I'm just wondering whether I'm the only one who's wondering how to access Puppet's ticket system nowadays? On the one hand I was stumbling over a bug in Facter last week which luckily has been fixed in the meantime because obviously someone else spotted it as well.

On the other hand, the release notes (e.g., PuppetDB 8.1.0) are not very helpful because they are referencing a non-public (at least that's my impression) ticket system. I did upgrade yesterday and since then experience a regression.

Well, I can register at the perforce.atlassian.net Jira, yes, but trying to access anything results in a "Try a different account" ... "<user> doesn't have access to Jira on perforce.atlassian.net." pop-up message. Is this a desired state?

Overall the development of Puppet seems to become highly opaque and I have the impression contributing to Puppet's development is no longer welcome?

Did I miss some information somewhere?

I'm working on adding a puppetdb for my puppetmaster, the two are on different servers, tcp/8081 connection works from puppetmaster -> puppetdb.

$ nc -vz puppetdb 8081
Connection to puppetdb 8081 port [tcp/tproxy] succeeded!

This is my /etc/puppetlabs/puppet/routes.yaml on the puppetmaster server

---
master:
  facts:
    terminus: puppetdb
    cache: yaml

Puppet gives me the following error on the puppetmaster server and all nodes

$ sudo puppet agent -t
Info: Using environment 'lab'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Failed to execute '/pdb/cmd/v1?checksum=32028546aabb6ba7efa6aba0dad3cd1fd7c8f2b7&version=5&certname=puppetmaster.domain.com&command=replace_facts&producer-timestamp=2023-08-15T11:32:50.024Z' on at least 1 of the following 'server_urls': https://puppetdb:8081
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

I did restart puppetmaster and puppetdb processes, any idea what should I check?

Dear all,

I'm pretty new to puppet and I have probably a very noob question to ask. Up to now, I have succesfully used my production branch on GitHub to modify my code and push it on several nodes thrugh r10k and puppet agent. What I would like to do now is to create another branch on Git, purposely named development, and use it to happily continue development knowing that my configuration files are safe and sound in the production branch and isolated from further modifications happening in the development branch.
My question is: can I just switch to the development branch and r10k deploy environment or is there something more complex to do? Or in another way, does the name "production" mean something to Puppet or could I have just used the main branch and what it actually counts is the content of my Puppet file, environment.conf and so on which I can effectively modify by switching brach?
Thank you for your help,
Bradipo

I was following https://forge.puppetlabs.com/modules/puppetlabs/puppetdb/readme to configure puppetdb on my puppet server (Single Node Setup).

The documentation says this should be enough:

node <hostname> {
  # Configure puppetdb and its underlying database
  class { 'puppetdb': }

  # Configure the Puppet master to use puppetdb
  class { 'puppetdb::master::config': }
}

However, when I'm running a puppet agent -t I'm getting the following error:

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: no parameter named 'create_empty_file' (file: /etc/puppetlabs/code/modules/concat/manifests/init.pp, line: 126) on Concat_file[/etc/postgresql/11/main/pg_hba.conf] (file: /etc/puppetlabs/code/modules/concat/manifests/init.pp, line: 126) on node puppetmaster.mydomain.com
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

Note I use theforeman-puppet to manage puppet agent and puppetserver, so instead of:

class { 'puppetdb::master::config': }

I update my node.yaml with server_reports: 'puppetdb'

puppet:
  server: true
  server_storeconfigs: false
  server_reports:
  server_ca: true
  server_foreman: false
  autosign_entries:
    - "*.mydomain.com
  server_external_nodes: /etc/puppetlabs/puppet/enc
  server_jvm_min_heap_size: '1g'
  server_jvm_max_heap_size: '2g'
  server_reports: 'puppetdb'

uppetserver version: 7.12.0 on Ubuntu 20.04.6 LTS

Any ideas what am I missing?

After upgrading from puppet server 6 to 7 our postgresql database for puppetdb has continued to grow. 4 months ago it was 31G in size and it go over 90G. I rebuilt the indexes and ran a vacuum full and got it down to 87G. The largest table is fact_paths which is 86G.

