that's something that could/should be implemented (if that really is still missing)

The logical volume seems to have it (I assume this is an autorequire) but the volume group doesn't have an autorequire on a physical volume.

The logical volume seems to have it (I assume this is an autorequire) but the volume group doesn't have an autorequire on a physical volume.

Collectors are a tool of last resort since they can have a lot of nasty unintended side effects.

This message was deleted.

Hello guys! I am unable to start puppetserver service VM is RHEL 8.7 puppetserver version: 7.9.3 javac 1.8.0_362 openjdk version "1.8.0_362" /var/log/puppetlabs/puppetserver/puppetserver.log 2023-02-08T093438.940+01:00 ERROR [async-dispatch-2] [p.t.internal] Error during service start!!! org.bouncycastle.openssl.PEMException: unable to convert key pair: RSA KeyFactory not available ..... Caused by: java.security.NoSuchAlgorithmException: RSA KeyFactory not available

Is that with FIPS mode?

oh mmmh yes it's enabled

This message was deleted.

This message was deleted.

your welcome!

This message was deleted.

Can anyone pls help me

I haven’t defined environment under puppet.conf file

We do with certs extension

that’s not where you define it any more. That’s quite an old practice… Further, Puppet will run by default in “production”, but not “win_production”. You would have to specify that environment for any nodes you wish to run in it. e.g.:

puppet agent -t --environment win_production

. If you were sing a control_repo, and were classifying nodes to a specific role or grouping of profiles, doing your environmental lookups in Hiera, that would be a better scenario for you. https://github.com/puppetlabs/control-repo https://www.puppet.com/docs/pe/2023.0/control_repo.html https://www.puppet.com/docs/puppet/7/environments_creating.html#env_create https://www.puppet.com/docs/puppet/7/environments_creating.html https://www.puppet.com/docs/puppet/7/environment_isolation.html#environment_isolation https://www.puppet.com/docs/puppet/7/roles_and_profiles_example.html

that’s not where you define it any more. That’s quite an old practice… Further, Puppet will run by default in “production”, but not “win_production”. You would have to specify that environment for any nodes you wish to run in it. e.g.:

puppet agent -t --environment win_production

. If you were sing a control_repo, and were classifying nodes to a specific role or grouping of profiles, doing your environmental lookups in Hiera, that would be a better scenario for you. https://github.com/puppetlabs/control-repo https://www.puppet.com/docs/pe/2023.0/control_repo.html https://www.puppet.com/docs/puppet/7/environments_creating.html#env_create https://www.puppet.com/docs/puppet/7/environments_creating.html https://www.puppet.com/docs/puppet/7/environment_isolation.html#environment_isolation https://www.puppet.com/docs/puppet/7/roles_and_profiles_example.html

Morning all. My agent checks into the CA and gets it's cert signed. Then when it goes to grab it's catalog from the compilers i get a wonderful error. Compilers are sitting behind an LB in azure.

<http://load.eastus.cloudapp.azure.com|load.eastus.cloudapp.azure.com>

I have added that to the dns_alt names of all the compilers. Here is an excerpt from "puppet ssl show" for compiler 1

X509v3 Subject Alternative Name: DNS:Compiler-1, DNS:<http://Compiler-1.bx.internal.cloudapp.net|Compiler-1.bx.internal.cloudapp.net>, DNS:<http://eastus.cloudapp.azure.com|eastus.cloudapp.azure.com>, DNS:<http://compiler-1.bx.internal.cloudapp.net|compiler-1.bx.internal.cloudapp.net>, DNS:<http://load.eastus.cloudapp.azure.com|load.eastus.cloudapp.azure.com>, DNS:<http://master.eastus.cloudapp.azure.com|master.eastus.cloudapp.azure.com>

you can clearly see that it has 'load.eastus.cloudapp.azure.com' as an alt name here is my error:

Server hostname '<http://load.eastus.cloudapp.azure.com|load.eastus.cloudapp.azure.com>' did not match server certificate; expected one of <http://compiler-1.bx.internal.cloudapp.net|compiler-1.bx.internal.cloudapp.net>, DNS:Compiler-1, DNS:<http://Compiler-1.bx.internal.cloudapp.net|Compiler-1.bx.internal.cloudapp.net>, DNS:<http://eastus.cloudapp.azure.com|eastus.cloudapp.azure.com>, DNS:<http://compiler-1.bx.internal.cloudapp.net|compiler-1.bx.internal.cloudapp.net>, DNS:<http://master.eastus.cloudapp.azure.com|master.eastus.cloudapp.azure.com>

Morning all. My agent checks into the CA and gets it's cert signed. Then when it goes to grab it's catalog from the compilers i get a wonderful error. Compilers are sitting behind an LB in azure.

<http://load.eastus.cloudapp.azure.com|load.eastus.cloudapp.azure.com>

I have added that to the dns_alt names of all the compilers. Here is an excerpt from "puppet ssl show" for compiler 1

X509v3 Subject Alternative Name: DNS:Compiler-1, DNS:<http://Compiler-1.bx.internal.cloudapp.net|Compiler-1.bx.internal.cloudapp.net>, DNS:<http://eastus.cloudapp.azure.com|eastus.cloudapp.azure.com>, DNS:<http://compiler-1.bx.internal.cloudapp.net|compiler-1.bx.internal.cloudapp.net>, DNS:<http://load.eastus.cloudapp.azure.com|load.eastus.cloudapp.azure.com>, DNS:<http://master.eastus.cloudapp.azure.com|master.eastus.cloudapp.azure.com>

you can clearly see that it has 'load.eastus.cloudapp.azure.com' as an alt name here is my error:

Server hostname '<http://load.eastus.cloudapp.azure.com|load.eastus.cloudapp.azure.com>' did not match server certificate; expected one of <http://compiler-1.bx.internal.cloudapp.net|compiler-1.bx.internal.cloudapp.net>, DNS:Compiler-1, DNS:<http://Compiler-1.bx.internal.cloudapp.net|Compiler-1.bx.internal.cloudapp.net>, DNS:<http://eastus.cloudapp.azure.com|eastus.cloudapp.azure.com>, DNS:<http://compiler-1.bx.internal.cloudapp.net|compiler-1.bx.internal.cloudapp.net>, DNS:<http://master.eastus.cloudapp.azure.com|master.eastus.cloudapp.azure.com>

on the server, if you do

puppetserver ca list --certname <http://load.eastus.cloudapp.azure.com|load.eastus.cloudapp.azure.com>

, what does it give you?

on my compiler correct?

Typically, the compiler does not terminate the SSL conversation, the primary server does.

on my CA it states "Missing Certificates: load.eastus.cloudapp.azure.com"

again, the primary “master” (if I can use that term any more) is where the CA signing, storage, and answering into the environment tend to happen (unless you are syncing the certs and all associated files from the primary master to all other compiler nodes)

Usually, an agent will have two directives in puppet.conf. The

server

entry and the

ca_server

entry.

ok, my agents have server=load.eastus.cloudapp.azure.come

the

ca_server

entry will point to the primary server and then the

server

entry will point to that load balancer

exactly

how about

ca_server

?