Puppet Community

Ok I think I have a disconnect when it comes to using puppet to manage resources on the server itself.  Where am I creating this manifest at?

alright i'll upgrade, look, I don't know what i'm doing <@U1PC2RAH0>!!!

I can create and manage manifests for the environments, but i haven't done anything related to managing resources on the actual server

You can use the puppet-debugger tool for this <https://www.puppet-debugger.com/>

Pdk console if you used pdk and inside a module

```~ puppet apply -e 'alert("Hello world")'
Alert: Scope(Class[main]): Hello world
Notice: Compiled catalog for ranjit.whatsaranjit.internal in environment production in 0.01 seconds
Notice: Applied catalog in 0.00 seconds```
As long as the function is in the modulepath.

Currently using a Control-Repo and r10k to manage my environments and their related Puppetfiles

I just need to be able to deploy or send a command to my agents based upon a custom fact that I've built

also all my nodes are windows, which means puppetdb wont work on them?

no my master/compiler are both ubuntu 20.04 in azure

do you use puppet agent at all, or only bolt?

i guess the idea they had was to use agent for configuration management, and bolt to deploy if needed

so you probably have an agent running on your puppetserver

and there is some logic in the controlrepo that assigns code to this specific agent

assign it an environment, add those modules to that environments puppetfile

and you need to extend the code to also configure puppetdb + tell the puppetservers to use that puppetdb

and since the puppetserver config needs to be adjusted, you also need to change your compiler. it needs to know that there's a puppetdb on your primary

if that's done, both puppetservers will put the most recent catalogs + facts from all agents into the database + one report for each puppet agent run

and that's the source of information bolt will then use

if you know how your code is structured the configuration of puppetdb + puppetserver is quite simple actually

ok, let me get this thing pointed to it's own environment and then i'll hit this thread back up when I ultimately fail

ok single node setup, i created an environment for just the puppetmaster called puppetmaster, in puppet.conf under [agent] set environment = puppetmaster.  I have the below code in my site.pp. When i run puppet agent -t i get this error
```node '<http://puppet.r13hcilrgv3uzliozghbrt20fb.bx.internal.cloudapp.net|puppet.r13hcilrgv3uzliozghbrt20fb.bx.internal.cloudapp.net>' {
  # Here we configure puppetdb and PostgreSQL to use ssl connections
  class { 'puppetdb':
    postgresql_ssl_on       =&gt; true,
    database_host           =&gt; '<http://puppet.r13hcilrgv3uzliozghbrt20fb.bx.internal.cloudapp.net|puppet.r13hcilrgv3uzliozghbrt20fb.bx.internal.cloudapp.net>',
    database_listen_address =&gt; '0.0.0.0',
  }
  # Configure the Puppet master to use puppetdb
  class { 'puppetdb::master::config': }
}```

i've added puppetlabs-firewall to my Puppetfile, still doesn't want to run

See the `puppetlabs-firewall` module at <https://forge.puppet.com/puppetlabs/firewall?src=slack&amp;channel=puppet>

just having the firewall module available isnt enough. you also need to have it in the catalog. you can do that with `include firewalld` in your manifest. or: you check which modules depends on it and disable it.

you maybe dont want it to manage your firewall

i don't really want to manage my firewall

how do i check which modules depend on it?

I dont know what database_listen_address does. but if that tells postgresql to listen on all interfaces thata probably. ot what you want

thats in the line below your screenshot :)

<https://forge.puppetlabs.com/modules/puppetlabs/puppetdb>

this is what i'm using as instructions basically

the error should tell you where its coming from

<https://github.com/puppetlabs/puppetlabs-puppetdb/blob/main/manifests/init.pp#L76|https://github.com/puppetlabs/puppetlabs-puppetdb/blob/main/manifests/init.pp#L76>

Is there a way with `puppet-query`  to only show those reports that have a match within a message, which is in the `log.data[]` within each report

I guess I could just get it close and then use jq to look for it.

I’m still getting that `Lookup using eyaml lookup_key function is only supported when the hiera_eyaml library is present on node` intermittently and it shouldn’t be.  It should fail on all catalogs if it’s a problem on the master.

Maybe some agents aren’t using Hiera data that uses the eyaml backend?

Is eyaml your ownly Hiera backend, or do you only use eyaml on some layers of the hierarchy?

Is eyaml your ownly Hiera backend, or do you only use eyaml on just some layers of the hierarchy?

Is eyaml your only Hiera backend, or do you only use eyaml on just some layers of the hierarchy?

If the eyaml gem was botched on one Puppetserver, I would suspect it’s botched on the rest of them too, and re-installing it to fix the problem across the board makes sense to me.

are you talking about exported resources?

Exported resources are compiled as part of the catalog of the exporter, so any relevant Hiera lookups would be done from the context of the exporter.

By the time the resource gets to the Collector, it's just a hash of static data coming out of a catalog stored in a backend like PuppetDB.

Yeah, trying to figure out what a Hiera lookup would look like, or if I should just avoid it entirely. I see in the docs that there's a caveat on resource attribute defaults, so not sure if there's similar complexity with Hiera.
&gt; Normally, exported resource types include their default attribute values. However, defined types are evaluated for the catalog after the resource is collected, so their default values are not exported. To make sure a defined type's values are exported, set them explicitly.
<https://puppet.com/docs/puppet/7/lang_exported.html#lang_exported-exported-behavior>

Thanks, <@U11MDJNGZ>! That makes sense, just wanted to make sure I wasn't missing anything.

Although, that docs page is probably relevant. Exporting Classes or Defined Types is a bit of an odd case.

Exported Resources work best when used on simple, uncomplicated, resources.

The defined types in question are pretty simple, basically just wrappers around `file` for monitoring logic, but would like to lookup some data from Hiera to get some boiler-plate configs by service type without having to add the lookups to the class of every monitored service.

exported resources work best when not used

there can be a pretty heavy performance hit when you have lots of exported resources/collecting going on

I think the current wisdom is to use puppetdb_query (<https://puppet.com/docs/puppetdb/7/api/query/tutorial.html#querying-with-puppet-code>) and just search for the info you need.

Interesting... I think we might have to stick with exported resources for now because right now things are classified via node-scope variables, which I don't think I'd be able to select on, but this makes a good case for future improvements. Thanks!

hi all, we have now Puppetserver ( master )  and Agents.
The Agents have only one Puppetserver ( master ).
Its possible to have multiple Puppetserver ( master )?  if one failed that Agents conntact the another one ?

thanks in advance

can you explain `list puppetservers in recent agent versions` a little bit more please?   do you mean I can add servers=srv1,srv2 ? in puppet.conf on the Agent?

look at `server_list` <https://puppet.com/docs/puppet/6/configuration.html#server-list> believe this was also available in puppet5, not sure about puppet4 or earlier

thank you so much <@U012ASYJN0L> and <@U1PC2RAH0>.

So in `puppet.conf` on agent I have add
`server=primarysrv`
`server_list=secondarysrv` 

right ?

why do you want to set both? did you read the docs about server_list?

Sorry <@U1PC2RAH0> I mean with my question I have to have both or I should replace current `server` configuration with `server_list=[srv1, stv2]`

the documentation says:
&gt; The list of primary Puppet servers to which the Puppet agent should connect, in the order that they will be tried.


thank you so much <@U1PC2RAH0>, one more question please. any suggestion how can I synch the both Puppetservers ? I use also foreman :$

the keys must be available on both Puppetservers or not ?

I mean when primaryserv is down, the agent conntact the secondarysrv right ?

So the certificates etc must be on secondarysrv too or not ?

If not whats the benifit of secondarysrv ? multi-puppetservers

usually people have one puppetserver acting as CA only and a bunch of compilers. agents can connect to all compilers. you can do that via the server_list option or a loadbalancer or srv records. the CA can be explicitly configured on the agent, or via srv records I think, or the a loadbalancer redirects CA requests to the CA and other requests to a compiler pool. certificates only need to be present on the one node that's related to the certificate.

Thank you so much <@U1PC2RAH0>, I think I have to learn more about Keys/CA.
 I have also to understand this part:

`you can do that via the server_list option or a loadbalancer or srv records. the CA can be explicitly configured on the agent, or via srv records`

there are different options available how agents can be distributed across multiple compilers. the best one depends on the environmen/setup you have

in the end it's just HTTPS and everything you find in the internet about HTTPS loadbalancing applies here as well

Okay, thank you so much. Ill read more about loadbalancing. Ill ask here again if I have any questions :slightly_smiling_face:

you can check the puppetserver.log. there should be some information about code deploys when a webhook is triggered

<https://puppet.example.com:8170/code-manager/v1/webhook?type=gitlab&amp;token=test>  this how is my webhook

I see, I think found reason. I use that webhook on module repos and module repos uses master branches

I need to change them to appropriate env brances? it will help?

depends what you reference in your Puppetfile

triggering the code-manager on pushes to a branch works fine

hello, should code manager webhook immedieatly update code-staging folder? because I see webhook returns 200 but code not changed on server side, manually try and this time works

Puppet 6 removed the Puppet cert commands

puppetserver ca list

is the new format you can see command details here <https://puppet.com/docs/puppet/7/server/subcommands.html#available-actions>

<https://puppet.com/blog/certificate-improvements-puppet-6/> also gives some background to its replacement