Puppet Community

<https://github.com/puppetlabs/puppetlabs-apache/blob/main/manifests/params.pp#L758-L762>

oh, yea in hiera it either needs to be `["one", "line"]` or
```key:
  - "multi"
  - "line"```

Hi all I have been using the the vault_lookup forge module <https://forge.puppet.com/modules/puppet/vault_lookup>
I have been trying to use the secret stored to use to configure a another module <https://forge.puppet.com/modules/sgnl05/sssd>
This is the code I have been using
```$ldap_bind_pws = Deferred('vault_lookup::lookup',["ldap_bind_pw", '<https://vault.net:8200>'])
class { 'sssd':
    config  =&gt; {
        'enumerate'                 =&gt; true,
        'ldap_default_bind_dn'      =&gt; $ldap_bind_user,
        'ldap_default_authtok_type' =&gt; 'password',
        'ldap_default_authtok'      =&gt; $ldap_bind_pws.unwrap,
      },
    }```

when the file gets generated it has the string
```ldap_default_authtok = Deferred({'name' =&gt; 'vault_lookup::lookup'```
Instead of it actually populating it
In the debug logs I see that it actually fetches the secret

<@U03DBUATG5T> seems to be wrong puppet code. can you please provide the puppet code which produces this entry?

I think the problem is that the catalog compilation for the config hash happens before the Deferred lookup happens. So the variable lookup happens on the client, but the hash key in the sssd class was generated on the puppet server.

<@U3ZVA4ND6> might be right, those are erb templates and they don’t support deferred functions 

<https://puppet.com/docs/puppet/6/deferring_functions.html>

Of note at the bottom:
```Do not use the Deferred object as a variable in a string. When compiled, these variables are interpolated, so the stringified version of the object would be passed to the agent, instead of the object itself.```

This is my starter reference for dealing with sensitive things:
<https://puppet.com/blog/my-journey-securing-sensitive-data-puppet-code/>

I also have these references stored:
<https://tickets.puppetlabs.com/browse/DOCUMENT-634>
<https://github.com/puppetlabs/puppet-specifications/blob/master/language/types_values_variables.md#sensitivet>

To echo what was said earlier, if you're trying to render a deferred value in a template, then the rendering must be deferred too, for example using `inline_epp`, see <https://puppet.com/docs/puppet/7/template_with_deferred_values.html>

which I suspect means that you'd need to have the sssd module support deferred lookups for that piece

Infosec in the company where I work is against keeping sensitive information in git - even encrypted. We are PE customers and so frustrated with lack of proper support of deffered functions in a bunch of forge modules.

sssd was one of those - which made us implenting internal version of the module

You still may use vault hiera backend + node_encrypt module. This way you don't need Deferred functions. Though your puppet master will have access to all your secrets.

inconsistent approach with implementing features like CD4PE as Enterprise feature and at the same time lacking support for secrets

hiera vault integration is 3rd party module - not supported or approved 

Not criticizing- just bringing up real world problem we had in the past and solved it internally 

It’s trying to load the apt class twice. My module may show up as includes a number of times and it’s using class-type declaration to include the apt class

```puppet agent -t
Info: Using environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: Class[Apt] is already declared; cannot redeclare (file: /etc/puppetlabs/code/environments/production/modules/repo/manifests/internal.pp, line: 38) (file: /etc/puppetlabs/code/environments/production/modules/repo/manifests/internal.pp, line: 38, column: 5) on node XXXXXX
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run```

It’d be awesome if I could track it down with dot graphs, but I doubt it’s generating anything with a partial compile.

it might give you the info you need, I'd grep for apt in the production env

Yeah. I’ve done that. There’s a few modules there that don’t seem to be included by the ENC. At least not directly, so it’s a bit of a goose chase

you might comment out that repo module for a moment and then run it and look in the dot file to find the links?

I can definitely duplicate this by doing `puppet apply --noop -e "include apt; include repo::internal"`

If I reverse the order, the problem goes away.

Unincluding it may do the trick, but it includes required setup and I’ll probably get some other catalog failures. I’ll have to think about that.

I was mostly going through my troubleshooting in my head, and usually tracing it back where I head to

Thanks. I think someone found it. Was another forge module that was including it.

btw, include apt can be done in multiple places

it's only if you define the class then include/class again

Yeah. I’m familiar with it, but when it’s buried a little, it can be unclear if the include will get evaluated before the declarative style, and that’s what was causing it.

Now that we’ve found it, we can put an explicit require in that forces the ordering.

The issue is that we’ve got some specific overrides on the default apt class params.

Can I put it into another module’s moduledata?

Like I have moduledata for that *repo* module, I could do:
```apt:
  update:
    frequency: always
  purge:
    'sources.list': true```

moduledata is limited to that module's namespace

So I’d have to do it in the control repo, got it.

