Puppet Community #puppet

Join Slack

Yorokobi

12/05/2022, 11:18 PM

A wrapper script could do it but ... 😬 could be as fragile as a fact in this context.

Yorokobi

12/05/2022, 11:19 PM

I'll poke around with Bolt; I already have 99% of the DSL completed.

n3snah

12/05/2022, 11:19 PM

you may be able to get away with an

exec

statement using a

creates

attribute but thats also not ideal.

Yorokobi

12/05/2022, 11:21 PM

I considered that using Splunk's

--gen-and-print-passwd

option but the non-debug STDOUT didn't print the password so I'd be left with going back and re-creating the admin password later.

n3snah

12/05/2022, 11:22 PM

that would have printed to root

stdout

right? Could you redirect that somewhere?

Yorokobi

12/05/2022, 11:24 PM

Yes ... I suppose I could create a hidden file with the plain text password (very Foreman-like).

kenyon

12/06/2022, 12:48 AM

puppet/splunk doesn't handle this?

Dr Bunsen Honeydew

12/06/2022, 12:48 AM

See the

puppet-splunk

module at https://forge.puppet.com/puppet/splunk?src=slack&channel=puppet

natemccurdy

12/06/2022, 12:52 AM

Looks like it does:

natemccurdy

12/06/2022, 12:52 AM

• https://github.com/voxpupuli/puppet-splunk/blob/master/manifests/forwarder.pp#L212-L214 • https://github.com/voxpupuli/puppet-splunk/blob/master/manifests/forwarder/password/seed.pp • https://github.com/voxpupuli/puppet-splunk/blob/master/manifests/enterprise/password/seed.pp

Slackbot

12/06/2022, 12:54 AM

This message was deleted.

what 1

notsureif 1

Slackbot

12/06/2022, 9:09 AM

This message was deleted.

Slackbot

12/06/2022, 10:50 AM

This message was deleted.

Artem Shaposhnikov

12/06/2022, 10:51 AM

Hi all, could somebody explain how does work windows provisioning after discovering using discovery plugin in terms of bootloaders? I specified the dchp option 67 as grub2/grubx64.efi and that is ok - when my vmware vm loads via pxe it can see bootloader, loads it and as it specified in bootloader loads foreman discovery. I can see the vm in foreman discovered hosts menu, then press provisioning, point all needed information like OS, templates and so on, after this machine goes reboot and again loads bootloader for discovery image, not bootloader for win OS. I can't understand what happens with bootloader when I run provision. Whether foreman have to create new grubx64.efi which will point to OS's bootloader or not? How does my vm have to understand after reboot where is os's bootloader if it gets the same grub2/grubx64.efi from dhcp? Hope my problem is clear. Thanks in advance.

a.botyan

12/06/2022, 1:51 PM

Hi, May be someone can assist and help. I trying to deploy puppetdb on separate server using PostgressSQL as DB. So I have clean installed virtual machine based on Debian 11 which have all latest updates installed. To deploy PuppetDB on this machine I use puppet module which i got here https://forge.puppet.com/modules/puppetlabs/puppetdb/readme My manifest for deploy

Copy code

node 'srv-vm-pupdb1m-p2' {
package {'nagios-nrpe-server':
    ensure => 'installed',
  }
 file {'/etc/nagios/nrpe.cfg':
	ensure =>present,
	mode => '644',
	owner => 'root',
	source => "puppet:///modules/nrpe/nrpe.cfg",
	}
  file {'/etc/nagios/nrpe_local.cfg':
	ensure =>present,
	mode => '644',
	owner => 'root',
	source => "puppet:///modules/nrpe/nrpe_local.cfg",
	}
  file {'/usr/lib/nagios/plugins/':
	ensure =>'directory',
	recurse=> true,
	mode => '751',
	owner => 'root',
	source => "puppet:///modules/nrpe_plugins/",
	}
	

  class { 'puppetdb::database::postgresql':
    listen_addresses => 'srv-vm-pupdb1m-p2.pfk.local',
	postgresql_ssl_on => true,
    puppetdb_server => 'srv-vm-pupdb1m-p2.pfk.local'
  }
  class { 'puppetdb::server':
 
	
    database_host => 'srv-vm-pupdb1m-p2.pfk.local',
	java_args => {
     '-Xmx' => '512m',
     '-Xms' => '512m',
     }
  }
}

a.botyan

12/06/2022, 1:52 PM

Copy code

node 'srv-vm-pupdb1m-p2' {
package {'nagios-nrpe-server':
    ensure => 'installed',
  }
 file {'/etc/nagios/nrpe.cfg':
	ensure =>present,
	mode => '644',
	owner => 'root',
	source => "puppet:///modules/nrpe/nrpe.cfg",
	}
  file {'/etc/nagios/nrpe_local.cfg':
	ensure =>present,
	mode => '644',
	owner => 'root',
	source => "puppet:///modules/nrpe/nrpe_local.cfg",
	}
  file {'/usr/lib/nagios/plugins/':
	ensure =>'directory',
	recurse=> true,
	mode => '751',
	owner => 'root',
	source => "puppet:///modules/nrpe_plugins/",
	}
	

