This message was deleted.

what types of things do folks plan on working on?

@Giovanni Bechis has left the channel

or more interesting/challenging stuff like enhancing https://github.com/voxpupuli/puppet_metadata so our acceptance testing does work on alma/rocky linux as well, or setup beaker integration for google. If you're interested in any of that, let me know and I can provide some guidance

This message was deleted.

👋 Hello, team! Glad to join this community, I am trying to reverse proxy using Cloudflare tunnel for puppet server, As puppet uses mTLS authentication mechanism, using reverse proxy is not usable solution unles we have header based mTLS.

👋 Hello, team! Glad to join this community, I am trying to reverse proxy using Cloudflare tunnel for puppet server, As puppet uses mTLS authentication mechanism, using reverse proxy is not usable solution unless we have header based mTLS. I would to check if there is a support having a reverse-proxy in front. I went through https://puppet.com/docs/puppet/7/server/external_ssl_termination.html but looks like it is not secure. Hence seeking for help here... thank you in advance.

I have a question about versioning in package resource. if I pin foopkg to

1.1.0

version but the latest version of the package in the security repo is

1.1.1

, then this will cause package installation failures as that version of the package is not available anymore in the security repo and also in the archive repo

for instance, let's see apache2 http://changelogs.ubuntu.com/changelogs/pool/main/a/apache2/apache2_2.4.29-1ubuntu4.25/changelog, current release 2.4.29-1ubuntu4.25 and previous security release 2.4.29-1ubuntu4.24

apt policy apache2
apache2:
  Installed: (none)
  Candidate: 2.4.29-1ubuntu4.25
  Version table:
     2.4.29-1ubuntu4.25 500
        500 <http://archive.ubuntu.com/ubuntu> bionic-updates/main amd64 Packages
        500 <http://security.ubuntu.com/ubuntu> bionic-security/main amd64 Packages
     2.4.29-1ubuntu4 500
        500 <http://archive.ubuntu.com/ubuntu> bionic/main amd64 Packages

trying to install

2.4.29-1ubuntu4.24

fails as it is not available anymore

apt install apache2=2.4.29-1ubuntu4.24
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Version '2.4.29-1ubuntu4.24' for 'apache2' was not found

so if I pin the version of PKG and a new security release takes place then the puppet agent will report errors when it will try to install it on new system, for existing systems that have the package isn't a problem

so if I pin the version of PKG and a new security release takes place then the puppet agent will report errors when it will try to install it on new system, for existing systems that have the package isn't a problem

how can I address this error in a soft way? Like ok apt fails to find the package, I will notify the error but it will not break the catalog

If you have a need for packages to be at a set version and your upstream isn't keeping old versions, you're kind of stuck maintaining a local mirror. If you know you have a business requirement to be at 1.1.0 and you appropriately tell puppet keep it at version 1.1.0, then you're stuck providing a mechanism for the system to get version 1.1.0 of the package.

If your business rule is "use 1.1.0 or just accept whatever is current" then you'd use

ensure => present

and it will just

apt install <package>

I see

puppet is all about enforcing the state you've told it to enforce

and if you need version 1.1.0, then it should fail if it can't enforce that configuration

True

what is the difference between

present

and

latest

? both will install what is the current latest version, right?

to me

present

is the same as

installed

, if the package is not install, just install it if it is installed then do not anything

I see this in the code https://github.com/puppetlabs/puppet/blob/main/lib/puppet/type/package.rb#L114

I see this in the code https://github.com/puppetlabs/puppet/blob/main/lib/puppet/type/package.rb#L114

present

is the same as

installed

present and installed are the same, so it will basically just

dpkg -l <package>

and if it is there do nothing latest means "update this as soon as you see an update for it"

latest

will attempt to reinstall an installed package with a different version;

present

or

installed

will not.

latest

will attempt to upgrade an installed package;

present

or

installed

will not.

in general, if you need a specific version of a package, I'd make sure to have a mechanism for installing it that didn't depend on the vendor

latest

will attempt to upgrade an installed package with an older version;

present

or

installed

will not.

latest

will attempt to reinstall an installed package with a different version;

present

or

installed

will not.