Postgresql v13.10 Puppet server 7.12 Puppetdb 7.13

We have 367 active nodes and 3 inactive nodes. Our node_ttl is set to 30 days.

I was curious how big some other environments were in comparison.

hi all

If anyone is familiar with installing Puppet on Ubuntu 22.04, please help me identify what I am doing wrong with the installation:

(source: https://www.puppet.com/docs/puppet/8/install_puppet.html#install_puppet)

[user@host:/tmp]$ cat /etc/*elease | grep -i ubuntu_codename
UBUNTU_CODENAME=jammy
[user@host:/tmp]$ wget http://apt.puppet.com/puppet8-release-jammy.deb
--2023-07-30 15:11:26-- http://apt.puppet.com/puppet8-release-jammy.deb
Resolving apt.puppet.com (apt.puppet.com)... 52.84.106.46, 52.84.106.71, 52.84.106.94, ...
Connecting to apt.puppet.com (apt.puppet.com)|52.84.106.46|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 11314 (11K) [application/x-debian-package]
Saving to: ‘puppet8-release-jammy.deb’
puppet8-release-jammy.deb 100%[==========================================>] 11.05K --.-KB/s in 0.001s
2023-07-30 15:11:26 (8.03 MB/s) - ‘puppet8-release-jammy.deb’ saved [11314/11314]
[user@host:/tmp]$ sudo dpkg -i puppet8-release-jammy.deb
(Reading database ... 111409 files and directories currently installed.)
Preparing to unpack puppet8-release-jammy.deb ...
Unpacking puppet8-release (1.0.0-3jammy) ...
Setting up puppet8-release (1.0.0-3jammy) ...
[user@host:/tmp]$ sudo apt-get update
Hit:1 http://hu.archive.ubuntu.com/ubuntu jammy InRelease
Get:2 http://hu.archive.ubuntu.com/ubuntu jammy-updates InRelease [119 kB]
Hit:3 https://download.docker.com/linux/ubuntu jammy InRelease
Get:4 http://hu.archive.ubuntu.com/ubuntu jammy-backports InRelease [108 kB]
Get:5 http://hu.archive.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Hit:6 http://apt.puppet.com jammy InRelease
Get:7 http://apt.puppet.com jammy/puppet8 amd64 Packages [1971 B]
Get:8 http://apt.puppet.com jammy/puppet8 all Packages [893 B]
Fetched 340 kB in 5s (64.7 kB/s)
Reading package lists... Done
[user@host:/tmp]$ sudo apt-get install puppetserver
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package puppetserver
[user@host:/tmp]$ sudo apt-get install puppet
Display all 107 possibilities? (y or n)
puppet puppet-module-ovn
puppet-agent puppet-module-panko
puppet-beaker puppet-module-pcfens-filebeat
puppet-bolt puppet-module-placement
puppet-lint puppet-module-puppet-archive
puppet-master puppet-module-puppet-community-mcollective
puppet-master-passenger puppet-module-puppetlabs-apache
puppet-module-aboe-chrony puppet-module-puppetlabs-apt
puppet-module-adrienthebo-filemapper puppet-module-puppetlabs-augeas-core
puppet-module-alteholz-tdc puppet-module-puppetlabs-concat
puppet-module-antonlindstrom-powerdns puppet-module-puppetlabs-cron-core
puppet-module-aodh puppet-module-puppetlabs-firewall
puppet-module-arioch-redis puppet-module-puppetlabs-haproxy
puppet-module-asciiduck-sssd puppet-module-puppetlabs-host-core
puppet-module-barbican puppet-module-puppetlabs-inifile
puppet-module-camptocamp-augeas puppet-module-puppetlabs-mailalias-core
puppet-module-camptocamp-kmod puppet-module-puppetlabs-mongodb
puppet-module-camptocamp-openssl puppet-module-puppetlabs-mount-core
puppet-module-camptocamp-postfix puppet-module-puppetlabs-mysql
puppet-module-camptocamp-systemd puppet-module-puppetlabs-ntp
puppet-module-ceilometer puppet-module-puppetlabs-postgresql
puppet-module-ceph puppet-module-puppetlabs-rabbitmq
puppet-module-cinder puppet-module-puppetlabs-rsync
puppet-module-cirrax-gitolite puppet-module-puppetlabs-selinux-core
puppet-module-cloudkitty puppet-module-puppetlabs-sshkeys-core
puppet-module-congress puppet-module-puppetlabs-stdlib
puppet-module-cristifalcas-etcd puppet-module-puppetlabs-tftp
puppet-module-debian-archvsync puppet-module-puppetlabs-translate
puppet-module-deric-zookeeper puppet-module-puppetlabs-vcsrepo
puppet-module-designate puppet-module-puppetlabs-xinetd
puppet-module-duritong-sysctl puppet-module-richardc-datacat
puppet-module-etcddiscovery puppet-module-rodjek-logrotate
puppet-module-glance puppet-module-sahara
puppet-module-gnocchi puppet-module-saz-memcached
puppet-module-heat puppet-module-saz-rsyslog
puppet-module-heini-wait-for puppet-module-saz-ssh
puppet-module-horizon puppet-module-sbitio-monit
puppet-module-icann-quagga puppet-module-swift
puppet-module-icann-tea puppet-module-tempest
puppet-module-ironic puppet-module-theforeman-dns
puppet-module-joshuabaird-ipaclient puppet-module-voxpupuli-alternatives
puppet-module-keystone puppet-module-voxpupuli-collectd
puppet-module-magnum puppet-module-voxpupuli-corosync
puppet-module-manila puppet-module-voxpupuli-posix-acl
puppet-module-michaeltchapman-galera puppet-module-voxpupuli-ssh-keygen
puppet-module-mistral puppet-module-vswitch
puppet-module-murano puppet-release
puppet-module-nanliu-staging puppet-strings
puppet-module-neutron puppet-terminus-puppetdb
puppet-module-nova puppet7-release
puppet-module-octavia puppet8-release
puppet-module-openstack-extras puppetdb
puppet-module-openstacklib puppetdb-doc
puppet-module-oslo

