Puppet Community

yes, _puppet server_ has not been released for 22.04

ok in general not, ok so will try a 20.04 thank you Lumiere :slightly_smiling_face:
I try it out asap :slightly_smiling_face:

can you walk through the steps you did to get the puppet server up and running and then what you did to register from  the client

ok i can try but mainly i want to get it on one machine up and running together with puppetdb, give me some minutes to spin up another instance

it looks like some sort of configuration mistake on the puppet server side, but without being able to walk through what you did, its hard to tell

totally ok, do you have time to do with me via e.g. teams ?

not really, I'm in meetings basically all day today

damn sorry to hear, but many thanks for your help :slightly_smiling_face:

but if you walk through what you did, someone here may be able to help beyond just me

BTW, I recommend posting commands and outputs as text, rather than images. Images are cumbersome to read, and impossible to copy.

thanks for your feedback, and yes you are totally right. can you maybe help me via teams ?

I really can't get stuck in a call now. But see <@U020LK7D0JU> answer above.

"Please see the server logs for details"
What do they say?

```2023-05-17T17:12:06.494Z INFO  [main] [o.e.j.u.log] Logging initialized @3616ms to org.eclipse.jetty.util.log.Slf4jLog
2023-05-17T17:12:06.558Z INFO  [main] [p.t.s.w.jetty9-core] Removing buggy security provider SunPKCS11 version 17
2023-05-17T17:12:07.083Z INFO  [async-dispatch-2] [p.t.s.s.scheduler-service] Initializing Scheduler Service
2023-05-17T17:12:07.110Z INFO  [async-dispatch-2] [o.q.i.StdSchedulerFactory] Using default implementation for ThreadExecutor
2023-05-17T17:12:07.119Z INFO  [async-dispatch-2] [o.q.c.SchedulerSignalerImpl] Initialized Scheduler Signaller of type: class org.quartz.core.SchedulerSignalerImpl
2023-05-17T17:12:07.119Z INFO  [async-dispatch-2] [o.q.c.QuartzScheduler] Quartz Scheduler v.2.3.2 created.
2023-05-17T17:12:07.119Z INFO  [async-dispatch-2] [o.q.s.RAMJobStore] RAMJobStore initialized.
2023-05-17T17:12:07.120Z INFO  [async-dispatch-2] [o.q.c.QuartzScheduler] Scheduler meta-data: Quartz Scheduler (v2.3.2) '1a0b1b87-de74-42f1-a2e6-96ca05156b82' with instanceId 'NON_CLUSTERED'
  Scheduler class: 'org.quartz.core.QuartzScheduler' - running locally.
  NOT STARTED.
  Currently in standby mode.
  Number of jobs executed: 0
  Using thread pool 'org.quartz.simpl.SimpleThreadPool' - with 10 threads.
  Using job-store 'org.quartz.simpl.RAMJobStore' - which does not support persistence. and is not clustered.

2023-05-17T17:12:07.120Z INFO  [async-dispatch-2] [o.q.i.StdSchedulerFactory] Quartz scheduler '1a0b1b87-de74-42f1-a2e6-96ca05156b82' initialized from an externally provided properties instance.
2023-05-17T17:12:07.120Z INFO  [async-dispatch-2] [o.q.i.StdSchedulerFactory] Quartz scheduler version: 2.3.2
2023-05-17T17:12:07.120Z INFO  [async-dispatch-2] [o.q.c.QuartzScheduler] Scheduler 1a0b1b87-de74-42f1-a2e6-96ca05156b82_$_NON_CLUSTERED started.
2023-05-17T17:12:07.122Z INFO  [async-dispatch-2] [p.t.s.w.jetty9-service] Initializing web server(s).
2023-05-17T17:12:07.143Z INFO  [async-dispatch-2] [p.t.s.s.status-service] Registering status callback function for service 'puppet-profiler', version 8.0.0
2023-05-17T17:12:07.145Z INFO  [async-dispatch-2] [p.s.j.jruby-puppet-service] Initializing the JRuby service
2023-05-17T17:12:07.152Z INFO  [async-dispatch-2] [p.s.j.jruby-pool-manager-service] Initializing the JRuby service
2023-05-17T17:12:07.156Z INFO  [async-dispatch-2] [p.s.j.jruby-puppet-service] JRuby version info: jruby 9.4.2.0 (3.1.0) 2023-03-08 90d2913fda OpenJDK 64-Bit Server VM 17.0.7+7-Ubuntu-0ubuntu122.04.2 on 17.0.7+7-Ubuntu-0ubuntu122.04.2 +jit [x86_64-linux]
2023-05-17T17:12:07.161Z INFO  [clojure-agent-send-pool-0] [p.s.j.i.jruby-internal] Creating JRubyInstance with id 1.
2023-05-17T17:12:07.177Z INFO  [async-dispatch-2] [p.t.s.s.status-service] Registering status callback function for service 'jruby-metrics', version 8.0.0
2023-05-17T17:12:07.178Z INFO  [async-dispatch-2] [p.s.v.versioned-code-service] No code-id-command set for versioned-code-service. Code-id will be nil.
2023-05-17T17:12:07.179Z INFO  [async-dispatch-2] [p.s.v.versioned-code-service] No code-content-command set for versioned-code-service. Attempting to fetch code content will fail.
2023-05-17T17:12:07.182Z INFO  [async-dispatch-2] [p.t.s.m.jolokia] Metrics access control using trapperkeeper-authorization is enabled.
2023-05-17T17:12:13.781Z INFO  [clojure-agent-send-pool-0] [puppetserver] Puppet Puppet settings initialized; run mode: server
2023-05-17T17:12:16.341Z INFO  [clojure-agent-send-pool-0] [p.s.j.i.jruby-agents] Finished creating JRubyInstance 1 of 2
2023-05-17T17:12:16.342Z INFO  [clojure-agent-send-pool-0] [p.s.j.i.jruby-internal] Creating JRubyInstance with id 2.
2023-05-17T17:12:16.347Z INFO  [async-dispatch-2] [p.s.c.puppet-server-config-core] Initializing webserver settings from core Puppet
2023-05-17T17:12:16.378Z INFO  [async-dispatch-2] [p.p.certificate-authority] CA already initialized for SSL
2023-05-17T17:12:16.388Z INFO  [async-dispatch-2] [p.s.c.certificate-authority-service] CA Service adding a ring handler
2023-05-17T17:12:16.432Z INFO  [async-dispatch-2] [p.t.s.s.status-service] Registering status callback function for service 'ca', version 8.0.0
2023-05-17T17:12:16.617Z INFO  [async-dispatch-2] [p.p.certificate-authority] Master already initialized for SSL
2023-05-17T17:12:16.627Z INFO  [async-dispatch-2] [p.s.m.master-service] Master Service adding ring handlers
2023-05-17T17:12:16.631Z INFO  [async-dispatch-2] [p.t.s.s.status-service] Registering status callback function for service 'master', version 8.0.0
2023-05-17T17:12:16.634Z INFO  [async-dispatch-2] [p.t.s.s.status-service] Registering status callback function for service 'server', version 8.0.0
2023-05-17T17:12:16.644Z INFO  [async-dispatch-2] [p.s.p.puppet-admin-service] Starting Puppet Admin web app
2023-05-17T17:12:16.648Z INFO  [async-dispatch-2] [p.t.s.w.jetty9-service] Starting web server(s).
2023-05-17T17:12:16.656Z INFO  [async-dispatch-2] [p.t.s.w.jetty9-core] webserver config overridden for key 'ssl-cert'
2023-05-17T17:12:16.656Z INFO  [async-dispatch-2] [p.t.s.w.jetty9-core] webserver config overridden for key 'ssl-key'
2023-05-17T17:12:16.657Z INFO  [async-dispatch-2] [p.t.s.w.jetty9-core] webserver config overridden for key 'ssl-ca-cert'
2023-05-17T17:12:16.658Z INFO  [async-dispatch-2] [p.t.s.w.jetty9-core] webserver config overridden for key 'ssl-crl-path'
2023-05-17T17:12:16.798Z INFO  [async-dispatch-2] [p.t.s.w.jetty9-core] Starting web server.
2023-05-17T17:12:16.805Z INFO  [async-dispatch-2] [o.e.j.s.Server] jetty-9.4.51.v20230217; built: 2023-02-17T08:19:37.309Z; git: b45c405e4544384de066f814ed42ae3dceacdd49; jvm 17.0.7+7-Ubuntu-0ubuntu122.04.2
2023-05-17T17:12:16.848Z INFO  [async-dispatch-2] [o.e.j.s.session] DefaultSessionIdManager workerName=node0
2023-05-17T17:12:16.848Z INFO  [async-dispatch-2] [o.e.j.s.session] No SessionScavenger set, using defaults
2023-05-17T17:12:16.849Z INFO  [async-dispatch-2] [o.e.j.s.session] node0 Scavenging every 660000ms
2023-05-17T17:12:16.872Z INFO  [async-dispatch-2] [p.t.s.m.jolokia] Using policy access restrictor classpath:/jolokia-access.xml
2023-05-17T17:12:16.907Z INFO  [async-dispatch-2] [o.e.j.s.h.ContextHandler] Started o.e.j.s.ServletContextHandler@16c936d9{/metrics/v2,null,AVAILABLE}
2023-05-17T17:12:16.908Z INFO  [async-dispatch-2] [o.e.j.s.h.ContextHandler] Started o.e.j.s.h.ContextHandler@7a1f94e7{/puppet-ca,null,AVAILABLE}
2023-05-17T17:12:16.909Z INFO  [async-dispatch-2] [o.e.j.s.h.ContextHandler] Started o.e.j.s.h.ContextHandler@4f7f5d9a{/puppet,null,AVAILABLE}
2023-05-17T17:12:16.909Z INFO  [async-dispatch-2] [o.e.j.s.h.ContextHandler] Started o.e.j.s.h.ContextHandler@1eca7aad{/puppet-admin-api,null,AVAILABLE}
2023-05-17T17:12:16.943Z INFO  [async-dispatch-2] [o.e.j.u.s.SslContextFactory] x509=X509@1e63459b(private key,h=[puppet, puppet2.],a=[],w=[]) for InternalSslContextFactory@37a1e638[provider=null,keyStore=null,trustStore=null]
2023-05-17T17:12:17.088Z INFO  [async-dispatch-2] [o.e.j.s.AbstractConnector] Started ServerConnector@75442d82{SSL, (ssl, http/1.1)}{0.0.0.0:8140}
2023-05-17T17:12:17.088Z INFO  [async-dispatch-2] [o.e.j.s.Server] Started @14212ms
2023-05-17T17:12:17.150Z INFO  [async-dispatch-2] [p.t.s.s.status-core] Starting background monitoring of cpu usage metrics
2023-05-17T17:12:17.162Z INFO  [async-dispatch-2] [p.t.s.s.status-service] Registering status callback function for service 'status-service', version 1.1.1
2023-05-17T17:12:17.162Z INFO  [async-dispatch-2] [p.t.s.s.status-service] Registering status service HTTP API at /status
2023-05-17T17:12:17.173Z INFO  [async-dispatch-2] [o.e.j.s.h.ContextHandler] Started o.e.j.s.h.ContextHandler@94a6719{/status,null,AVAILABLE}
2023-05-17T17:12:17.185Z INFO  [async-dispatch-2] [p.s.a.analytics-service] Puppet Server Update Service has successfully started and will run in the background
2023-05-17T17:12:17.189Z INFO  [async-dispatch-2] [p.s.m.master-service] Puppet Server has successfully started and is now ready to handle requests
2023-05-17T17:12:17.812Z ERROR [1a0b1b87-de74-42f1-a2e6-96ca05156b82_Worker-3] [p.s.a.analytics-service] Failed to check for product updates
2023-05-17T17:12:19.579Z INFO  [clojure-agent-send-pool-0] [puppetserver] Puppet Puppet settings initialized; run mode: server
2023-05-17T17:12:21.299Z INFO  [clojure-agent-send-pool-0] [p.s.j.i.jruby-agents] Finished creating JRubyInstance 2 of 2
2023-05-17T17:13:01.767Z ERROR [qtp1847757902-55] [p.t.a.rules] Forbidden request: puppet2.(91.107.216.1) access to /puppet/v3/catalog/puppet2. (method :post) (authenticated: true) denied by rule 'puppetlabs v3 catalog from agents'.
2023-05-17T17:13:01.803Z ERROR [qtp1847757902-53] [p.t.a.rules] Forbidden request: puppet2.(91.107.216.1) access to /puppet/v3/report/puppet2. (method :put) (authenticated: true) denied by rule 'puppetlabs report'.```

The 2 last records show there are 'p.t.a.rules' (which I have no idea what they are) blocking agent requests to the server. I'd start reviewing those rules.

ok, lets find these stuff, its a pity there is nothing stated in the docs :disappointed:

