Puppet Community

No, I should have been more clear. Is there a firewall blocking connections to that port despite your db listening? (`<https://your-puppet-db-url:8081/>` for example)

Is `test1001` the *certname* of the node? Or its hostname?

Yeah, I'm thinking of a different error.
```Error: Could not retrieve catalog from remote server: Error 500 on SERVER: ...```


Nodes are always referenced by their full certnames (which is their FQDN by default)

<@U112RM52S> looks like for me they are one in the same

facter -p on the agent shows FQDN/Hostname as the same, puppetserver ca list --all shows certname matching FQDN/Hostname

<https://github.com/puppetlabs/puppetserver-helm-chart/pull/129> ready to be reviewed :smile:

not that I’m aware of. As far as I know, Puppet.features don’t have a built in way to list — only to query whether a given feature exists

`Puppet.features.instance_variable_get(:@results)` will list the ones that evaluated as true, but I don’t know a public method for it

It would be a nice to have some way of getting at it. Running the agent with `--debug` outputs which features failed confinement, which was enough to point me at what the problem was but that feels like a fairly roundabout way to determine which features are present.

I agree. I’m actually surprised that it’s not a thing

As was I... I spent some timing rummaging through the core before figuring I had to have missed something. :wink:

Not that I know of (which kind of sucks), but maybe someone will correct me there.

When I need to transform data, I usually turn to `reduce()`, `map()` or any of those functions and put the result into a new "variable" (if you cannot change the value, it's not really a variable, is it?).

<https://puppet.com/docs/puppet/7/function.html>

These functions may also help you to transform data: <http://www.puppetmodule.info/list/github/simp/puppetlabs-stdlib/puppet_function>

you cannot redefine a variable in Puppet (it's influenced by functional languages).. so you should re-think your situation from this perspective..

see here: <https://puppetcommunity.slack.com/archives/C0W298S9G/p1660056328330299>

I guess this is very related question with very related answers :slightly_smiling_face:

"you cannot redefine a variable in Puppet (it's influenced by functional languages).."

Maybe. But Puppet has come a long way and it started looking more like a scripting language. Which is something I'm perfectly fine with because of ease of use. E.g. if you can do loops (before Puppet 4 it wasn't as easy to do or understand as it is now), then why can't I reassign a value to a variable?
A variable seems treated as a resource (you also cannot define the same resource multiple times, for obvious reasons; I understand that), but AFAICS resources and variables are not the same thing.

I read it was possible to add items to an array back in 2013, but it was deemed a bug and the "bug" was squashed in Puppet 4.
<https://groups.google.com/g/puppet-users/c/I9Y-p3UY8JE/m/3YX7TtZysbQJ>
Therefore, not being able to reassign a value to a variable feels artificial, and it makes life with Puppet sometimes more difficult than I think it needs to be.

Anyway, this is just my 0,02 and I'm not about to start a war over this. I think the OP's question is answered. :wink:

my understanding is that, being a _declarative_ language, there's no way to guarantee that the various classes or defined type instances will be "executed" in any given order ... resources in the catalog are declared with explicit or implicit dependencies, and the agent uses these in order to build a directed graph which tells it what order to evaluate the resources in ... trying to do the same kind of thing _within the compiler_, to make sure "operations which update variables" happen in the right order related to "operations which use the final results" would be a bit of a nightmare ... the other choice would be to re-design the language so that things are executed in a deterministic order, which would be a much larger nightmare.

Well, that makes sense. And IIRC the language was already redesigned for Puppet 4.0, so... let's not go there.

if i had the time i would look into writing an "accumulator" type, where things can be added by different parts of the code, and results can be queried by other code ... unfortunately my ruby-fu is weak

usually what I recommend to people when they hit this point is to use hiera to generate the array.

if you use lookup_options you can define all the bits in many parts of the hierarchy and have hiera merge them either as a unique array, by first level hash key, or generally by a full deep merge of the hashes

it's what i do for what classes to install on a system as well as for a list of packages to install for system interop

When I need to transform data I often resort to `reduce()`. (I _have_ used the other functions as well, but not as much. And here I'm not talking about something as trivial like adding an element to an array.) I guess it's not the most optimal way for everything, but it's quite flexible and get's the job done.

yea, I try not to be in a position to need to map or reduce, I think the only place I do a map is to convert ldap group names into their dn so I can use them in an ldap query (without making people type full dns into hiera)

If they're in Hiera you could use `lookup` to get them in a separate class, or if they're class parameters reference them directly as variables in another class: `$some::class::parameter`

Once you figure out how to refer to them, you can use the array append operator `&lt;&lt;` to build them into one array, or `reduce` if you have to do some logic on each array before appending.

I'd say there should be a way with facts.. e.g. if appA is installed then set fact A, for appB set fact B.. then you can use those facts to count them and to take a decision during the catalog compilation.. though in worst case this will work on 2nd run only.. :disappointed:

the problem was, each instance of a defined type was calculating the number of file handles it needed based partly on the machine's RAM, and there were anywhere from 2-20 instances of this defined type on each machine (one per client the machine was serving) ... there _was_ no way to pre-calculate things, other than using way too high a number and hoping nothing ever spiked (so far so good)

i also had an idea to create files in a work on the target system containing the counts, then a script which ran on the target system that counted the total (similar to how `concat` works), however there was no way to pass that value back to the compiler so it could be used in the `postgresql.conf` file where it was needed

While you can do this by writing a function that makes use of the caching feature in the 4x function API (or storing it in a file, the difficulty is using the final value since you cannot really do much after all classes have been evaluated. Only the spaceship operator can do that so you can override values, but the values will be bound at the time the spaceship is declared, so you cannot get to the final value in the cache.

It may be possible to do this with a deferred template and a deferred function that counts the number of resources of interest i. The catalog the agent applies.

How did you check it doesn't ? that fact you set influences hierarchy search
```# grep facts  /etc/puppetlabs/code/environments/production/hiera.yaml 
      - "locations/%{facts.location}.yaml"
# echo 'location: nowhere' &gt; /tmp/whatever.yaml
# puppet lookup something --explain --facts /tmp/whatever.yaml|grep locations/
          Path "/etc/puppetlabs/code/environments/production/data/locations/nowhere.yaml"
            Original path: "locations/%{facts.location}.yaml"```
Works fine