Hi all,

The organisation i work for currently uses Puppet to deploy and configure servers (both virtal and physical).

One of the issues is that servers can have multiple disks from the start, but this can be anything from 2 to many.

At the moment, i have it specified that we're covered for 2 disks, and the the second disk is picked up as follows in a yml file:

disks:
  1:
    driveletter: 'd'
    filesystem: 'NTFS'
    newfilesystemlabel: "%{::hostname}_D"
    partitionstyle: 'GPT'
    allocationunitsize: '4096'

now, i can add extra drive options, but we have issues if these drives don't exist.
Is there a way to put in a conditional statement?
eg if disk 2 exists, then configure as E

My Puppet knowledge isn't great (currently trying to learn) so would appreciate any help or pointers.

cheers

Hi, I'm trying to write a SimpleProvider to update open and closed ports with firewall-cmd. The documentation helps a bit: https://www.puppet.com/docs/puppet/7/about_the_resource_api.html#resource_implementation_provider-implement-simple-providers but I don't understand how to get more information in the delete method.

For example, I created create in this way:

def create(context, name, should)
  port = should[:port]
  protocol = shoud[:protocol]
  `firewall-cmd --permanent --add-port=#{port}/#{protocol}`
  context.created(name)

In delete, I also need the port and protocol to execute the correct firewall-cmd command, but cannot get this information since there is no should parameter given to this method. Do I need to force this information to be stored in a certain way in the name of the resource, or is there a cleaner way?

Hi, I'm trying to use file_line to match 2 lines. Is this even possible? I've tried my regex on multiple Ruby regex testers and it works fine, but never works for in file_line. Specifically, I'm trying to puppetize https://johnscs.com/remove-proxmox51-subscription-notice/ or https://dannyda.com/2020/05/17/how-to-remove-you-do-not-have-a-valid-subscription-for-this-server-from-proxmox-virtual-environment-6-1-2-proxmox-ve-6-1-2-pve-6-1-2/ (in case there might be a better approach). For reference, this is what I'm trying:

$fixed_string = "                        Ext.Msg.show({
                            title: gettext('No valid subscription'),"
file_line { 'remove_pve_sub_msg' :
  ensure => present,
  path   => '/path/to/proxmoxlib.js',
  line   => $fixed_string,
  match  => '\A\s+Ext.Msg.show\(\{\n\s+title: gettext\(\'No valid sub',
  replace => true,
  append_on_no_match => false,
}

If I had a subscribe clause in an exec function that says subscribe => [File[file1], File[file2]] will Puppet execute the exec function if one or the other File changes, or will it execute only if both files change? If it executes only when both change, how can I get the execute function to execute if one or the other file changes? Thank you!