do you know any good tutorial aka <https://phoenixnap.com/kb/install-puppet-ubuntu> for installing puppet ? the link just shows puppet6 which is a little bit outdated, but with puppet8 i am running into this issue, which i am investigating

On your Puppetserver, open up `/etc/puppetlabs/puppetserver/conf.d/auth.conf`
That's where the rules are that define access to the API endpoints.

In that file, search for "puppetlabs v3 catalog from agents".
There's probably an allow list in that rule. What does it say?

that in puppet6 it was allowed that server and agent can run on the same host

but now i am stuck with host certificates -,-

The agent and server can absolutely be run on the same host; in all versions of Puppet.

Did you do an in-place upgrade of the operating system to focal?

What Puppet repo are you using for the packages?

let me get you the wget command give me a sec

wget <https://apt.puppetlabs.com/puppet8-release-focal.deb>

then dpkg -i ...
apt install puppetserver
fixing wrong permissions in /opt
adding ip puppetmaster puppet to host
start server

then restart
puppet agent --test
403 error meeee

more or less following this tut but only with puppet8 <https://phoenixnap.com/kb/install-puppet-ubuntu>
any ideas <@U112RM52S>?

You're trying to use the 20.04 (Focal Fossa) packages on a 22.04 (Jammy Jellyfish) server?

yes spp :slightly_smiling_face: with puppet6 it was working just got stuck with puppetdb

and i wanted to upgrade :slightly_smiling_face:

you can't use 20.04 packages on a 22.04 server.  It isn't supported.

give me 15 minutes, then i am at home and i can start a 20.04 machine and i can test it :slightly_smiling_face:

<@UPVF2CKRP>, .. the first programm on ubuntu i had in my lifetime that was not compatible, so i was lucky, that the puppet6 version was running, but then it misleaded me.
nice :wink:
may i ask you a second thing to puppetdb ?

You can always ask.  I may not know the answer, but someone should....

ok :raised_hands:
after following <https://www.puppet.com/docs/puppetdb/8/install_via_module.html> and some research it was possible to run puppetdb with a hsql backend, this i added to the database.ini:
```subname = file:/etc/puppetlabs/puppetdb/;hsqldb.tx=mvcc;sql.syntax_pgs=true```
but after starting the puppetdb i get following error:
```2023-05-17T19:12:46.185Z INFO  [o.q.i.StdSchedulerFactory] Quartz scheduler '231cf5fd-8eba-479e-b266-6af535d33edb' initialized from an externally provided properties instance.
2023-05-17T19:12:46.185Z INFO  [o.q.i.StdSchedulerFactory] Quartz scheduler version: 2.3.2
2023-05-17T19:12:46.186Z INFO  [o.q.c.QuartzScheduler] Scheduler 231cf5fd-8eba-479e-b266-6af535d33edb_$_NON_CLUSTERED started.
2023-05-17T19:12:46.195Z INFO  [p.t.s.n.nrepl-service] nREPL service disabled, not starting
2023-05-17T19:12:46.217Z ERROR [p.t.internal] Error during service init!!!
java.lang.AssertionError: Assert failed: (:user config)
        at puppetlabs.puppetdb.config$ensure_migrator_info.invokeStatic(config.clj:422)
        at puppetlabs.puppetdb.config$ensure_migrator_info.invoke(config.clj:419)
        at puppetlabs.puppetdb.config$fix_up_db_settings.invokeStatic(config.clj:442)
        at puppetlabs.puppetdb.config$fix_up_db_settings.invoke(config.clj:438)
        at puppetlabs.puppetdb.config$configure_dbs$fn__18983.invoke(config.clj:485)
        at clojure.core$update.invokeStatic(core.clj:6231)
        at clojure.core$update.invoke(core.clj:6223)
        at puppetlabs.puppetdb.config$configure_dbs.invokeStatic(config.clj:485)
        at puppetlabs.puppetdb.config$configure_dbs.invoke(config.clj:475)
        at puppetlabs.puppetdb.config$convert_config.invokeStatic(config.clj:536)
        at puppetlabs.puppetdb.config$convert_config.invoke(config.clj:532)
        at puppetlabs.puppetdb.config$process_config_BANG_.invokeStatic(config.clj:694)
        at puppetlabs.puppetdb.config$process_config_BANG_.invoke(config.clj:690)
        at puppetlabs.puppetdb.config$init_config_service.invokeStatic(config.clj:727)
        at puppetlabs.puppetdb.config$init_config_service.invoke(config.clj:725)
        at puppetlabs.puppetdb.config$create_defaulted_config_service$reify__19193$service_fnk__16819__auto___positional$reify__19202$fn__19203.invoke(config.clj:756)
        at puppetlabs.puppetdb.utils$call_unless_shutting_down.invokeStatic(utils.clj:394)
        at puppetlabs.puppetdb.utils$call_unless_shutting_down.invoke(utils.clj:391)
        at puppetlabs.puppetdb.config$create_defaulted_config_service$reify__19193$service_fnk__16819__auto___positional$reify__19202.init(config.clj:754)
        at puppetlabs.trapperkeeper.services$fn__16643$G__16635__16646.invoke(services.clj:9)
        at puppetlabs.trapperkeeper.services$fn__16643$G__16634__16650.invoke(services.clj:9)
        at puppetlabs.trapperkeeper.internal$fn__17157$run_lifecycle_fn_BANG___17164$fn__17165.invoke(internal.clj:196)
        at puppetlabs.trapperkeeper.internal$fn__17157$run_lifecycle_fn_BANG___17164.invoke(internal.clj:179)
        at puppetlabs.trapperkeeper.internal$fn__17186$run_lifecycle_fns__17191$fn__17192.invoke(internal.clj:229)
        at puppetlabs.trapperkeeper.internal$fn__17186$run_lifecycle_fns__17191.invoke(internal.clj:206)
