Puppet Community

yes but it is possible its hosed. Let me look at it

poking at it with curl, I can get expected responses but v4/catalogs is either broken or I don't have a reasonable query:
```	   [(named (not (instance? java.lang.String a-honeysql.types.SqlRaw)) sql) nil]  ```

I can't say I've ever used the /catalogs endpoint

Wow.  I do that a lot.  Now I’m interested…

One of the old threads is still here: <https://puppetcommunity.slack.com/archives/C0W298S9G/p1682012355931829>

Perfect! Thank you. Just replied there :slightly_smiling_face:

That file unfortunately also contains auths from docker registries which I cannot overwrite.

Hence I need to make sure to only manage the proxies.

My other idea was to try to build something with Deferred functions, but I guess that won't solve it.

I’d move the registry credentials to some other store using `credsStore` JSON option or with credentials helper.. and then I’d manage the whole file :slightly_smiling_face:

though.. I’d configure registry creds with Puppet too

I understand your env is different and you have some reasons behind.. but maybe different credentials store can help you

I do have registry creds with puppet too. But some users tend to still put their own :wink:

Actually sounds good :slightly_smiling_face:

<@UNNE9882X>: In case you wondered. I now solved it with the follwing (seperate cred store did not work due to more "local" settings in the file):

`$existing_settings = Deferred('loadjson', ['/opt/jenkins/.docker/config.json', {} ])`
`$merged_settings = Deferred('deep_merge', [$existing_settings, $settings])`
`file { '/opt/jenkins/.docker/config.json':`
  `content =&gt; Deferred('to_json_pretty', [$merged_settings]),`
`}`

I was not aware of the "loadjson" file in stdlib.

ah, so you deferred it to the agent side.. nice trick! thank you for sharing!

Depends, but you may create a class to hold such settings 

Yep, we've done that. IIRC one caveat is that defined types have a distinct scope so you'll have to `include _class_` to make sure the variables are in-scope.

facter -p shows nothing in the publicIPaddress but yet.. i'm using the publicIPaddress to ssh into the dam thing

and keep in mind that `facter` is deprecated. Use `puppet facts show`

i'm ssh'd into this box right now, with the public IP

what i screenshotted was az_metadata.network, puppet facts show networking returns the networking portion but I don't see a publicip in there anywhere

but yet i can see it in azure and am using it to connect

if the IP isn't configured locally, puppet cannot detect it :slightly_smiling_face:

azure gives you no public ip on your VM so puppet cannot figure it out

there is NAT which does mapping from the public IP you’re using to the VM’s private IP

not sure if azure metadata has this info at all

easily, if you have egress NAT in front of it.

Is there an option in pdk to mock trusted facts for all tests in a module?

```# "clean room" shared context
RSpec.shared_context 'clean_room' do
  let(:node) { 'this.is.only.used.for.unit.tests' }
  let(:hiera_config) { '/dev/null' }
end

  # Run non-host/non-plan tests in a clean room (fake node, no hiera)
RSpec.configure do |c|
  c.include_context 'clean_room', file_path: proc { |x| !['hosts', 'plans'].include? File.dirname(x).split('/')[-1] }
end```

I have this in my spec_helper_local.rb in one very special repo :wink:

I was adding the `include_context 'clean_room'` in every spec before.. then decided to move it to a helper

`:type` doesn’t work for me btw.. have no idea why

Have you tried setting `default_trusted_facts`? <https://github.com/puppetlabs/rspec-puppet/tree/f4c5c71dd0271f42891d76a0d017331da7f0c126#default_trusted_facts>

See the `puppetlabs-lvm` module at <https://forge.puppet.com/puppetlabs/lvm?src=slack&amp;channel=puppet>

though.. I’m not sure there is a way to call it with `-a` option.. I guess it’s for mounting/umounting a swap device with known name

ja i think its only for createing swapfs or smoething
<https://github.com/puppetlabs/puppetlabs-lvm/search?q=swap>

i think i will go with:

```  exec { 'Disable SWAP':
    command =&gt; '/sbin/swapoff -a',
    path    =&gt; $facts['path'],
    onlyif  =&gt; 'test $(swapon -s | wc -c) -gt 0',
  }```


swapon -s shows output if there is swap, so if wc count is greater than 0 i need to swapoff :thonk:

or this :thinking_face:
```    onlyif  =&gt; 'swap' in $facts['memory'].keys,```

Of course, you always want to avoid exec if you can....  but, if you do go for exec, I wonder if `awk '/SwapTotal/ {print $2}' &lt;/proc/memory` might not be more efficient.

you mean of this is &gt;0? :thonk:
```awk '/SwapTotal/ {print $2}' /proc/meminfo```

onlyif is executed on an agent so you cannot use puppet dsl there (i.e. cannot check if swap is in facts)

awk can compare numbers for you too :) though I’m not sure about exit code

```systemctl mask swap.target```
perhaps?  That'd require a reboot but would kill off all swap.

That won't prevent a "swapon -a" if someone does it from the command line, though.

:letsplay: _Content and Tooling_ is about to start up in <#CFD8Z9A4T|>

which acl module version do you use, which puppet version, which os and version?

v10.0.0 is the current acl version..puppet version is 7.18. Windows OS 2019

:waiting: _:fox_face:Vox Pupuli monthly sync; see calendar event for info_ is about to start up in <#CFD8Z9A4T|>

thanks for reply <@U2S1MUUQ7> . Do I need to update iis and pwshlib module as well?