Java 17 is likely to be the next version tested and supported. There's some preliminary efforts on that front, but it likely won't ramp up until after the next PE LTS ships.

I'll play around and see. I don't know much about r10k. It said it was a ruby based DSL, but I wasn't sure if that meant it just allowed for ruby syntax entirely.

yes, entirely, in the past I had ruby code there, when r10k lacked functionality I needed

You can also try setting an .netrc file depending on how the token is working.

i think it's just https basic auth. not sure what a netrc file is, but i'll look at that, too.

code example

```# manage r10k and creds for it
class profile::r10k(
  String[1] $password,
) {

  include profile::puppetagent
  include r10k

  # for reasons I don't understand this ONLY works if
  # you put it in $HOME/.netrc
  # I tried all sorts of nonsense and nothing else worked.
  # this provides the crendentions to r10k, root user
  # to deploy code from <http://dev.azure.com|dev.azure.com>
  netrc::simple { '<http://dev.azure.com|dev.azure.com>':
    login    =&gt; 'azure_useraccount',
    password =&gt; $password,
    path     =&gt; '/root',
  }```
Some background on netrc <https://www.gnu.org/software/inetutils/manual/html_node/The-_002enetrc-file.html>

template since I wasn't doing anything very fancy.

```site/netrc/templates/netrc.epp   
&lt;%- |
  $machine,
  $login,
  $password,
 | -%&gt;
# netrc
machine &lt;%= $machine %&gt;
&lt;% if $login { -%&gt;
  login &lt;%= $login %&gt;
&lt;% } -%&gt;
&lt;% if $password { -%&gt;
  password &lt;%= $password %&gt;
&lt;% } -%&gt;```

I loved playing MM2 back in the day. I remember when my Dad rented it for me. Then I got it for Christmas.

<@U2S1MUUQ7> I was able to create a variable and use that with string interpolation. Thanks.