        at puppetlabs.trapperkeeper.internal$fn__17816$build_app_STAR___17825$fn$reify__17837.init(internal.clj:614)
        at puppetlabs.trapperkeeper.internal$fn__17866$boot_services_for_app_STAR__STAR___17873$fn__17874$fn__17876.invoke(internal.clj:648)
        at puppetlabs.trapperkeeper.internal$fn__17866$boot_services_for_app_STAR__STAR___17873$fn__17874.invoke(internal.clj:647)
        at puppetlabs.trapperkeeper.internal$fn__17866$boot_services_for_app_STAR__STAR___17873.invoke(internal.clj:641)
        at clojure.core$partial$fn__5910.invoke(core.clj:2647)
        at puppetlabs.trapperkeeper.internal$fn__17231$initialize_lifecycle_worker__17242$fn__17243$fn__17406$state_machine__10377__auto____17431$fn__17434.invoke(internal.clj:249)
        at puppetlabs.trapperkeeper.internal$fn__17231$initialize_lifecycle_worker__17242$fn__17243$fn__17406$state_machine__10377__auto____17431.invoke(internal.clj:249)
        at clojure.core.async.impl.ioc_macros$run_state_machine.invokeStatic(ioc_macros.clj:978)
        at clojure.core.async.impl.ioc_macros$run_state_machine.invoke(ioc_macros.clj:977)
        at clojure.core.async.impl.ioc_macros$run_state_machine_wrapped.invokeStatic(ioc_macros.clj:982)
        at clojure.core.async.impl.ioc_macros$run_state_machine_wrapped.invoke(ioc_macros.clj:980)
        at clojure.core.async$ioc_alts_BANG_$fn__10606.invoke(async.clj:421)
        at clojure.core.async$do_alts$fn__10545$fn__10548.invoke(async.clj:288)
        at clojure.core.async.impl.channels.ManyToManyChannel$fn__5218$fn__5219.invoke(channels.clj:99)
        at clojure.lang.AFn.run(AFn.java:22)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at clojure.core.async.impl.concurrent$counted_thread_factory$reify__5121$fn__5122.invoke(concurrent.clj:29)
        at clojure.lang.AFn.run(AFn.java:22)
        at java.base/java.lang.Thread.run(Thread.java:833)
2023-05-17T19:12:46.220Z INFO  [p.t.internal] Beginning shutdown sequence
2023-05-17T19:12:46.230Z INFO  [p.p.c.services] Shutdown request received; puppetdb exiting.
2023-05-17T19:12:46.234Z INFO  [p.t.s.s.scheduler-service] Shutting down Scheduler Service
2023-05-17T19:12:46.237Z INFO  [o.q.c.QuartzScheduler] Scheduler 231cf5fd-8eba-479e-b266-6af535d33edb_$_NON_CLUSTERED shutting down.
2023-05-17T19:12:46.237Z INFO  [o.q.c.QuartzScheduler] Scheduler 231cf5fd-8eba-479e-b266-6af535d33edb_$_NON_CLUSTERED paused.
2023-05-17T19:12:46.676Z INFO  [o.q.c.QuartzScheduler] Scheduler 231cf5fd-8eba-479e-b266-6af535d33edb_$_NON_CLUSTERED shutdown complete.
2023-05-17T19:12:46.677Z INFO  [p.t.s.s.scheduler-service] Scheduler Service shutdown complete.
2023-05-17T19:12:46.680Z INFO  [p.t.s.w.jetty9-service] Shutting down web server(s).
2023-05-17T19:12:46.689Z INFO  [p.t.internal] Finished shutdown sequence```

We haven't supported HSQLDB since Puppet 4 (or maybe 5).  I don't believe you can use it with P8.

PuppetDB should only be using a Postgresql backend.

spp to the rescue :slightly_smiling_face: so i go for postgres :slightly_smiling_face:
thanks again, i will come back tomorrow ( gmt +1)  to check :slightly_smiling_face:
thanks natem also to you :slightly_smiling_face:

If you are just kicking the tires, try puppetserver without puppetdb first. You can add pupeptdb later.

<@UPVF2CKRP> <@U112RM52S> thanks a lot it is working now . <@U01RH6J4QDC> i do have some experience with puppet6 only, i just was stuck at instaling v8 with puppetdb :slightly_smiling_face: But definitely I agree :slightly_smiling_face: Thanks a lot guys !

you can use the notify or echo resource to check the value of `$trusted['certname']`

even better, i WANT the shortname, so I guess I'll just go with that.
Yea, I tried using notify to check, nothing.  Very weird.

whenever possible, use `$trusted` and not facts

'whenever possible'  - that's why I'm here, I'ma trying!  LOL

agents can provide you whatever fact values they like. stuff in `trusted` comes from the tls cert

if you drop `$` from your regex it will work. Or extract the hostname from `$trusted['certname']`

`if $trusted['certname'] =~ /-sec\.common\.domain\.com/ {`

or `if $trusted['certname'].split('.')[0] =~ /-sec$/`

But I need the regex$, my certname &amp; hostname both are just a shortname, ending with either -pri or -sec (primary/secondary).  In our test env I've never added a fqdn .<http://domain.com|domain.com> for simplicity.
That said, when this goes live, the prod nodes will certainly have fqdn's.  So I guess I should start using them in test env now.

don't do that. always use FQDNs for the certificates

honestly, always use FQDNs for systems and put them in DNS (unless they're a totally ephemeral cloud node)

Per default $trusted['hostname'] and $trusted['domain'] does also exist. They also come from the cert itself so you do not need to manually split the $trusted['certname'].
<https://www.puppet.com/docs/puppet/8/lang_facts_builtin_variables.html#trusted-facts>

and deleting all the docker packages also resolves the issue... so it looks like the provider only gets upset when trying to upgrade an existing package.

it didn't complain about docker-ce, which is epoch 3... so I don't think the provider is choking on the epoch

PuppetDB has an API, you can write a function to query a foreign PuppetDB and get information

or try  to share one PuppetDB across the different puppetserver

or Upgrade the ancient puppet4 puppetserver

with "backup server" you mean a server that handles backups but has a puppet 4 agent that talks to a puppet 4 infra?

and now you've an additional puppet 7 infra?

is there a reason for the puppet 4 infra? Why isn't the backup server using the new puppet infra?

or a reason why that data can't just live in hiera as a setting

nono, don't use hiera. then puppet 4 lives even longer :smile:

(not that i am anti-puppetdb query, but in this case it does at least allow you a migration path)

let me know if you need professional help :smile:

I absolutely do, but not that a developer can provide :rolling_on_the_floor_laughing:

We were hoping to just replace our servers one by one and remove them over time from puppet4. It seemed like a big task.

Feels bad when I say it out loud, probably because it is. But it's the path we're on atm.

Okay, I have some answers.

What kind of stuff do you get from PuppetDB

so, the other thing is, if you migrate the p4 backup server to p7

the puppet 4 puppetdb will still have the data in it

as long as you don't remove the cert on the server minimally

but it is hackish, and the data does go away after some TTL

and you still need a function to get the data

yea, I am saying migrate the backup server, and then abuse the fact that puppetdb doesn't remove data quickly if at all

sounds like we're going to have to build some kind of bridge no matter what, and it's probably going to be at least a little bit hackish.

puppetdb_query in both instances, the data is not updated in p4 anymore, but it still exists

but then you need to run puppet twice on the backup node, onces against p7 and once against p4

and ensure that both runs don't purge the configs from the other run

I would try to connect the puppet4 puppetserver to the puppet7 puppetdb

or stop the puppet agent on the backup node until the migration is done

because it will repopulate itself after the first run

and so if you migrated the pdb server and then run puppet on the backup server

it should repopulate before anyone hits it

or test all the puppet code with --noop and then move all servers to the new infra in a single change, and not one server after another

dito. had to do that dance with multiple customers

We've been trying to cleanup some of the old things we did on puppet 3 and 4, so we weren't planning to copy most of the modules, but maybe I could make an environment for the old servers and move all the servers to puppet7 infra and then the old modules/puppet4 is completely removed when we update the OS. At that point, everything is in the same puppetdb. Not sure if this is better or worse than any of the other ideas.

and updating the code so it works with puppet 4 and puppet7 is possible

sure. if you need more input or run into weird issues , or need a consultant ,just ask here :smile:

When I was doing a 4 to 6 migration I built a separate puppet 6 server infrastructure and setup an additional noop cron job run on all my agents pointing to it. This was to seed the puppetdb and then check for any changes the agents thought they wanted to make.

Got to upgrade to 7 now, but I _think_ a puppetdb 7 will ‘work’ with puppetserver 6 ok.

Cool. Both ways? Ie does it matter which I upgrade first?

when they are on different servers it's a nobrainer

if it's the same server there were some weird rpm dependency problems. almost like Puppet doesn't want you to mix major versions!

Different servers, but I could choose to upgrade the puppetservers first, or what I’m more inclined to do is upgrade the puppetdb servers first instead.

I’m of the opinion that it should _always_ be possible to have puppetdb one major version ahead of puppetserver. (Maybe with some caveats like you have to be running the latest eg. 6.x puppetserver if you want it to work with a 7.x puppetdb)

No big bang changes if possible is the rule.

Hiera is fully parsed on the puppetserver. It doesn't matter what the OS of the agent is

can you share an explicit example that fails?

I will check for any errors, but I don't think we got any, I believe the variable values just remain empty.  Let me confirm.

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Function Call, Class[Wincognos]:
  expects a value for parameter 'hostname'
  expects a value for parameter 'dispatcher_domain'
  expects a value for parameter 'content_hostname'
  expects a value for parameter 'groupname'
  expects a value for parameter 'database'
  expects a value for parameter 'database_user'
  expects a value for parameter 'database_password'
  expects a value for parameter 'efs_suffix'
  expects a value for parameter 'cogstartup_xml'
  expects a value for parameter 'environment' (file: /etc/puppetlabs/code/environments/development/modules/profiles/manifests/wincognos.pp, line: 4, column: 3) on node <http://w01.dev1.cognos-test.nikecloud.com|w01.dev1.*>**.com
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

you can use `puppet lookup...` on the puppetserver to debug where it's looking for the data

ok let me explore that thanks for the suggestion.

```this is init.pp manifest
class wincognos (
  #String           $hostname                 = 'xxx',
  #String           $dispatcher_domain        = 'xxx',
  #String           $content_hostname         = 'xxx',
  #String           $groupname                = 'xxx',         
  #String           $database                 = 'xxx',
  #String           $database_user            = 'xxx',
  #String           $database_password        = 'xxx',
  #String           $efs_suffix               = 'xxx',
  #String           $cogstartup_xml           = 'xxx',
  #String           $environment              = 'dev',
  #String           $version                  = $trusted['extensions']['pp_software_version'],
  String           $hostname,
  String           $dispatcher_domain,
  String           $content_hostname,
  String           $groupname,  
  String           $database,
  String           $database_user,
  String           $database_password,
  String           $efs_suffix,
  String           $cogstartup_xml,
  String           $environment,
  String           $version                  = $trusted['extensions']['pp_software_version'],
) {

  if ( $facts['datacenter'] == 'aws' ) {
    case $trusted['extensions']['pp_role'] {
      'Dispatcher': {
        include wincognos::dispatcher::config
      }
      default: {
        fail('No valid Role tag value found, aborting component specific installation')
      }
    }
  }
}

this is config.pp manifest

class wincognos::dispatcher::config (
  String $cogstartup_xml        = $wincognos::cogstartup_xml,
  String $hostname              = $wincognos::hostname,
  String $dispatcher_domain     = $wincognos::dispatcher_domain,
  String $content_hostname      = $wincognos::content_hostname,
  String $groupname             = $wincognos::groupname,
  String $database              = $wincognos::database,
  String $database_user         = $wincognos::database_user,
  String $database_password     = $wincognos::database_password,
  String $version               = $wincognos::version,
  String $efs_suffix            = $wincognos::efs_suffix,
) {

}```

```This is hiera values yaml file

---
wincognos::gw_cert_prefix:       'xxx'
wincognos::efs_suffix:           'xxx'
wincognos::hosted_zone_suffix:   'xxx'
wincognos::dispatcher_domain:    'xxx'
wincognos::gw_elb_cname:         'xxx'
wincognos::database:             'xxx'
wincognos::cogstartup_xml:       'xxx'
wincognos::hostname:             'xxx'
wincognos::content_hostname:     'xxx'
wincognos::groupname:            'xxx'```

puppet node able to retrieve the values when we hard code variable values in init.pp but not from hiera

yeah check with puppet lookup which hiera files are used

i tried this command on puppet master but it didn't list anything

`puppet lookup --node <http://w01.dev1.xxx.com|w01.dev1.xxx.com> keyname`

i repalced keyname with one of variable name

you probably want `--explain` and `--compile`

and if the node isn't running in production, provide the environment as well

```Warning: Defining "data_provider": "hiera" in metadata.json is deprecated. It is ignored since a 'hiera.yaml' with version &gt;= 5 is present
   (file: /etc/puppetlabs/code/environments/development/modules/wincognos/metadata.json)
Warning: /etc/puppetlabs/code/environments/development/modules/wincognos/data/common.yaml: file does not contain a valid yaml hash
Error: Could not run: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Function Call, Class[Wincognos]:
  expects a value for parameter 'hostname'
  expects a value for parameter 'dispatcher_domain'
  expects a value for parameter 'content_hostname'
  expects a value for parameter 'groupname'
  expects a value for parameter 'database'
  expects a value for parameter 'database_user'
  expects a value for parameter 'database_password'
  expects a value for parameter 'efs_suffix'
  expects a value for parameter 'cogstartup_xml'
  expects a value for parameter 'environment' (file: /etc/puppetlabs/code/environments/development/modules/profiles/manifests/wincognos.pp, line: 4, column: 3)```

ah it fails to compile because the data cannot be found. try without `--compile`

```Searching for "lookup_options"
  Global Data Provider (hiera configuration version 5)
    Using configuration "/etc/puppetlabs/puppet/hiera.yaml"
    Hierarchy entry "Classifier Configuration Data"
      No such key: "lookup_options"
  Environment Data Provider (hiera configuration version 5)
    Using configuration "/etc/puppetlabs/code/environments/development/hiera.yaml"
    Hierarchy entry "Eyaml Hierarchy"
      Merge strategy hash
        Path "/etc/puppetlabs/code/environments/development/data/nodes/.yaml"
          Original path: "nodes/%{trusted.certname}.yaml"
          Path not found
        Path "/etc/puppetlabs/code/environments/development/data/environment/development.yaml"
          Original path: "environment/%{environment}.yaml"
          No such key: "lookup_options"
        Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development///.yaml"
          Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_role}/%{trusted.extensions.pp_cluster}.yaml"
          Path not found
        Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development///.yaml"
          Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_role}/%{trusted.extensions.pp_role}.yaml"
          Path not found
        Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development//.yaml"
          Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_cluster}.yaml"
          Path not found
        Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development//.yaml"
          Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_software_version}.yaml"
          Path not found
        Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development/development.yaml"
          Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{environment}.yaml"
          Path not found
        Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/teamdata.yaml"
          Original path: "teamdata/data_%{trusted.extensions.pp_application}/teamdata.yaml"
          Path not found
        Path "/etc/puppetlabs/code/environments/development/data/common.yaml"
          Original path: "common.yaml"
          No such key: "lookup_options"
Searching for "groupname"
  Global Data Provider (hiera configuration version 5)
    Using configuration "/etc/puppetlabs/puppet/hiera.yaml"
    Hierarchy entry "Classifier Configuration Data"
      No such key: "groupname"
  Environment Data Provider (hiera configuration version 5)
    Using configuration "/etc/puppetlabs/code/environments/development/hiera.yaml"
    Hierarchy entry "Eyaml Hierarchy"
      Path "/etc/puppetlabs/code/environments/development/data/nodes/.yaml"
        Original path: "nodes/%{trusted.certname}.yaml"
        Path not found
      Path "/etc/puppetlabs/code/environments/development/data/environment/development.yaml"
        Original path: "environment/%{environment}.yaml"
        No such key: "groupname"
      Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development///.yaml"
        Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_role}/%{trusted.extensions.pp_cluster}.yaml"
        Path not found
      Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development///.yaml"
        Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_role}/%{trusted.extensions.pp_role}.yaml"
        Path not found
      Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development//.yaml"
        Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_cluster}.yaml"
        Path not found
      Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development//.yaml"
        Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{trusted.extensions.pp_software_version}/%{trusted.extensions.pp_software_version}.yaml"
        Path not found
      Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/development/development.yaml"
        Original path: "teamdata/data_%{trusted.extensions.pp_application}/%{environment}/%{environment}.yaml"
        Path not found
      Path "/etc/puppetlabs/code/environments/development/data/teamdata/data_/teamdata.yaml"
        Original path: "teamdata/data_%{trusted.extensions.pp_application}/teamdata.yaml"
        Path not found
      Path "/etc/puppetlabs/code/environments/development/data/common.yaml"
        Original path: "common.yaml"
        No such key: "groupname"
Function lookup() did not find a value for the name 'groupname'```

is your data in one of the paths that use the trusted hash and your windows cert doesn't have the correct data?

not sure we will explore that and will update here. Thankyou for the quick responses.

Hi Tim- Thankyou for your troubleshooting guidance. It helped us to figure out the issue and now puppet windows manifest are parsing values from hiera correctly. We've defined hiera repo in puppet control and that name is not matching with the facts we defined. It worked after fixing that facts value.

<@U5V9MMW9E> YOU ARE MY HERO <https://github.com/puppetlabs/puppetlabs-stdlib/commit/837f988ffd5a8bce0d546607a05571dc0fb0526b> :hearts:

:fry_dancing: _:teacher:PE Console_ is about to start up in <#CFD8Z9A4T|>

Hi Team,
For vm build, we are using the vSphere module. It was successful a month ago. Our current problem is listed below. In the module we have specified new template information , but while running puppet apply it looks like pointing to an older datastore path and that path we have not specified anywhere else. Kindly assist me on the below specified error

Okay, thanks. I will tell my colleagues, I guess they did not check that.

<https://www.puppet.com/products/puppet-enterprise/support-lifecycle>

&gt; The open source Puppet projects that are included in Puppet Enterprise, such as Puppet and Facter, adhere to the maintenance and EOL dates for the PE release tracks that depend on them. For example, PE 2019.8 (LTS) uses Puppet Agent 6.x, so bug fixes and security updates for open source Puppet Agent 6.x will be released until the PE 2019.8 (LTS) end of life date of February 28, 2023.

Good to know, I will fwd that, thanks :smile: :slightly_smiling_face:

reading through <https://github.com/search?q=repo%3Apuppetlabs%2Fr10k%20checksum&amp;type=code> I think you can provide your own checksum for a module

and checking through <https://forgeapi.puppet.com/#tag/Module-Operations/operation/getModule> it looke like the forge provides md5 and sha256 :thinking_face:

in `/opt/puppetlabs/puppet/cache/r10k/$module/tarball` I only see an sha256 file

people upload those to <http://forge.puppet.com|forge.puppet.com>

pdk build will create tar ball and that we upload to repository.

yes. so if you care about files within the tar archive, you need to look at pdk or puppet-modulebuilder, not r10k

No, I am new to r10k. tar.gz generated by pdk build does not contain checksum file.
Mostly it should be done at repository level or r10k level while installating module.
Please correct if I am wrong

r10k just downloads the archive, it doesn't modify it

I can see below files
```/opt/puppetlabs/puppet/cache/r10k/$module/
/opt/puppetlabs/puppet/cache/r10k/$module/md5sum
/opt/puppetlabs/puppet/cache/r10k/$module/module.tar.gz```

ah so you're not talking about a checksum within the tar archive

did you download the module from <http://forge.puppet.com|forge.puppet.com> or something else?

<http://forge.puppet.com|forge.puppet.com> usually supports md5 and sha256 and r10k should default to sha256

I download from internal repo, but it support both

so I guess you don't download from <http://forge.puppet.com|forge.puppet.com> or you download an old module that only has md5 checksum

then check if your internal repo supports sha256

any command  which I can try and confirm explicitly ?

I'm not sure if r10k logs the api calls when you run it with debug2 loglevel

Hi <@U1PC2RAH0> <@U2S1MUUQ7>
I am able to download sha256 and md5 checksum if I use
```curl https://&lt;module_url&gt;.tar.gz.md5 or 
curl https://&lt;module_url&gt;.tar.gz.sha256```
But r 10k is failing with error "*Could not verify module, no SHA256 checksum available, and MD5 checksums not allowed in FIPS mode*"

I cannot reproduce this with the puppet forge. I suggest to set the maximum loglevel and check which http calls are actually executed

where are your md5 filew coming from when r10k says md5 isnt supported

I am using jfrog repo not puppet forge directly. One query how I can get the module metadata through api?

its seems puppetforge.file_sha256 is not available.
Is it related to <https://jfrog.atlassian.net//si/jira.issueviews:issue-html/RTFACT-26143/RTFACT-26143.html>

Hi <@U2S1MUUQ7> <@U1PC2RAH0>
Is there any workaround, I can make r10k to take sha256 from other source like Puppetfile or different url like &lt;repo_url&gt;/&lt;module&gt;.sha256 ?

Hi Team,
how we can call your module in ansible playbook for Jenkins job?

This is the error I keep getting.

bolt command run 'whoami' --targets linux
Started on camnpunbutt...
Failed on camnpunbutt:
  Failed to connect to camnpunbutt: No route to host - connect(2) for 106.1.220.243:22
Failed on 1 target: camnpunbutt

I have configured the inventory file to load config from ~/.ssh config.

The only way I can get it to work is by running bolt from the command line and entering my password.

bolt command run "uname -n" --targets camnpunbutt.cam.scsc.local --user nbutt --password-prompt

<https://www.puppet.com/docs/pe/2019.8/component_versions_in_recent_pe_releases.html|https://www.puppet.com/docs/pe/2019.8/component_versions_in_recent_pe_releases.html>

Looks like my version of Ruby/bundle from "Red Hat Software Collections" doesn't have or doesn't support the -a options.

I was using ruby 2.7.  Ruby 3.0 supports the -a/-A.  Thanks.

In my attempt what I'm getting is
Could not parse for environment *root*: Syntax error at ':'

:+1: cool cool. So the next step is to figure out what's failing

turns out that Puppet doesn't do ternary operators

<https://www.puppet.com/docs/puppet/8/lang_conditional.html#lang_condition_selector>

but even if it was, where would joy come from?

short answer, you _can_ do selectors in a class signature, but it makes the code less readable. You should consider refactoring to something favoring readability rather than conciseness.

In general, when I've thought I've needed conditional logic in a class parameter, it turns out I can use Hiera instead.

If $main_joy was true, $joy would be true otherwise it would be false. That would make $test_var1 true or false

You can have (almost) any puppet expression as the default value expression. As pointed out it may not read all that nicely, and tools that generate documentation for your classes won’t do a good job.

<@U042TSQKU8Z> unclear what you are trying to do - looks like both $joy and $main_joy are two global variables acting as independent input? 
Or, are you trying to state that the class has three parameters $test_var1, $joy, and $main_joy and that $test_var1 is a combination of the two using “and” ? 

hrm. Slack doesn't seem to be unfurling links :confused:

Hey, hey! Puppet is hosting a PlatformCon 2023 Watch Party in the Portland office. What's PlatformCon, you ask? It's some of the world's top DevOps and platform engineering leaders on one virtual stage, and we'd love you to watch the kickoff with us.
<https://forms.gle/ddC2aEfiryJsz7xSA>

Does anyone know when Puppet are planning to release Puppet Tools packages that aren't for an EOL Fedora release?
I thought one might have been added now Fedora 38 is available, but still showing version 36 and below