information about this can be found here:

https://github.com/voxpupuli/puppet-icinga2/issues/803

I want to work with a new constant called CustomTicketSalt which is set in an external config file which then is included and set in ApiListener configuration:

~ icinga2 variable list | grep Salt
CustomTicketSalt = 2b[…]

~ cat /etc/icinga2/features-enabled/api.conf 
# This file is managed by Puppet. DO NOT EDIT.

object ApiListener "api" {
  accept_commands = true
  accept_config = true
  ticket_salt = CustomTicketSalt
}

However, the Icinga CLI does not seem to read the custom constant, generating a client ticket for example results in an error:

~ icinga2 pki ticket --cn agent1.localdomain
critical/cli: Ticket salt (--salt) must be specified.

It seems like the ticket_salt = CustomTicketSalt config is not used at all and Icinga always looks for the default TicketSalt constant.

Regards,
Alex

Start by reproducing the shown icinga2 pki ticket --cn agent1.localdomain failure with the ApiListener configuration using CustomTicketSalt, after checking the available constants with icinga2 variable list | grep Salt. Trace how the CLI obtains the ticket salt versus the configured constant. Done means the custom constant is honored without requiring --salt.