• What did you change?
• Where did you change it? Which file?
• Did you edit the file directly on the Puppetserver, or are you deploying changes remotely with something like r10k/code manager?
• Did you change code in the environment that your agent is running against?

Honestly, I’ve never seen `puppet node ...` used for this kind of thing. What made you use that tool for this job?
(genuinely curious if there’s some new thing I missed, or if you’re reading bad docs).

My preferred tool for interacting with PuppetDB is `puppet query`.

<https://puppet.com/docs/puppetdb/7/api/query/tutorial-pql.html>
<https://puppet.com/docs/puppetdb/7/api/query/v4/pql.html#executing-pql-queries-using-the-puppetdb-cli>

I believe it just came up in a google search so i tried using it. I'll work on puppet query, thank you

Then from the CLI on a Puppetserver, or really any host that has the PuppetDB tools installed and configured to talk to your PuppetDB instance, run something like:
```puppet query 'nodes {}'```

```root@test-puppet:~# puppet query nodes {}
Error: Unknown Puppet subcommand 'query'
See 'puppet help' for help on available puppet subcommands
root@test-puppet:~# puppet query
Error: Unknown Puppet subcommand 'query'
See 'puppet help' for help on available puppet subcommands
root@test-puppet:~# puppet query nodes {pops1002}
Error: Unknown Puppet subcommand 'query'
See 'puppet help' for help on available puppet subcommands```

i have puppetdb installed on this server.

you need a separate package installed on OSS

<https://puppet.com/docs/puppetdb/7/pdb_client_tools.html>

Note, you could also do that query with `curl` or any generic HTTP client, but the PDB client tools are *much* easier to use (for humans) in the long term:
<https://puppet.com/docs/puppetdb/7/api/query/tutorial-pql.html#querying-with-curl>

sorry, OSS = Open Source Software, it's often used to indicate non-PE puppet :slightly_smiling_face:

just to clarify puppet cli is installed on the same server as the puppetdb, so I don't need to add that client-tools\puppetdb.conf?

i feel like i may be misunderstanding those paragraphs

i also believe that if i was using PE this all would be much easier

Yeah, with PE, this all comes installed out of the box and ready to use.

and with a [certname]{limit 5} it returned a whopping 1, it's own cert

so that means that my puppetdb isn't getting information from my agents.  Even though this is just a CA server

technically, agents don't submit data to puppetdb. puppetserver does

check puppetserver's log file, it should say `submitted to PuppetDB` there

```/var/log/puppetlabs/puppetserver/puppetserver.log```


Did you follow these steps?
<https://puppet.com/docs/puppetdb/7/connect_puppet_server.html>

That’s covers configuring your Puppetservers to send node information to PuppetDB.

so i was torn on that, because i did install this via module in Puppetfile

<https://github.com/vchepkov/puppet-bootstrap/blob/production/site/bootstrap/manifests/server.pp>

You’re using the puppetlabs/puppetdb module, and you added it to your Puppetfile?
But did you classify your Puppetservers with the `puppetdb::master::config` class?

See the `puppetlabs-puppetdb` module at <https://forge.puppet.com/puppetlabs/puppetdb?src=slack&amp;channel=puppet>

Okay, that looks good.
And just to clarify, you just have a single Puppet server that’s both puppetserver + puppetdb? Is that right?

<@U112RM52S> i believe i've added that already

I have two servers, one the Master (CA) has puppetserver and puppetdb on it, the other is my compiler which only serves my catalogs

You need to declare that `puppetdb::master::config` class on your compiler as well

Cool… so yeah, that’s probably the problem then. If your compiler isn’t configured to talk to PuppetDB, your agents that use that compiler won’t be in PuppetDB.

just making sure, i don't need the puppetlabs/puppetdb on my compiler, just on my master

if agent on puppet compiler gets catalog from itself, then yes, you need it on compiler as well

ok, i believe i've successfully got something here

It’s best to use the same `Puppetfile` on both your CA and all compilers so that all your code is available everywhere.

i just ran another query and got back not only my master but my compiler

would you suggest i use the same environment in my control-repo for master/compiler?

Cool, that’s a good sign. And now try doing a Puppet run on one of your agents that talks to the compiler. After that run, it should show up in PuppetDB too.