I’ve always been a little sketchy on whether the top level parameters have to be called out on their own lines in the hieradata

Like:
```apt::update:```
vs.
```apt:
  update:```

Will YAML support that `'sources.list'` key?

<https://forge.puppet.com/modules/puppetlabs/apt#configure-apt-from-hiera>

what's the class signature you're trying to configure?

```class { 'apt':
      auth_conf_entries =&gt; [
        {
          'machine'  =&gt; '<http://internalrepo.XXXXXX.COM|internalrepo.XXXXXX.COM>',
          'login'    =&gt; 'internal',
          'password' =&gt; 'XXXXXXXX',
        },
      ],
      update            =&gt; {
        'frequency' =&gt; 'always',
      },
      purge             =&gt; {
        'sources.list' =&gt; true,
      },
    }```

ok. There's a 1-1 relationship between parameter and hiera keys

there's not a parameter called `sources.list`

It’s a key supported in the purge parameter. I’d have to dig in the code. Sec

so the hiera key would be `apt::purge` and its value would be the hash of `{ 'sources.list': true }`

<https://github.com/puppetlabs/puppetlabs-apt/blob/main/manifests/init.pp#L57>

or
```apt::purge:
    'sources.list': true```

basically, when Puppet declares a class, it will do a `lookup()` with `&lt;name of class&gt;::&lt;parameter&gt;` as a stringed key. Whatever that parameter is expecting should be what you define in your hiera data

Dumb question about hiera and hiera eyaml. Will it do the decryption cycle before interpreting the rest of hiera so that I could use a decrypted value within another hiera value?

I’m looking at that password above and it seems like unless I include that whole array parameter in my `secrets.eyaml` , I’ll have to do something like that.

Bump <https://puppetcommunity.slack.com/archives/C0W298S9G/p1651270631812719>

I think you’re getting `3` because `@dotnet_version` is the only bit of data provided to the `fail` function. Passing a string containing a descriptive error message may make it more clear.

As for why `@dotnet_version == 3` isn’t resolving to true, is `@dotnet_version` a string, or an integer?

Enforcing types for data used by templates is also one area where the EPP template system is better than ERB.

If you’re just starting out, using EPP is the best choice for new templates. ERB is solidly “legacy” at this point. It likely won’t ever go away, but it has several deficiencies that won’t be fixed.

I’d also recommend moving the check for `dotnet_version` into Puppet and out of the template. Will be much simpler to handle the `fail()` condition that way.

Thank you for your replies on this one
<@U11MDJNGZ> - Any suggestions on how to pass a string for the error message ? I tried some thing like
```&lt;%= scope.call_function('fail', ["The version @dotnet_version could not be found ]) %&gt;```
but it ends up in a syntax error .
Also I relaised that I made a mistake of assigning the value of `@dotnet_version`  as an integer whereas it should be a string .

<@U112RM52S> - Thank you for the suggestion . Since I am also new to Puppet , could you please give me an example on how I could do it ?
Any suggestion would be helpful.

anybody know of an easy way to benchmark/profile ruby facts?

Im having trouble tracking down which fact is taking so darn long

no luck finding any built in tools to do it :disappointed:

Facter 4 brought the --timing flag back, which shows the resolution times of each fact.

as long as you're talking about external facts in a facts.d directory and you're invoking the script directly

Im just going to have to find all facts by extracting the fact name from the Facter.add string and calling the individual fact in a timer

Yeah, bisecting the pluginsynced facts is pretty much the best method available for Facter 3 :disappointed:

switching a single machine with puppet 6 to facter 4 is quite easy. something like `puppet config set facterng true once`? I think that should bring you facter 4. maybe the facterng gem needs to be installed into the agent ruby :thinking_face:

Cloud guru has good tutorials to understand and start writing modules, For exam preparation you can follow below link

<https://training.puppet.com/pages/19/get-certified>

Cloud guru also has practitioner tutorial but I think it is not enough on its own, tutorial + above study guide

<https://puppet.com/docs/pe/2019.8/grouping_and_classifying_nodes.html>

I read this but still cant understand possible use cases that I will choose one over another

Configuration data can be used as a parameter override, sometimes declaring a class, which may already be declared as part of another class or profile, for the sole purposes of changing one parameter can cause duplicate classifications

Or you may want a quick way to override one parameter on one nested node group, without changing classification

configuration data will not add a class thats not present, if you configure a parameter in a class thats not part of a node group, nothing happens

I see and variables are not tied to classes right, available for all classes present on node group

yes,  it avoids the fuss of actually declaring a class

do not wanna have two copies of same module, just there is a module with tasks/plans which I would  like to run

so I have built a module with plan+task and it is under open-source puppet /etc/puppetlabs..... . Now I need to run those tasks what should I do?

We're just adding in support for Rocky and noticed that $facts['os']['name'] resolves to RedHat on a Rocky 8 system, but on systems like CentOS or AlmaLinux it resolves to those instead

3.14.22 as bundled with puppet-agent-6.26.0