you can pass the desired certname on the CLI or set it in the puppet.conf

but if you already have a certificate, the agent won't recreate it. so you have to delete it first

Quick browse of the docs and I couldn't find anything, perhaps someone here can school me. If I wanted to "hook in" to the Puppet CA's signing and revocation functions - such as running a script after CA actions are undertaken, is that possible? Or can I only watch the result of the CA function (files moving around the

ca/

directory)?

I've an open ticket where I requested that. currently the CA doesn't support hooks

This message was deleted.

https://tickets.puppetlabs.com/projects/SERVER/issues/SERVER-2716 you can comment here

We use puppet ton configure laptops and desktops computers (macOS, Linux, Windows), not only servers. Sometimes in Windows, (when a user switch from network), the fqdn change, and agent recreates a new cert with the new fqdn. Fixing manualy certname in puppet.conf with the netbios name of the computer seem to work : Agent stop creating new certname each times fqdn changes; So there is maybe a way to automate this, and configure agent in order to split hostname at first run and create his certname with short name, like certname=$Fact["networking]["hostname"] ?

usually people write the used certname into the puppet.conf

then it doesn't matter if the fqdn later on changes

why not just prestage the certname as the FQDN in puppet?

We are just visiting this at the moment also and we are justifying reasons why we shouldn't ever change the machine name or FQDN... all changes would be done via CNAMEs in DNS or adding extra A records if required

@bastelfreak could you cheat a little and on an autosigning script tag on scripts / actions to perform after? I ask because I've never tried and am thinking it could be a bit risky.

@bastelfreak could you cheat a little and on an autosigning script tag on scripts / actions to perform after? I ask because I've never tried and am thinking it could be a bit risky.

mhm

would be a hack, but would work

What do you mean with "prestage" @n3snah ? I agree, hostnames shoud never change... It's not a prob in Linux and macOS. But in Windows 10, agent computes a new certname each times the computer connects to a new network.

It will come down to how your trying to install the agent but you can pass MSI args to the installer to use a pre-staged certname. https://puppet.com/docs/puppet/7/install_agents.html#install_agents leveraging the msi arg

PUPPET_AGENT_CERTNAME

It will come down to how your trying to install the agent but you can pass MSI args to the installer to use a pre-staged certname. https://puppet.com/docs/puppet/7/install_agents.html#install_agents leveraging the msi arg

PUPPET_AGENT_CERTNAME

Therefore in summary, certname should be fixed in puppet.conf. Another process is needed (MSI args, manual config, script, etc...) to compute the value of certname.

well it will depend on how your installing it but scripted install would be a pretty common approach I believe and yes in your scenario it should probably be fixed/set in the puppet.conf

well it will depend on how your installing it but scripted install would be a pretty common approach I believe and yes in your scenario it should probably be fixed.

well it will depend on how your installing it but scripted install would be a pretty common approach I believe and yes in your scenario it should probably be fixed/set in the puppet.conf

The logic in https://github.com/puppetlabs/puppet/blob/main/lib/puppet/generate/type.rb is unfortunately not marked with API private/public, so not totally clear if it is considered API. Puppet devs won’t change that without proper release notes though and will also make sure to not break API in minor versions. The generator is well covered with unit tests. I think it is ok to call it from your Ruby, it expects that the environment has been set up in order for it to find types to process - for the face version that setup is done by the application/faces framework and the logic in the face.

Thanks a lot for your help @n3snah & @bastelfreak. We'll follow this approach. Maybe puppetlabs/puppet-agent module could help us to set the right certname =>

Puppet_agent::Config_setting

https://forge.puppet.com/modules/puppetlabs/puppet_agent/reference#puppet_agentconfig_setting

what exactly is it that prevents you from running

puppet generate types

? Not sure I understood

Would it help to know that you can run the command elsewhere given you have the same version of the environment. The output is just a file in a hidden directory. That can be copied. There is nothing machine specific in the generated file, it is just an enumeration of the data types (meta data) so that the actual type in Ruby does not have to be loaded (as ruby code).

This message was deleted.

I want to disable the puppet agent on most of our servers before making a potentially dangerous change. Is there a way to know which puppet agents have connected to the server within a time period (last 7 days maybe). I was going to use the puppet cert list, but that seems to have accumulated many servers that are no longer relevant.

do you use puppetdb?

I'm not sure. I think the answer is yes. The deployment I'm looking at is puppet 4.10.