its going to break any timestamp parsing library

got my catalog runs to about 3seconds for ~150 resources per windows node. i think the only way to pare it down further are provider changes to use ruby pwsh, and other puppet enhancements. not sure i can do anything about shrinking pluginsync below 4-5 sec. not sure where that time is spent, client, server, network.

i have come to realize that onlyif/unless can cost 1sec+ per evaluation. cleaned up a bunch of execs. also wish i could leverage puppet schediling priority to powershell instantiation, or being able to set provider scheduling priority. might have to look at that

Hello All - I'm still learning puppet and need your help. Is there a way to troubleshoot why a particular portion of an yaml file is not executing via puppet apply command. I am trying to setup a package and configure the windows service by including require and subscribe resource parameters in my yaml file. Required package is getting installed correctly, but module service class not getting executed.

Without seeing the YAML, two guesses: 1. The formatting is incorrect 2. The Puppet module doesn't support what you're trying to do with Hiera.

You also may not be executing the lookup properly. Questions like this are usually considerably easier to discuss with an example of both your code and the YAML

I would check out https://github.com/github/octocatalog-diff for this It lets you compile and diff catalogs for a host using a set of facts, either pre-defined or fetched from your puppetdb. The catalog can be from two branches of your control-repo using the same version of puppet OR the same code using two different version of puppet. You dont actually have to use r10k/control-repo you just have to have the code for the from and to code staged in dirs that get identified using the from and to path flags This works pretty much out of the box for puppet code, hiera, and server side functions. it doesnt work, out of the box, for any fact changes. there is a systems for getting the facts for your test hosts in a file named ${certname}.yaml but I havent found a way yet to specify a from and to version of that file, it uses the same file for both from and to catalogs. This gem was developed by github to extensively test their upgrade from puppet v3.x to v5.x Ive used it quite a lot for my own testing and it f'ing rocks. I think that Vox Pupuli has a very similar thing but I havent used it yet, it may be easier to use: https://forge.puppet.com/modules/puppet/catalog_diff

I would check out https://github.com/github/octocatalog-diff for this It lets you compile and diff catalogs for a host using a set of facts, either pre-defined or fetched from your puppetdb. The catalog can be from two branches of your control-repo using the same version of puppet OR the same code using two different version of puppet. You dont actually have to use r10k/control-repo you just have to have the code for the from and to code staged in dirs that get identified using the from and to path flags This works pretty much out of the box for puppet code, hiera, and server side functions. it doesnt work, out of the box, for any fact changes. there is a systems for getting the facts for your test hosts in a file named ${certname}.yaml but I havent found a way yet to specify a from and to version of that file, it uses the same file for both from and to catalogs. This gem was developed by github to extensively test their upgrade from puppet v3.x to v5.x Ive used it quite a lot for my own testing and it f'ing rocks. I think that Vox Pupuli has a very similar thing but I havent used it yet, it may be easier to use: https://forge.puppet.com/modules/puppet/catalog_diff

Thank you @Yorokobi & @CVQuesty for your replies. Was able to figure out the issue. Appreciate your inputs.

Does anybody know how to get rid of inserting:

%YAML 1.1

on top of the file during converting datastructure to yaml by using:

content      => $config.to_yaml,

Every time when it is being executed - it inserts %YAML 1.1 which breaks me syntax

This message was deleted.

Can’t say I’ve even seen the function do that before. I use it all the time, and it never writes

%YAML 1.1

@CVQuesty, do I understand correctly that I have to use {canonical => true} option to get rid of it?

Been working on my apache hardening config, The apache class is working but not the apache::vhost one, I assume I need to call apache::vhost in a different manner?

# @summary A short summary of the purpose of this class
#
# A description of what this class does
#
# @example
#   include phpipam_config::harden_apache
class phpipam_config::harden_apache {
  # <https://github.com/puppetlabs/puppetlabs-apache/blob/main/REFERENCE.md>

    class { 'apache':
    mpm_module       => false,
    purge_configs    => false,

    # Misc config
    log_level         => 'info',

    # Security Configuration
    trace_enable      => 'Off',
    server_tokens     => 'ProductOnly',
    server_signature  => 'Off',

    limitreqfields    => 100,
    limitreqfieldsize => 1024,



    # purge_vhost_dir  => true,

  }
  class { 'apache::vhost':
    limitreqline      => 512,
    limitreqbody      => 102400,
  }
}

does it need to be nested into the class {'apache': section?

No,

apache::vhost

isn’t a class, so you can’t declare it like a class.

apache::vhost

is a “defined type”. You declare those as if they were a built-in Puppet resource. For example:

apache::vhost { 'some_title':
  some_param       => 'foo',
  some_other_param => 'bar',
}

Docs: https://puppet.com/docs/puppet/7/lang_defined_types.html#lang_defined_types-declaring-defined-type-resources

No,

apache::vhost

isn’t a class, so you can’t declare it like a class.

apache::vhost

is a “defined type”. You declare those as if they were a built-in Puppet resource. For example:

apache::vhost { 'some_title':
  some_param       => 'foo',
  some_other_param => 'bar',
}

Docs: https://puppet.com/docs/puppet/7/lang_defined_types.html#lang_defined_types-declaring-defined-type-resources

What's the current recommended way for managing hiera data for different app/deployment tiers? It used to be using a custom fact like

deployment_tier

or

app_tier

, but I see that

pp_apptier

exists now. Is that the intended place for those classifications like dev, prod, test, etc. to exist now?

pp_apptier

is an attempt at standardizing on that fact name, but doing it via certificate extensions in the host’s Puppet cert.

pp_apptier

maps to a reserved OID field in the certificate’s extensions. So

pp_apptier

is technically a trusted value in the

$trusted

hash, it’s not a fact.

But the concept is still valid, and the concept is the recommended way or organizing Hiera data based on tier. Whether you use some custom fact named whatver you want, or the reserved

pp_apptier

trusted extension, it doesn’t matter…. what matters is that you’re doing it at all 🙂

Oh yeah totally, I would prefer that an agent not be able to change from test to prod on a whim, so I think

pp_apptier

is a good idea. Thanks for the input, I'm glad I noticed that value.

I've gotten the framework of a module setup, now I'm just trying to figure out how to modify the vhost for the default directory / in apache2.conf

message has been deleted

got past that, I'm however not finding any good examples for the resource

a2mod

I'm trying to ensure that the status and autoindex modules are removed

profile::ipa_logs::config:
  sources:
    httpd_error_log:
      type: file
      include:
        - /var/log/httpd/error_log
      read_from: end
  transforms:
    filtering:
      type: filter
      inputs:
        - httpd_error_log
      condition: "'contains!(.message, \"<http://DOMAIN.IN|DOMAIN.IN>\")'"

this is a data. Version is 8.2.0. I also tried with the latest version but same result.

Once I moved that function to .erb template with the variable - it removed me that undesired header. Not sure why it happened but it worked out. Looks like erb files handles YAML differently rather that passing it directly to content in .pp file

hi all, I have a probably simple problem to be solved, I just don't know the right approach.

I want to manage sshd's AllowGroups directive and sudo settings with the same defined resource, something like this: