Puppet Community

do you have multiple resolvers configured? is this a continues error or does it disappear if you try an again run again?

sounds like your DNS resolver is a bit broken

There won't be releases this week, but could be in a few weeks unless something unexpected comes up.

damn, okay. thanks for the heads up. do you know if the next release will be the new LTS one?

Yes, at this time the next release should include a 2019.8.z and the next LTS.

(all statements subject to the slings and arrows of outrageous fortune :wink:)

~It does not look like the `ca_crl.pem`  file was changed while revoking the certificate. Not sure if that could be related?~

Scratch that — it did .. :slightly_smiling_face: so signed cert removed, and crl file got updated. But agent still works :thinking_face:

I do use an nginx load balancer in front of it though which handels the SSL termination and adds the required headers for puppetserver:

• `X-SSL-Subject`
• `X-SSL-Issuer`
• `X-Client-DN`
• `X-Client-Cert`
It seems like somehow the CRL file didn’t get updated on the nginx proxy (which is surprising, its a shared docker file, but I’ll figure that one out).

Does it mean that, in case the load balancer does let traffic through even it should not, PuppetServer will just compile the catalog and not verify if that signed certificate was revoked or not?

When SSL is being terminated externally, Puppet Server is no longer in the business of checking things like revocation, expiration, or issuing authority. The assumption is that the load balancer is checking the validity of agent certificates.

Yeah if I make sure the new CRL is loaded by Nginx it rejects it indeed.

That’s interesting <@U11MDJNGZ> — what’s the exact purpose of the `X-Client-Cert` header then? I was assuming that it was using this information to still verify this information.

Puppet Server parses it to pull out items that get set as variables --- like `$certname` and `$trusted`.

Is that part of the code open source so that I can have a :eyes: on it? I’d assume I would find `X-Client-Cert` somewhere in the code but I only find <https://github.com/puppetlabs/puppetserver/blob/d5889d7322f2a07c110cd340bb75eb09d9e590c2/src/clj/puppetlabs/services/request_handler/request_handler_core.clj#L20-L23|https://github.com/puppetlabs/puppetserver/blob/d5889d7322f2a07c110cd340bb75eb09d9[…]lj/puppetlabs/services/request_handler/request_handler_core.clj> :thinking_face:

I think you're looking in the right place. The rest of the code like refers to that header as `header-client-cert-name`.

Yeah I tried searching for that but maybe github search isn’t what I expect it to be :slightly_smiling_face:

What problem are you trying to solve at this point? The first issue was that revocation checking is part of the TLS handshake and that handshake has been offloaded to NGINX. Duplicating TLS logic back to Puppet Server seems like a lot of complexity with a bad cost-benefit story.

Nothing to solve. I just wanted to give you extra karma but the robot does not seem to like it :wink:

In my case it seems like my load balancer did not somehow get the up to date CRL file. So the loadbalancer didn’t 400 the traffic coming from the agent. After making sure it has the up to date file, it started blocking the traffic.

~It does not look like the `ca_crl.pem`  file was changed while revoking the certificate. Not sure if that could be related?~

Scratch that — it did .. :slightly_smiling_face: so signed cert removed, and crl file got update.

~It does not look like the `ca_crl.pem`  file was changed while revoking the certificate. Not sure if that could be related?~

Scratch that — it did .. :slightly_smiling_face: so signed cert removed, and crl file got updated.

That's great to hear!  So if I am building a nomad cluster, should I have 3 nodes ready and deploy away, or is there a systematic way to build it out?

Puppet Server parses it to pull out items that get set as variables --- like `certname` and `$trusted`.

Ok, built a module.  I then add that module as a class to my site.pp file in my environment so that my nodes get it?

module has pilot_groups.pp in it with this as the code

```class test_pilot_groups::pilot_groups {
  file { 'C:/test_pilot_groups/':
    ensure =&gt; directory,
    path   =&gt; 'C:/test_pilot_groups/',
    source =&gt; 'puppet:///modules//test_pilot_groups//files//',
  }
}```

```node default {
  # This is where you can declare classes for all nodes.
  # Example:
  #   class { 'my_class': }
  class { 'test_pilot_groups': }
}```

```Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Could not find declared class test_pilot_groups```

You can leave out the path argument if you want.  Puppet will use the <https://puppet.com/docs/puppet/7/types/file.html#file-attribute-path|resource title> by default.

it should be
```include test_pilot_groups::pilot_groups```
:sunglasses:

`class { 'test_pilot_groups': }` should be: `class { 'test_pilot_groups::pilot_groups': }`