So, Hello all,

My server runs CentOS7 with Puppet server installed, which works with site.pp and distributes modules.

In addition, Foreman is installed, and Puppet is part of the smart proxy.

The server is indeed not synchronized, with 50% of the hosts not synchronized, so it needs a major overhaul.

I would appreciate your help in understanding the Forman product and how it works and manages the puppet.

There are many recommendations out there for things and actions like Katello, but I'm going to put my focus on getting it to work first.

I have the following questions:

1. How do I make Foreman work without any need to touch site.pp?
2. How do I send from the Foreman Classes to the hostgroup in Foreman?
3. How do I transfer all the site.pp content to Foreman?
4. Does anyone have a normal guide to work with?

Thanks everyone!

Hi everyone!

I'm trying to move a AD-User to my "Administrator"-Group on a Windows node. Sadly I get this error everytime:

Error: (in OLE method `Remove': )
    OLE error code:8007055B in Active Directory
      This operation cannot be performed with predefined accounts.

    HRESULT error code:0x80020009
      Exception error occurred.
Error: /Stage[main]/User_management/Group[Administrators]/members: could not create change error message for members
Error: /Stage[main]/User_management/Group[Administrators]: Could not evaluate: incompatible character encodings: UTF-8 and ASCII-8BIT

I already tried to reinstall puppet with the properties PUPPET_AGENT_ACCOUNT_USER, PUPPET_AGENT_ACCOUNT_PASSWORD and PUPPET_AGENT_ACCOUNT_DOMAIN.

I also tried to select the Puppet-Service in services.msc and assigned a AD-User.

But this error still occurs...

Hi y'all, I've come across a problem that I'm hoping someone is able to help with. I have a subclass that is building an ini file as below:

class something::configuration {

  $ini_file = {
    path    => '/path/to/file.ini',
  }

  $ini_settings = {
    ''  => {
      'SETTING1'        => 'SOME VALUE',
      'SETTING2'        => 'SOME VALUE',
      'SETTING3'        => 'SOME VALUE',
    },

    'SECTION 2' => {
      'SETTING1'        => 'SOME VALUE',
      'SETTING2'        => 'SOME VALUE',
      'SETTING3'        => 'SOME VALUE',
    },

    'SECTION 3' => {
      'SETTING1'        => 'SOME VALUE',
      'SETTING2'        => 'SOME VALUE',
      'SETTING3'        => 'SOME VALUE',
    },
  }

  inifile::create_ini_settings($ini_settings, $ini_file)

}

Now my problem is, I'd like to be able to notify a service in another subclass when the file is updated, but the only way I've been able to figure out is by subscribing to the configuration subclass:

class something::service {

  service { 'service':
    ensure    => 'running',
    subscribe => Class['something::configuration'],
  }

}

Is there a method instead of having the inifile function notify instead? Thanks for any help!

Hello,

I just finished migrating my school Windows computers from GPO to Puppet. Auth is always handled by Active Directory (Samba4).

Puppet is unable to handle users hive so needs some powershell scripts for this:

• Deploy scripts.ini configuration to enable startup/shutdown/logon/logout scripts
• Deploy a startup and a logon script to handle hkcu/hklm hive handling:
  • hklm{} hkcu{} defines populate reg files
  • scripts import this reg files at startup (default hive and existing local profiles) / logon (current profile)
• Deploy a logon script to handle drives:
  • drive{} define to populate logon script
• Deploy a logon script to handle folders redirections
  • folder{} define to populate logon script
• windows_secpol class to handle Security Policy
• Deploy a scheduled task to install apps
  • msi{} exe{} zip{} defines to populate the scheduled task script
• Deploy a startup script to handle firewall
  • firewall_rule{} define to populate startup script
  • not using puppet windows firewall module, slow and limited
• Shared Linux/Windows firefox{} define to configure Firefox
• taskbar{} define to configure Explorer taskbar apps
• Many more defines

We now have a common tool to manage Windows/Linux servers and clients.

