https://www.puppet.com/community logo
Join Slack
Powered by
# puppet-enterprise
  • t
    On PE 2025.11.0 when managing EC encryption using a Puppet custom function the pe-puppetserver throws an exception. Same error message as in older OpenVox server packages: github.com/OpenVoxProject/openvox-server/issues/322. Solution is to upgrade jruby-openssl
    s
    m
    • 3
    • 4
  • t
    Why are there environements with empty name in puppetdb? Customer queries puppetdb for env using: curl localhost/pdb/query/v4/environments | python3 -m json.tool
  • t
    Result:
  • t
    Copy code
    [
    {
        "name": "production"
    },
    {
        "name": ""
    },
    {
  • t
    And: how to get rid of the env with empty name? We also see entries in postgresql referencing the empty env id
  • t
    /opt/puppetlabs/server/bin/psql -d pe-puppetdb -c ‘select * from environments;’ id | environment -----+------------------------------------------------------------------- 1 | production 258 | 259 |
  • t
    /opt/puppetlabs/server/bin/psql -d pe-puppetdb -c ‘select count(*) from reports where environment_id = 258;’ count ------- 5 (1 row)
  • t
    select id, certname, puppet_version, producer_timestamp from reports where environment_id = 258;
  • t
    shows us that this occurred during PE 2025.11 update on the replica.
  • t
    Correction: the reports have been stored during the upgrade of the primary, but with the old puppet agent version on the replica.
  • j
    Need some help.. Have Vulns for Postgres 4.22 with remediation to 4.23, But PE 2025.10 is at 4.22 with 2025.11 jumping to Postgres 17. Same Vuln sez it needs to be at least 17.10. Can I get some help / validation that Postgres goes to 17.10 in 2025.11 before I make this jump?
    t
    j
    • 3
    • 7
  • c
    Along with the theme of vulnerabilities scans I see our scanner is flagging nginx/1.28.2 as EOL. Newer version coming soon in PE?
    t
    • 2
    • 1
  • v
    A heads up - PE2025.11.2 release breaks eyaml. From what I can tell BouncyCastle 1.85 is to blame
    s
    • 2
    • 3
  • v
    yep. here is the story PE 2025.11.2 ships /opt/puppetlabs/share/java/bcprov-jdk18on-1.85.jar; 2025.11.0 shipped 1.84. BouncyCastle 1.85 rejects X.509 certificates whose issuer DN is empty. Certificates produced by "eyaml createkeys" have an empty subject AND an empty issuer DN, so they can no longer be parsed inside puppetserver.
  • s
    yep, repro'd here
  • j
    Ugh So don't go there or is there an easy workaround?
    s
    • 2
    • 3
  • v
    I hacked pkcs7.rb
  • v
    But I won't go prod with that 🙂
  • b
    patches welcome 🙂
    s
    s
    v
    • 4
    • 35
  • j
    Thanks Everyone for sharing...
  • e
    it also fails for us here:
    Copy code
    2026-08-27T21:01:52.439+00:00 [ERROR]: Your pe.conf file at /opt/puppetlabs/server/data/staging/pe_repo-puppet-agent-8.20.0/puppet-enterprise-2025.11.2-el-9-x86_64/conf.d/custom-pe.conf contains errors.
2026-08-27T21:01:52.446+00:00 [ERROR]: Check your pe.conf file for errors and try re-running the installer.
  • e
    unfortunately this was also supposed to fix the compilers-fail-to-check-in-after-MoM-restarts thing so looks like we're stuck 😢
  • e
    ah. so earlier in the log, I see this:
    Copy code
    ## We're checking if /opt/puppetlabs/server/data/staging/pe_repo-puppet-agent-8.20.0/puppet-enterprise-2025.11.2-el-9-x86_64/conf.d/custom-pe.conf contains valid HOCON syntax...

2026-08-27T21:09:31.367+00:00 Running command: /opt/puppetlabs/installer/bin/validate_pe_conf.rb /opt/puppetlabs/server/data/staging/pe_repo-puppet-agent-8.20.0/puppet-enterprise-2025.11.2-el-9-x86_64/conf.d/custom-pe.conf
./puppet-enterprise-installer: line 665: /opt/puppetlabs/installer/bin/validate_pe_conf.rb: No such file or directory
2026-08-27T21:09:31.382+00:00 [ERROR]: !! Validation failure. !!
Rolling puppet-agent back to 8.20.0.
Rolling pe-installer back to PE 2025.11.0.
Rolling pe-modules back to PE 2025.11.0.
    something missing from the installer build?
    s
    c
    • 3
    • 5
  • j
    Anyone run into an error when upgrading the Replica via the puppet infrastructure cmd during 2025.11.2 upgrade.... The plan fails:
    Copy code
    {
  "msg": "Failed to execute the task for the non blocking 'apply apply' request (transaction 1926). Unexpected error: ssl-crl setting is requried for apply",
  "kind": "puppetlabs.orchestrator/execution-failure",
  "details": {
    "file": "/opt/puppetlabs/puppet/modules/enterprise_tasks/plans/upgrade_and_migrate_replica.pp",
    "line": 382,
    "node": "<replica hostname redacted>",
    "column": 5
  }
}
    I checked the webserver.conf on the main pe server and the ssl-crl-path is specified in there.
    t
    • 2
    • 4
  • g
    We use _*pe_patch*_ and for debian we have used the option autoremove = true to clean up old kernels among other things. Yet, we see that this leaves many old kernel versions in the state "rc" instead of doing what "apt purge kernel...." would do, i.e. cleaning up properly. Is this a bug or a a very conservative behaviour on the part of the pe_patch module? Does anyone know?
  • k
    I don't think there is a way to purge them. do kernel packages even have any config files left behind? I'd just ignore them, unless you want to run 
    aptitude purge ~c
    occasionally
  • k
    even unattended-upgrades doesn't purge old kernel packages, it just removes the packages
  • k
    oh there is an 
    autopurge
    subcommand of 
    apt-get
    that would do it
  • j
    Morning..Has anyone run into the scenario where after upgrqading to v2025.11.2, that the pe_postgres_info fact shows both Version 14 and Version 17 info together in the fact.. as opposed to just the 17 info as expected?
    z
    j
    +2
    • 5
    • 7
  • v
    Hi. Curios mind wants to know. why 2023.8.11 has puppet agent 8.21.0, but 2025.11.3 only 8.20.0 ?
    s
    b
    • 3
    • 8