Puppet Community

and working on a shared workflow for ra10ke st <https://github.com/voxpupuli/gha-puppet/pulls|https://github.com/voxpupuli/gha-puppet/pulls>

i'm still trying to learn about workflows in general, but i still need to re-organize things from the current "everything in three repos" to the normal "control repo plus one repo per module" layout, before i'll be able to do anything like that ... i have a list of things to check out if i ever think i'll be able to do that conversion, i've added these two things to that list. thanks for the pointers.

yes we have been moving that way in the recent releases now that it has been “road tested” the recent blog publications are a signal its safe to consume

ill see if there is an official statement

time to migrate my 40 environments then :smile:

<https://puppet.com/blog/lockless-code-deploys-in-puppet-enterprise-continuous-delivery-for-pe/>

hmm, when I played with it just recently there were a lot of errors in puppetserver log

on which version were you? I tried it on 2021.5 and that worked fine

```2022-05-01T19:00:02.646-04:00 WARN  [clojure-agent-send-off-pool-114] [c.p.p.ShellUtils] Executed an external process which logged to STDERR: generate-puppet-types.rb: Command /opt/puppetlabs/bin/puppet generate types --environment 'unix_testing' --environmentpath '/etc/puppetlabs/code-staging/environments/' --modulepath '/etc/puppetlabs/code-staging/environments/unix_testing/modules:/etc/puppetlabs/code-staging/environments/unix_testing/site:/etc/puppetlabs/code-staging/modules:/opt/puppetlabs/puppet/modules' exited 1```

```generate-puppet-types.rb: STDERR --   Error: /etc/puppetlabs/code-staging/environments/unix_testing/modules/rvm/lib/puppet/type/rvm_gem.rb: title patterns that use procs are not supported.```

I think some modules expect code to be in code and link is not created

I would expect /etc/puppetlabs/code would be modified as a link, but it's just left behind

yeah and reverting back blows up spectacularly and doesn't clean versioned_environment_dirs setting in puppet conf

I did a rm -rf in a code-manager dir to purge the git repos and removed the versioned_deploys: true setting, that worked fine

single 2021.5 primary without replica/compilers

I think it stores it in enterprise/ files end refuse to die :slightly_smiling_face:

I explicitly set puppet_enterprise::profile::master::versioned_deploys to false and yet I get
versioned_environment_dirs = true in puppet.conf

I didn't care much for that test anyway, so I just wiped it out :)

ah yes I still have that, but stuff still works

it was irritating me, I am not a patient person :slightly_smiling_face:

Sorry the `versioned_environment_dirs` is causing confusion having it set will cause Puppet to readlink &amp; expandpath the environment path if it is a symlink. It was a behavior we were worried might cause unexpected issues in FOSS so we put it behind a flag, but we turn it on unconditionally in PE

<https://github.com/puppetlabs/puppet/blob/main/lib/puppet/environments.rb#L198> is all it does

Sounds like maybe a bug in their new partial deploy stuff… but if you specify a branch it should evaluate it every time and I haven’t had a problem with it.

If that’s the same issue I’m thinking of we fixed it in the upcoming release of PE.  You can contact support with the details and if it’s a match get a hotfix or a workaround until the next release.

I want to deploy all my enviornments via a github webhook.  I was trying to use the deploys API but it requires a json payload and not html parameters. <https://puppet.com/docs/pe/2019.8/code_manager_api.html#code_mgr_post_deploys>

github webhooks support both, you can configure it

ahh I’ll use that.  I thought the api supported both forms but only the payload

so the usual github webhook can call any site and provide information about the event as url encoded or jskn

but you cannot set your own payload. but code manager has a proper endpoint for github

or use a github action and set your desired payload?

and the normal webhooks api doesn’t support “All”

what’s the use case for having a repo tell code manager to deploy all environments?  Is this a module that you want deployed to all environments?

YAML based environments: <https://github.com/nwops/puppet-environments>

Anytime that r10k-environments file is updated I want to deploy all.

you really really want to deploy them all or you want to deploy the ones that you added, removed or modified?

but I need some extra code for that.  Right now this is just a hack.

makes sense.  I don’t think you can do that :disappointed:

action that hits the api directly seems like what you’d have to do

I am interested to know how you are using the YAML based environments for your workflow if you’d be willing to educate me over a call

I wrote this but it may not detail enough: <https://logicminds.github.io/blog/2022-02-22-trunk-based-development-for-your-control-repo/>

just to clarify my understanding.  So you deploy to QA ( and already deployed the same SHA to test and dev) now you find an issue…

You’ve been adding commits that are being deployed to test.  So when you fix the issue you found, that commit is after 4 commits that are already merged to main because they are deployed to test.

In order to take up your fix for QA you still need to take up 4 extra commits.

Am I missing something?  Is that just not a common problem?  or that’s an acceptable workflow?

yes, different “infra environments” with different hiera data.  Sometimes a mix of infra envs and puppet envs

So while code works in one env it might not in the other

This is a common flow I find at almost all clients

In PE you install the agent first then run a command that turns it into a compiler

so it’s required that the agent be on each puppet server ( which we call compilers )

As for using LetsEncrypt… I think you’re asking about how to turn PEs CA into an intermediate CA?

No. All of the automation PE has for issuing and maintaining agent certificates is tied to using the PE CA.

You can run the PE CA as an intermediate, but Let’s Encrypt won’t issue certificates with `CA: TRUE` set. They’d be kicked out of the “browser trusted” club if they did.

Yup. It’s a vastly simpler setup and maintenance schedule. Running PE as an intermediate has to provide significant benefits to balance the additional cost in complexity.

Sure, just wanted to remove the browser warning when going to PE web interface. Guess we will just click the "Advanced - Accept risk" option.

Ahhhhhhhh. Removing the browser warning is a completely other thing in a parallel universe to customizing the PE CA.

That’s totally doable with a Let’s Encrypt cert. Here’s the config instructions:

<https://puppet.com/docs/pe/2021.5/use_a_custom_ssl_cert_for_the_console.html>

for tuning reasons I have set the `puppet_enterprise::puppetserver_ram_per_jruby` parameter to `2048` on our compilers, but how can I verify this setting? should it be visible somewhere in the logs?

I would guess that sets the xmx/xms for the puppetserver jvm and other things

<https://puppet.com/docs/pe/2021.2/tuning_infrastructure.html#tuning_parameters>