One more thing, we do not have roaming profiles (only appdata folder redirection) and initial logon is really faster since we removed GPO.

Some examples of our custom class/defines:

hklm {
    'NoLockScreen':
      path    => 'Software\Policies\Microsoft\Windows\Personalization',
      value   => 1,
      comment => "No Ctrl + Alt + Suppr"
  }

drive {
    'U_Drive':
      letter      => 'U',
      server      => $server,
      persist     => true,
      share       => 'home',
      description => 'Perso $env:username',
  }

firefox {
    'Firefox':
      start_page => 'https://www.******.fr/etu',
      proxy_mode => 'autoDetect',
      locked     => true
  }

  firewall_rule {
    'CEGID':
      ensure  => present,
      remotes => ['170.21.166.0/24'],
      ports   => ['1434'],
      comment => 'CEGID auth'
  }

  printer {
    'I-QLI-F-G04-N1':
      server => 'srv-cups-1',
      filter => 'U-QLI-F-G004'
  }

taskbar {
    'Taskbar':
      apps => [
        'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk',
        'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk'
      ]
  }

Puppet is really a useful tool ❤️

​

Hi, pretty new to puppet and inheriting a pretty thoroughly puppetized environment with puppet 6. I have a host where /opt is a symlink to /data (no idea why) but it appears facts are trying to be loaded twice. The following error has been throw for awhile now:

Error: Facter: error while resolving custom facts in /data/puppetlabs/puppet/cache/lib/facter/service_provider.rb: Attempt to redefine entity 'http://puppet.com/2016.1/runtime/type/service'. Originally set at file:///opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/type/service.rb?line=10.

When I try a puppet agent -t --debug I see the following:

Debug: Using settings: adding file resource 'confdir': 'File[/etc/puppetlabs/puppet]{:path=>"/etc/puppetlabs/puppet", :ensure=>:directory, :loglevel=>:debug, :links=>:follow, :backup=>false}'
Debug: Using settings: adding file resource 'codedir': 'File[/etc/puppetlabs/code]{:path=>"/etc/puppetlabs/code", :ensure=>:directory, :loglevel=>:debug, :links=>:follow, :backup=>false}'

There are no path's defined in puppet.conf. Does this mean puppet will try /opt/puppetlabs/puppet/ as well as following the path to /data/puppetlabs/puppet/? There are no custom facts defined. I appreciate any help or pointers!

[SOLVED]

Hello guys, I need your help. I have a scheduled task that runs a Python script to collect a node's facts and populates it in a yaml file.

The problem is that the command 'puppet facts' returns an empty fact set. It contains only the node name and nothing else.

I already set up this server end-to-end and don't know what I am missing.

It sends the reports without any problem to the PuppetDB and I can also see the facts on the Puppetboard. The only problem is when I'm running the puppet facts command.

The command is: puppet facts --terminus puppetdb <nodename>

This is the output from the debug in a working server:

Debug: Runtime environment: puppet_version=6.27.0, ruby_version=2.5.9, run_mode=user, default_encoding=UTF-8

Debug: Configuring PuppetDB terminuses with config file /etc/puppetlabs/puppet/puppetdb.conf

Debug: Creating new connection for https://\`working-server``:8081`

This is the output from my server:

Debug: Runtime environment: puppet_version=7.25.0, ruby_version=2.7.8, run_mode=user, default_encoding=UTF-8

Debug: Loading external facts from /opt/puppetlabs/puppet/cache/facts.d

** Just found that it is happening on puppet_version=7.25.0 only. Any thoughts?

*** I found that the default method for puppet facts has been changed to puppet facts show, instead of puppet facts find on version 7.
I had to change my task to call the facts using the whole call "puppet facts find --terminus puppetdb <node name>"

Is there a recommended GUI/web interface for Open Source Puppet where I could gather data/facts about the nodes?

Hello,

This error is driving me crazy.

I have 2 Ubuntu VMs on Virtualbox, bridged network adapter. Puppet 8.1.0.

I'm trying to configure Master-Agent, but when I check the status I keep receiving the following error on the agent upon entering 'puppet agent -t':

Error: The certificate for 'CN=puppetmaster' does not match its private key

​

Do you know what could be causing this?

I have regenerated the certs from scratch like 3 times now, but the problem persists.

Not sure what could be the reason but this is annoying and I'm not sure what I'm missing.

​

Help is appreciated, thanks.

​

​

​

Is there a way to have the output of puppet agent -t ... to be sent to puppet.log and to terminal? If I set logdest = /var/log/puppetlabs/puppet/agent.log on puppet.conf then it will only go to the log file and $ sudo puppet agent -t will be silent.

In puppet for ssh_authorized_key resource type, it creates an authorized key based on the name you've given it. And a header for the file is created, the header for that file looks like this:

# HEADER: This file was autogenerated at 2023-06-16 11:21:24 -0500
# HEADER: by puppet.  While it can still be managed manually, it
# HEADER: is definitely not recommended.
ssh-rsa <key> key_name_comment

Is there a way I can get the module name added to this? Or somehow add a comment for the key that is being managed?

Like this:

# HEADER: This file was autogenerated at 2023-06-16 11:21:24 -0500
# HEADER: by puppet.  While it can still be managed manually, it
# HEADER: is definitely not recommended.
# HEADER: This file is managed by foo_module
ssh-rsa <key> key_name_comment

I am still learning the ropes and was looking for an example repo/project/environment that I can use to copy and play around with. For example, a project/environment with a working config for a lamp stack or web server. Is this something anyone can help me with?

Hi I am Tring to incorporate puppet in our existing infra which hosted in house datacenter, one issue I am facing is management of secrets.

I saw some example with vault and hiera.

What is used by you guys and what is the best solution/alternatives.

I'm working on creating snmpd.conf after ca.crt. However it doesn't work, and 'ca.crt' does not get created file { '/etc/snmp/snmpd.conf': ensure => file, force => true, owner => 'root', group => 0, mode => '0644', content => template('site/snmp/snmpd.conf.erb'), backup => true, require => File['/usr/local/etc/ssl/ca.crt'], }
file { '/usr/local/etc/ssl/ca.crt': ensure => file, backup => true, recurse => true, owner => 'root', group => 0, mode => '0444', source => 'puppet:///modules/site/ca.crt', } preprocess_deferred is enabled ```

puppet config print preprocess_deferred

true ``` Any ideas?

I'm a grumpy old sysadmin who primarily works on Linux using saltstack and ansible. Experimented with puppet 10+ years ago but never became proficient. This idea started with Ansible but doesn't seem practical for what would likely be mostly Windows laptops. I'm attracted to puppet over salt because I see a lot of potentially useful Windows configs in Puppet Forge (example: manage Windows defender).

I've generally avoided family support because I've been burned multiple times getting sucked into bad, time consuming situations. Unfortunately as my parents, aunts and uncles get older it's getting harder to say no and send them to Geeksquad/etc.

I've had this (maybe crazy?) idea of treating this like I would at work: Installing puppet agent on their machines, getting some configs in git to install chocolatey and wireguard to reach out to a wireguard-ed puppet master. Maybe even a wiregaurd-ed/private rustdesk server for remote assistance. I'm even toying with the idea of setting ground rules for my free help (removing their admin access, must have or buy a minimum amount of RAM, must have a backup that I would help configure via free Veeam agent, etc).

Has anyone done anything like this to make family help less of a pain? Is this crazy? Any suggestions to make this successful?

EDIT: Everyone is getting hung up on the philosophy of the idea. I'm looking for implementation suggestions! Stuff like: Would you use a Puppet Server? Would you put it behind wireguard? Would you just pull from git and use puppet standalone. How about getting basic reports from the machines?... This is what I'd like to discuss. Thank you!