https://www.puppet.com/community logo
Join Slack
Powered by
# puppet
  • p
    Surely it is a confusing message.
    Copy code
    Error while evaluating a Function Call, 'compare' compare(): Non comparable type. Only values of the types Numeric, String, Semver, Timestamp and Timestamp can be compared. Got Timestamp['2022-11-03T00:00:00.000000000 UTC']-Type and Timestamp['2023-10-01T00:00:00.000000000 UTC']
    What am I doing wrong?
  • p
    Question - With Puppet agent 7 , facter is generating "openwith.exe" processes on windows at every run. As per https://tickets.puppetlabs.com/si/jira.issueviews:issue-html/PA-3700/PA-3700.html it is because facter_interactive.bat and run_facter_interactive.bat were missing from the MSI and has been included now since version 7.12.0 However, This does not seem to have fixed the issue . Has anyone encountered similar issue and has a solution ? TIA.
  • p
    and as semi-OT, getting from the timestamp the ISO format ( 
    Timestamp.new().strftime('%F')
    ) then makes the comparison with ISO strings also possible. (this if one doesn’t want to use timestamps often)
  • g
    message has been deleted
  • g
    • can anyone explain me why it was going to null character when given the run job in the console level Request "puppet agent" run on over "null" via orchestrator job "257"
  • s
    This message was deleted.
    t
    m
    • 3
    • 5
  • s
    This message was deleted.
    g
    d
    • 3
    • 3
  • g
    Copy code
    Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: Class[Apache] is already declared; cannot redeclare (file: /etc/puppetlabs/code/modules/profile/manifests/oldwebserver/apache2.pp, line: 29) (file: /etc/puppetlabs/code/modules/profile/manifests/oldwebserver/apache2.pp, line: 29, column: 3) on node <http://example.net|example.net>
    Am I missing something? It's mentioning the same line on the same file, how is that a duplicated declaration? 🤔
  • n
    Copy code
    $content_fapolicyd = @("END")
    # This file is managed by Puppet
    # Changes will be overwritten
    allow perm=open dir=/usr/lib/jvm trust=1 : dir=/etc/puppetlabs/code/environments all trust=0
    | END

    file { '/etc/fapolicyd/rules.d/60-puppetserver.rules':
      ensure  => file,
      owner   => 'root',
      group   => 'fapolicyd',
      mode    => '0644',
      content => $content_fapolicyd,
      notify  => Exec['puppetserver - load fapolicyd rules'],
    }

    exec { 'puppetserver - load fapolicyd rules':
      command     => 'fagenrules --load',
      path        => ['/usr/bin', '/usr/sbin'],
      refreshonly => true,
      require     => Service['fapolicyd'],
    }
  • w
    Hi folks, I'm still trying to cement a methodology for my puppet hierarchy. My understanding is generic modules (that don't have any sort of specific configuration) are typically stored underneath {ENV}\modules\.... , Anything with customer/site specific config shouldn't live within that and ideally within the control repo.
  • w
    One thing I'm trying to puzzle out is keeping commit history seperate from the control repo for site specific config such as a profile for applying trusted CAs, administrative SSH keypairs, etc.
  • w
    And where that should ideally go within an environment, and ways to keep it detangled from the control repo.
  • n
    The standard control-repo model is to put custom modules in 
    site-modules/
    . These are typically things like the 
    profile
    and 
    role
    module, but this can also include any custom modules your organization creates. The 
    modules/
    directory is usually considered off limits to humans and is where tools like 
    r10k
    will put its modules that it pulls from your 
    Puppetfile
    .
  • n
    So: `site-modules/`: Custom modules that live inside your control repo and are part of your control repo’s git history `modules/`: r10k managed modules that come from your 
    Puppetfile
    . These are not committed to control-repos and are not part of its git history.
  • n
    So: `site-modules/`: Custom modules that live inside your control repo and are part of your control repo’s git history `modules/`: r10k managed modules that come from your 
    Puppetfile
    . These are not committed to control-repos and are not part of it’s git history.
  • n
    So: `site-modules/`: Custom modules that live inside your control repo and are part of your control repo’s git history `modules/`: r10k managed modules that come from your 
    Puppetfile
    . These are not committed to control-repos and are not part of its git history.
  • s
    This message was deleted.
    n
    • 2
    • 1
  • n
    See https://github.com/puppetlabs/control-repo/blob/production/.gitignore Notice that 
    modules/
    is ignored in git since that folder is managed by 
    r10k
    (usually)
  • w
    Let's say I have some profile type modules/manifests which are designed to provision user accounts to specific systems in absense of LDAP /KRB auth. These contain some details about the account, the ssh public key and SHA-512'd copy of the user PW
  • w
    One could argue that should be tracked by itself to make it easier to audit commits against.
  • w
    Although it's a site specific profile.
  • n
    @William Myers we put those into 
    data/<site>/whatever.yaml
    hiera files
  • n
    that way the site-specific details, especially the passwords, are unique and encrypted
  • w
    Could one consider a SHA512 encrypted password from /etc/shadow sufficient?
  • w
    I had a debate about that with someone, I prefer to error on the side of caution and wanted to install hiera-eyaml to encrypt anything that could be theoretically reverse engineered but the likeliness of doing that with a SHA512 encrypted password hash seems kind of unlikely.
  • w
    I had a debate about that with someone, I prefer to error on the side of caution and wanted to install hiera-eyaml to encrypt anything that could be theoretically reverse engineered but the likeliness of doing that with a SHA512 encrypted password hash seems kind of unlikely.
  • n
    we usually encrypt them along with the salt
  • n
    i agree SHA512 is unlikely to be reversed, however if you have a password stolen or you choose one that is already hashed in a database with "vanilla" / unsalted SHA512, then it can be cracked better to encrypt it and make sure you salt your passwords
  • n
    i agree SHA512 is unlikely to be reversed, however if you have a password stolen or you choose one that is already hashed in a database with "vanilla" / unsalted SHA512, then it can be cracked better to encrypt it and make sure you salt your passwords
  • n
    is there a way to setup puppetserver ca to use EC instead of RSA?
1...225226227...428Latest