  class { 'puppetdb::database::postgresql':
    listen_addresses => 'srv-vm-pupdb1m-p2.pfk.local',
	postgresql_ssl_on => true,
    puppetdb_server => 'srv-vm-pupdb1m-p2.pfk.local'
  }
  class { 'puppetdb::server':
 
	
    database_host => 'srv-vm-pupdb1m-p2.pfk.local',
	java_args => {
     '-Xmx' => '512m',
     '-Xms' => '512m',
     }
  }
}

a.botyan

12/06/2022, 1:53 PM

Copy code

node 'srv-vm-pupdb1m-p2' {
package {'nagios-nrpe-server':
    ensure => 'installed',
  }
 file {'/etc/nagios/nrpe.cfg':
	ensure =>present,
	mode => '644',
	owner => 'root',
	source => "puppet:///modules/nrpe/nrpe.cfg",
	}
  file {'/etc/nagios/nrpe_local.cfg':
	ensure =>present,
	mode => '644',
	owner => 'root',
	source => "puppet:///modules/nrpe/nrpe_local.cfg",
	}
  file {'/usr/lib/nagios/plugins/':
	ensure =>'directory',
	recurse=> true,
	mode => '751',
	owner => 'root',
	source => "puppet:///modules/nrpe_plugins/",
	}
	

  class { 'puppetdb::database::postgresql':
    listen_addresses => 'srv-vm-pupdb1m-p2.pfk.local',
	postgresql_ssl_on => true,
    puppetdb_server => 'srv-vm-pupdb1m-p2.pfk.local'
  }
  class { 'puppetdb::server':
 
	
    database_host => 'srv-vm-pupdb1m-p2.pfk.local',
	java_args => {
     '-Xmx' => '512m',
     '-Xms' => '512m',
     }
  }
}

a.botyan

12/06/2022, 1:53 PM

Problem puppetdb service start failed

a.botyan

12/06/2022, 1:54 PM

Copy code

Error: Systemd start for puppetdb failed!
journalctl log for puppetdb:
-- Journal begins at Mon 2022-12-05 13:31:30 EET, ends at Tue 2022-12-06 13:26:18 EET. --
Dec 06 13:21:25 srv-vm-pupdb1m-p2 puppetdb[191267]: WARNING: An illegal reflective access operation has occurred
Dec 06 13:21:25 srv-vm-pupdb1m-p2 puppetdb[191267]: WARNING: Illegal reflective access by dynapath.defaults$fn__18603$fn__18604 (file:/opt/puppetlabs/server/apps/puppetdb/puppetdb.jar) to method java.net.URLClassLoader.addURL(java.net.URL)
Dec 06 13:21:25 srv-vm-pupdb1m-p2 puppetdb[191267]: WARNING: Please consider reporting this to the maintainers of dynapath.defaults$fn__18603$fn__18604
Dec 06 13:21:25 srv-vm-pupdb1m-p2 puppetdb[191267]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Dec 06 13:21:25 srv-vm-pupdb1m-p2 puppetdb[191267]: WARNING: All illegal access operations will be denied in a future release
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [database] classname config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [database] conn-keep-alive config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [database] log-slow-statements config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [database] subprotocol config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [read-database] classname config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [read-database] conn-keep-alive config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [read-database] log-slow-statements config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: The [read-database] subprotocol config option has been retired and will be ignored.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: Execution error (IllegalArgumentException) at java.net.URL/fromURI (URL.java:692).
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: URI is not absolute
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: Full report at:
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191267]: /tmp/clojure-14154318437795009553.edn
Dec 06 13:21:30 srv-vm-pupdb1m-p2 puppetdb[191243]: Background process 191267 exited before start had completed
Dec 06 13:21:30 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Control process exited, code=exited, status=1/FAILURE
Dec 06 13:21:30 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Failed with result 'exit-code'.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 systemd[1]: Failed to start puppetdb Service.
Dec 06 13:21:30 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Consumed 13.161s CPU time.
Dec 06 13:21:31 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Scheduled restart job, restart counter is at 155.
Dec 06 13:21:31 srv-vm-pupdb1m-p2 systemd[1]: Stopped puppetdb Service.
Dec 06 13:21:31 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Consumed 13.161s CPU time.
Dec 06 13:21:31 srv-vm-pupdb1m-p2 systemd[1]: Starting puppetdb Service...
Dec 06 13:21:38 srv-vm-pupdb1m-p2 puppetdb[191332]: WARNING: An illegal reflective access operation has occurred
Dec 06 13:21:38 srv-vm-pupdb1m-p2 puppetdb[191332]: WARNING: Illegal reflective access by dynapath.defaults$fn__18603$fn__18604 (file:/opt/puppetlabs/server/apps/puppetdb/puppetdb.jar) to method java.net.URLClassLoader.addURL(java.net.URL)
Dec 06 13:21:38 srv-vm-pupdb1m-p2 puppetdb[191332]: WARNING: Please consider reporting this to the maintainers of dynapath.defaults$fn__18603$fn__18604
Dec 06 13:21:38 srv-vm-pupdb1m-p2 puppetdb[191332]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Dec 06 13:21:38 srv-vm-pupdb1m-p2 puppetdb[191332]: WARNING: All illegal access operations will be denied in a future release
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [database] classname config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [database] conn-keep-alive config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [database] log-slow-statements config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [database] subprotocol config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [read-database] classname config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [read-database] conn-keep-alive config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [read-database] log-slow-statements config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: The [read-database] subprotocol config option has been retired and will be ignored.
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: Execution error (IllegalArgumentException) at java.net.URL/fromURI (URL.java:692).
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: URI is not absolute
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: Full report at:
Dec 06 13:21:44 srv-vm-pupdb1m-p2 puppetdb[191332]: /tmp/clojure-11372100615486275268.edn
Dec 06 13:21:45 srv-vm-pupdb1m-p2 puppetdb[191308]: Background process 191332 exited before start had completed
Dec 06 13:21:45 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Control process exited, code=exited, status=1/FAILURE
Dec 06 13:21:45 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Failed with result 'exit-code'.
Dec 06 13:21:45 srv-vm-pupdb1m-p2 systemd[1]: Failed to start puppetdb Service.
Dec 06 13:21:45 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Consumed 13.401s CPU time.
Dec 06 13:21:45 srv-vm-pupdb1m-p2 systemd[1]: puppetdb.service: Scheduled restart job, restart counter is at 156.
Dec 06 13:21:45 srv-vm-pupdb1m-p2 systemd[1]: Stopped puppetdb Service.

a.botyan

12/06/2022, 1:54 PM

Can some one to help me?

Florian

12/06/2022, 2:34 PM

Hey all, just need some opinions: currently, I debate with my colleagues if we should open up the firewall of our Puppet master (ofc only the port that is needed). • They say it would be a security risk. • I think if we disable auto-sign, it should be ok. All Agents need to authenticate via certificates and the communication is encrypted. Context: we want to manage our notebook fleet with Puppet, even if people work from home. Has anyone experience/recommendations with this kind of setup (open Puppet master)?

Florian

12/06/2022, 2:36 PM

Hey all, just need some opinions: currently, I debate with my colleagues if we should open up the firewall of our Puppet master. • They say it would be a security risk. • I think if we disable auto-sign, it should be ok. All Agents need to authenticate via certificates and the communication is encrypted. Context: we want to manage our notebook fleet with Puppet, even if people work from home. Has anyone experience/recommendations with this kind of setup (open Puppet master)?

Florian

12/06/2022, 2:39 PM

CVQuesty

12/06/2022, 2:40 PM

I did this for a big insurance company. Here’s the philosophical debate… let’s say you open 8140 to the world. Let’s say someone figures out it’s Puppet from the port, and maybe loads a Puppet agent to connect. Now you know everything about their system (facter) and you will classify their box to your corporate baseline standard. There’s plenty of disagreement as to whether that’s good or bad. Conversely, if you do turn off autosign, then you have to manually approve each first time request. Is that so bad? For those just mad the port is open.. it’s HTTPS. You might be able to pound the port with hacking techniques, etc…. I’ve not heard of Puppet having a vulnerability on the service port. I’ve also never had an issue with it being open on the ’net. Anecdotal, yes, but that’s my experience.

bastelfreak

12/06/2022, 2:41 PM

policy based autosigning is great 🙂

☝️ 1

Lumiere

12/06/2022, 2:41 PM

also, if you design your autosigning to do some checking about the system (if you use a dell for example, you could have a fact that passes the service tag to puppet) and determine if it is legit

bastelfreak

12/06/2022, 2:41 PM

but I'm a fan of VPNs, I would use that for external clients

💯 1

Lumiere

12/06/2022, 2:42 PM

I might specifically put up a separate puppet infra for your notebooks just so that customer production and internal systems are on 100% separated infrastructure

☝️ 1

☝🏻 1

cruelsmith

12/06/2022, 2:45 PM

You should also use trusted facts (when not already) to ensure the client can not change contect and can access other nodes data. https://puppet.com/docs/puppet/7/lang_facts_builtin_variables.html#lang_facts_builtin_variables-trusted-facts

cruelsmith

12/06/2022, 2:46 PM

You should also use trusted facts (when not already) to ensure the client can not change contect and can access other nodes data.