Is it also required to update iis &amp; pwshlib module if i upgrade acl?

As I said, I don't think it's relevant, but the error you showed comes from iis module

thanks :pray: ..Got the issue. Actually I upgraded iis module version due to that it was giving that pwshlb because its dependent on iis version.
just tried by downgrading iis version now error disappeared 

:allthethings: _:teacher: Bolt_ is about to start up in <#CFD8Z9A4T|>

is there anyway to "offline " create the a puppet csr? tl;dr, i want to use vault as puppet's ca, but want to use puppet's csr creation method to get all the fancy x509v3 extension magic

:coffee: _:teacher:Puppet Core Team_ is about to start up in <#CFD8Z9A4T|>

For example:
```some_class (
  URI $primary_uri,
) {

}```
This doesn't work when `$primary_uri` is pulled in from Hiera as a `String`.

Which makes sense. But I wonder if it's possible to make that work some how.

I think you'd need to convert it explicitly to URI, similar to what's done for `Sensitive` <https://www.puppet.com/docs/puppet/7/hiera_merging.html#make-hiera-return-data-by-casting>
```mymodule::mykey: 42
lookup_options:
 mymodule::mykey:
   convert_to: "Sensitive"```

Ah, use `convert_to`, yeah that'd work.

Though in all the Puppet code, we do consume the data as a String, so I'd then want to convert it back to a String.

I really just want `URI` for a quick "this string is a valid URI" type of check. At least in this case.

So I might just do that in a few lines of code in the body of the class rather than in the class parameter.

So take it as a String value and validate it by creating a URI from the string, then check if the resulting URI has the expected parts.

Yup, that's exactly what I ended up doing. Works Great :+1:

Though, I did have to use a regex to validate that there wasn't a typo in the `://` portion (just after the schema).

I’d say as long as mount_core is enough for your needs go with it

I use puppetlabs-mount_core and haven't had any issues or need for extra/different functionality.

See the `puppetlabs-mount_core` module at <https://forge.puppet.com/puppetlabs/mount_core?src=slack&amp;channel=puppet>

You need mount_providers for puppet/augeasproviders_mounttab

See the `puppet-augeasproviders_mounttab` module at <https://forge.puppet.com/puppet/augeasproviders_mounttab?src=slack&amp;channel=puppet>

I am curious about the issue with mount_providers, though.  It’s current and supported according to the forge:

```This version is compatible with:
Puppet Enterprise 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x, 2017.3.x
Puppet &gt;= 5.0.0 &lt; 7.0.0
RedHat, 
CentOS, 
OracleLinux, 
Scientific, 
SLES, 
Debian, 
Ubuntu, 
Solaris```

Yes, it doesn’t have 2022 or 2023 in it explicitly, but chances are really good there were new features to take advantage of, so it just stayed the course.

```Puppet &gt;= 5.0.0 &lt; 7.0.0```
Didn't puppet 6 just got EOL?

yeah, but still… in the grand scheme of Forge modules, unless there’s a specific incompatibility, you should be able to continue to use what you need.  And if you’re going to upgrade from 3-&gt;7, expect to have some modules to update.

Also, as a curiosity… are you pre-3.8? and if so, are you using PuppetDB?

I've tested this module using P7 and it seems to work, I assume it was not updated as 7.0.0 came out in 2020 and the module's last update was 2019.

Running 3.8.7 at present …. and yes there are a lot of modules that needs updates to work on p7 !

there was a time when you were upgrading from 3.3 to more modern you had to go to 3.8 first and then upgrade from there.  You should be good, though.

Its not really an upgrade as such - more a replace the client software and point it at an entirely new p7 infrastructure ….  still lots of code to update (and changes to the way hiera works to accommodate)

See the `puppetlabs-mount_providers` module at <https://forge.puppet.com/puppetlabs/mount_providers?src=slack&amp;channel=puppet>

is this the recommended module to use for ca cert mgmt? <https://forge.puppet.com/modules/pcfens/ca_cert/readme>

hello, does anyone know what happens when puppet node certs expire? does puppet auto renew? do i have to revoke and re sign? the certs puppet create have long expiries so I have never run into this.

Your erb will be compiled into a file contents in a catalog on a puppetserver.. I guess you’d like to have the info from an agent, right? :)

If you’re adventurous and want to confuse your colleagues you may try to play around Deferred to render the erb on an agent side.. but it’s not that obvious 

The `Do something` part includes looking up fact information - the expected output format is something like this:
```VLAN|INTERFACE|U/T
2|missing|
3|missing|
25|em1|untagged
26|em1|tagged
27|em2|tagged
100|em2|tagged```

I’d go with facts.. or maybe generate the bash right on a node with a ruby script called from a puppet with Exec

I was afraid of that... I already created a script in my Gem (`exe/get_network_list`) to output that:
```#!/usr/bin/env ruby
# frozen_string_literal: true

require "my_network/vlan_table"

MyNetwork::VlanTable::VLANS.each do |net|

  vlan_id = net[:vlan]
  subnet = net[:subnet]

  puts "%s|%s/%s" % [vlan_id, subnet, subnet.prefix() ]

end```
which can be executed as `/opt/puppetlabs/puppet/bin/get_network_list`

Looks good but I’d put it under /usr/local/bin instead to not pollute the /opt/puppetlabs