I like the idea of a separate server for external clients and policy based autosigning. Not a fan VPN, at least for this use case anyway. Thanks for your thoughts!

You should also use trusted facts (when not already) to ensure the client can not change contect and can access other nodes data. https://puppet.com/docs/puppet/7/lang_facts_builtin_variables.html#lang_facts_builtin_variables-trusted-facts

trusted facts won't work unless something puts the csr_attributes on every notebook

they are still useful to get the common name

true

and do classification based on that, and not the FQDN

it really depends for me, on your asset management having an api

so you can do running confirmation from the puppet server that the agent is who they say they are

if you enter good data in the asset management system, so that you can confirm technical details of the system I'd say it is fine

Our asset management has an API, so that should be easy. The reason why I want to avoid VPNs for this is that we don't really have a VPN infrastructure (No on-premise hosting). Furthermore, I find forcing people to use VPN the entire time or tell them to connect via VPN because we have updates/changes not viable.

if you can force people to do a csr_attributes.yml and trusted facts, it will make it all easier, but it's doable either way

you can also separate the ca from the compiler infrastructure, which might allow you to open them in different ways

This message was deleted.

Here is the Manifest:

# init.pp
class profile_cmdbautomation (

  Hash[String[1],Hash[String[1],Sensitive[String[1]]]] $tokens,

) {

  $tokens.each |String[1] $api_user, Struct[{
      'client_key' => Sensitive[String[1]],
      'secret_key' => Sensitive[String[1]],
  }] $credentials| {
    file { "/opt/token/${api_user}.json":
      ensure  => file,
      path    => "/opt/token/${api_user}.json",
      content => "{\"client_key\":\"${credentials['client_key']}\",\"secret_key\":\"${credentials['secret_key']}\"}",
    }
  }
}

Here is the yaml code that goes along with it:

---
# node.yaml

lookup_options:
  'profile_test::tokens':
    '^.+$':
      client_key:
        convert_to: 'Sensitive'
      secret_key:
        convert_to: 'Sensitive'

profile_test::tokens:
  user-1:
    client_key: ENC[PKCS7,MIIBmQYJKoZI[...]8+zLmit3+61U+aBflVU=]
    secret_key: ENC[PKCS7,MIIBuQYJKoZI[...]GRT1NTmy26NVlqmUJg==]
  user-2:
    client_key: ENC[PKCS7,MIIBmQYJKoZI[...]syUwZKvnmjnnHipKahc=]
    secret_key: ENC[PKCS7,MIIBuQYJKoZI[...]rmLfzBi+4zTlvWWmTg==]
  user-3:
    client_key: ENC[PKCS7,MIIBmQYJKoZI[...]IJaRT6Ny1TTSaHIEYmk=]
    secret_key: ENC[PKCS7,MIIBuQYJKoZI[...]x/tdRWBpRBJXWd9xcA==]

I thought I am smart and use a regex to get all entries in the hash (and it seems to be working?!) but it's not converting it. Is the lookup_option even capable of drilling down into a hash?

🧵 Hey all 🙂 I am running into an issue today and hope you might have an idea. I am trying to use eyaml in a Struct and strictly checking whether the value of the keys in the struct are actually Sensitive or not. When I try to solve this I get the usual and known log message

expects a Sensitive[String] value, got String

. I am using the Hiera

lookup_options

function to

convert_to: Sensitive

but it's not working. I'll start a tread to post my example code I came up with to reproduce the problem. Maybe you can spot where I'm "holding it wrong".

I mean everything works if I take out all of the

Sensitive

parts in the manifest - Puppet happily decrypt the ENC strings. The logic works, it's just that I want to check whether the key holds data of the type

Sensitive

and I'm not sure I can check for that.

Here is the Manifest:

# init.pp
class profile_test (

  Hash[String[1],Hash[String[1],Sensitive[String[1]]]] $tokens,

) {

  $tokens.each |String[1] $api_user, Struct[{
      'client_key' => Sensitive[String[1]],
      'secret_key' => Sensitive[String[1]],
  }] $credentials| {
    file { "/opt/token/${api_user}.json":
      ensure  => file,
      path    => "/opt/token/${api_user}.json",
      content => "{\"client_key\":\"${credentials['client_key']}\",\"secret_key\":\"${credentials['secret_key']}\"}",
    }
  }
}

Here is the yaml code that goes along with it:

---
# node.yaml

lookup_options:
  'profile_test::tokens':
    '^.+$':
      client_key:
        convert_to: 'Sensitive'
      secret_key:
        convert_to: 'Sensitive'

profile_test::tokens:
  user-1:
    client_key: ENC[PKCS7,MIIBmQYJKoZI[...]8+zLmit3+61U+aBflVU=]
    secret_key: ENC[PKCS7,MIIBuQYJKoZI[...]GRT1NTmy26NVlqmUJg==]
  user-2:
    client_key: ENC[PKCS7,MIIBmQYJKoZI[...]syUwZKvnmjnnHipKahc=]
    secret_key: ENC[PKCS7,MIIBuQYJKoZI[...]rmLfzBi+4zTlvWWmTg==]
  user-3:
    client_key: ENC[PKCS7,MIIBmQYJKoZI[...]IJaRT6Ny1TTSaHIEYmk=]
    secret_key: ENC[PKCS7,MIIBuQYJKoZI[...]x/tdRWBpRBJXWd9xcA==]

I thought I am smart and use a regex to get all entries in the hash (and it seems to be working?!) but it's not converting it. Is the lookup_option even capable of drilling down into a hash?

Because stuff like:

---
# node.yaml
lookup_options:
  'profile_test::api_password':
    convert_to: 'Sensitive'

profile_test::api_password: ENC[PKCS7,MIIBuQYJKoZI[...]x/tdRWBpRBJXWd9xcA==]

# init.pp
class profile_test (
  Sensitive $api_password,
){
  notify ("Encrypted string: ${api_password}")
}

"just" works.

Yeah I see what you're saying. It's the regex that's not working for the internal hash keys or that Hiera doesn't support type casting, convert_to, of those keys And all the examples are standard keys rather than internal keys. sadtaco

Hey folks - I'm trying to gather metrics for puppetdb using

jolokia

and am running into a permission issue. Any ideas? Error message:

[root@puppetserver01 puppetlabs]# curl localhost:8080/metrics/v2/list
Forbidden request: /metrics/v2/list (method :get). Please see the server logs for details

`metrics.conf`:

metrics {
    metrics-webservice: {
        jolokia: {
          enabled: true # uncomment this line to disable jolokia metrics
            servlet-init-params: {
                # Specify a custom security policy:
                # <https://jolokia.org/reference/html/security.html>
                policyLocation: "file:///etc/puppetlabs/puppetdb/jolokia-access.xml"
            }
        }
    }
}

`jolokia-access.xml`:

<?xml version="1.0" encoding="utf-8"?>

<restrict>

  <remote>
    <host>127.0.0.1</host>
  </remote>

  <http>
    <method>post</method>
    <method>get</method>
  </http>

  <commands>
    <command>read</command>
    <command>list</command>
  </commands>

  <allow>
    <mbean>
      <name>java.lang:type=Memory</name>
      <operation>gc</operation>
    </mbean>
  </allow>

  <deny>
    <mbean>
      <name>com.mchange.v2.c3p0:type=PooledDataSource,*</name>
      <attribute>properties</attribute>
    </mbean>
  </deny>

</restrict>

letsplay 🧑‍🏫Puppet Core Team is about to start up in #CFD8Z9A4T

I've recently run into the "puppetdb not supported on el8 due to postgresql" issue and was hoping to get some more details. It appears the issue is primarily due to the puppetlabs-postgresql module's inability to properly install the package, but I don't see any correlating bug reports on the puppetlabs-postgresql issue tracker.

See the

puppetlabs-postgresql

module at https://forge.puppet.com/puppetlabs/postgresql?src=slack&channel=puppet

This message was deleted.

message has been deleted

Hi @Steve Handy, in the code,

$list

is the array of packages and

$package

is just a single element of that array.

Hi @Steve Handy Jr, in the code,

$list

is the array of packages and

$package

is just a single element of that array.

This message was deleted.

This is because we're using "chained " format (

.<function>

) of calling functions: https://puppet.com/docs/puppet/7/lang_functions.html#chained-function-calls

So

in

wouldn't consider those as the same.

'micosoft-edge' in ["Opera Stable 93.0.4585.37", "Microsoft Edge"]

will never be true.