Puppet Community

it just timeouts. it has been happening in PE2021.7, I did open ticket before and I was told that it could be related to a ticket <https://tickets.puppetlabs.com/browse/PE-34609> , But I don't have access to it

```Deploying all environments.
2023/05/04 10:14:18 ERROR - [POST /deploys][500] The deploys job failed to resolve before the wait timeout was exceeded.
{
  "errored-deploys": [],
  "timeout": 900,
  "unfinished-deploys": [
    {
      "environment": "production",
      "id": 4488,
      "status": "queued"
    }
  ],
  "unsynced-deploys": []
}```

```2023-05-04T08:56:06.086-04:00 ERROR [qtp38561487-5083911] [p.c.app] The deploys job failed to resolve before the wait timeout was exceeded.
2023-05-04T09:26:05.673-04:00 ERROR [qtp38561487-5262037] [p.c.app] The deploys job failed to resolve before the wait timeout was exceeded.
2023-05-04T09:56:06.173-04:00 ERROR [qtp38561487-3976800] [p.c.app] The deploys job failed to resolve before the wait timeout was exceeded.```

I guess will start wiping filesync ¯\_(ツ)_/¯

Hopefully simple enough question: anyone have the syntax for the console to accept a hash in a plan/task?

you should be able to specify as json hash (colons not rockets) similar to other params <https://www.puppet.com/docs/pe/2021.7/grouping_and_classifying_nodes.html#tips_for_specifying_parameter_and_variable_values> eg: `{ "key1": "value1", "key2": "value2" }`  (no outer enclosing quotes)

I think i did every combination except double quotes around the key and the value

The inputs expect JSON, so it needs to use double quotes.   The spec if you are curious:  <https://www.json.org/json-en.html>

`ca.pem` just has the CA chain. The PE services all use the Puppet agent certificate as their server certificate:

```puppet config print hostcert```

And PE services just present the leaf certificate during TLS handshakes, not the full chain. On the assumption that the client has a local copy of `ca.pem` to complete the chain for validation.

I was somehow under the impression that some PE services use a different CA but clearly I was mistaken

So yes, installing the CA (root and intermediate CA) solved my problem :ok_hand::skin-tone-2: 

Nope, same CA. And PE Services for the most part just share the certificate of the local Puppet Agent.

I'm writing a bash script that needs to run on PE compilers but fail if it runs on the MoM. what's the least-awful way to check such a condition from shell, like looking for a specific file/path or calling `facter &lt;something&gt;`?

write a bolt plan that will only run on compilers

unable, has to function without relying on PE being available

grep for your hostname from /etc/puppetlabs/puppet/puppet.conf and then grep for “server” in that.  then, if you get the answer, don’t run the command, otherwise run it.

when you use peadm to setup a PE infra, it inserts data into the certificates. you can use that to differentiate between primary and compilers

`has to function without relying on PE being available`

what does that mean? I assumed the PE services are down

So, I’m assuming from that that none of the faces will be available either

you can read the local certificates, you don't need any PE service

so, knocks against the API are also unavailable

by the time I’ve opened a file for read, grep has already done the work

you developer types always wanting elegance.  PHAH!!!!

that only works when the agent doesn't run against itself, which is possible for compilers

no I want reliable scripts :stuck_out_tongue: