Puppet Community

"failures appear in the file last_run_summary.yaml" what kind of failures? Can you share them?

I won't be able to share files - sorry (air-gapped environment)
But the line at the end of the yaml that is title events can show failure: &gt; 0

On the server I am currently examinig - failure is 4 yet puppet ran in te last 1/2 hour.
In the puppet.log I have the following entries:

Unable to fethc my node defiition, but the agent will continue:
SSL_connect returned=1 error=0 state=error: sslv3 alert certificate unknown
....
Could not retrieve catalog from remote server: SSL_connect returned=1 error=0 state=error: sslv3 alert certificate unknown
....
Applied catalog in 8.58 seconds (edited)

Now if I run the command "puppet agent -t" if will be successful and perform an update.
What's the difference?

After running from te command line then the puppet.log is now completely different:

Using configured environment 'Production'
Retrieving pluginfacts
Retrieving plugin
Retrieving locales
Loading facts
Caching catlog for hostname
Applying configuration version 'NUMBER'
Applied catalog in 8.98 seconds

The last_run_summary.yaml has 'failure: 0'

Nothing was canged on the server or client

This is just an example of course.

sounds like certificate errors. Do all runs fail from the puppet service? Do you have multiple compilers?

Usually that error only appears sometimes and indicates a broken compiler/loadbalancer

Why does the puppet sevice fail but the command line succeed?

thats why I asked if the service always fails

maybe its just a coincidence that your command kine succeeded

No - that's the usual case. I.e when the puppet service isn't working then the command line does. This doesn't mean that the service will run corerectly next time, though.

In this case the service is up and runnig - is that what you're asking?

no. puppet runs as daemon in the background. every X minutes it requests a catalog and tries to apply it. you mention you see errors in the puppet agent log file. Do all requests fail with that TLS error or do some succeed?

there are no TLS errors when I run the command 'puppet agent -t'. My question is what's the difference between the command line and the service?

so again: are there always TLS errors in the log or does the service sometimes succeed?

if it always fails it's a local error because of the differences in your shell vs the service (for example a http_proxy environment variable)

I have 100s of servers where this is failing in the same fashion. How can I check what is happening across my environment? As I said, its not a single machine

sorry, but I asked you this multiple times. Are there always TLS errors in the log or does the service sometimes succeed?

And I also asked "Do you have multiple compilers?". How is your infrastructure setup? do you have any loadbalancer/dns round robin for the puppetserver?

Thre is no LB or RR in front of the Puppet server. I'm checking out the "multiple compilers" (I didn't create this envirnment - just trying to fix it

restart the service, perhaps something is cached. I had this after updating an expired cert

another way of validating a variable? Another datatype?

We are using something like that:
if ( $available_named_users =~ Stdlib::Compat::Hash ) and ( $enabled_named_users =~ Stdlib::Compat::Array ) {


Stdlib::Compat::Hash was removed in stdlib v9.0.0

what do you want to do, check the datatype?

just check for the native datatype:
```if ( $available_named_users =~ Hash ) and ( $enabled_named_users =~ Array ) {```

is_hash is also removed in stdlib 9.0.0 :confused:

all this legacy stuff that's deprecated since years :slightly_smiling_face:

Yeah, we wrote this legacy code in 2016 or 2017 :wink:

back then it was already legacy :slightly_smiling_face:

i will check now all modules (~170 ) with a different r10k branch and stdlib v9.0.0 and fix those issues

sounds good, let me know if you run into more errors

what is for puppet 8 is the new way to use ::kernel

facts.kernel (dot notation in hiera?)

possible to download a tiny file from master/compiler to the agent that is not in a module path?

i.e. instead of
```file { '/path/on/client/myfile.txt':
  ensure =&gt; file,
  source =&gt; 'puppet:///modules/mymodule/myfile.txt',
}```
something like
```  file { '/foo_user/foobar/foo.txt':
    ensure =&gt; file,
    source =&gt; '/new_user/foobar/foo.txt',
  }```

obviously the bottom one doesn't work which is why i'm asking

<@U035NAH9QUU> <https://www.puppet.com/docs/puppet/7/config_file_fileserver.html>

I've never used them, but should do what you want.

I'd be curious what you're doing with it and if it shouldn't be in Jenkins or whatever creating an apt/rpm for agents to consume. Grabbing files from the puppetserver seems a little sketch. I'd guess you're generating some cluster level config that's easier to determine membership outside of a catalog compile.

I did that by creating a symlink from ../mymodule/symlink/somewhere/on/filesystem/

Ask in <#C9KFTKRU3|> I think Smortex knows what’s outstanding. Not much but a release probsbly a few weeks out 

do you actually want Puppet 6 or is 7/8 fine as well?

Note there is an answer, but I expect it to be incorrect; the fact that `<https://apt.puppet.com/puppet6-release-jammy.deb>`  exists to me is a clear sign that Puppet engineers have taken the effort to support the combination of Puppet 6 and Ubuntu Jammy JellyFish

We are upgrading from Puppet 5.5, Puppet 7 / 8 should be fine too :slightly_smiling_face:

<https://apt.puppet.com/pool/jammy/puppet6/p/puppet-agent/index.html>

Yes, I’m running from Apple M1 Docker host. Is that the issue?

Aha thanks. I’m trying to run docker-container then with amd64 arch. Changed in Dockerfile:

`FROM ubuntu:jammy`

to

`FROM --platform=linux/amd64 ubuntu:jammy`

Now trying it out :slightly_smiling_face:

but then it's MacOS and no real docker anyways

Yeah, I understand now. Still trying it out, should maybe be possible with x86 compatibility mode of M1?

arm64 native package of puppet 7 is available for Ubuntu 20.04 just in case

In theory it’s possible to run an x86_64 container on arm64 linux vm but you need qemu as a binary translation layer 

run puppet facts show and search for non ascii chars

I mean puppet can do it. But one time execution on initial setup is usually something you want to include in your setupscript/template whatever. But that depends on your use-case. There are conditional exec commands.
Is it something that should be rerun on certain conditions or is it a "run-forget-never touch again" type of command?

I hit this recently, command can't be an array before 6.24

the $confd_dir value is     $confd_dir            = "${httpd_dir}/conf.d" so no issue with that for me

I use this module on Debian also, but I don't have same issue

I saw the same issue here: <https://puppetcommunity.slack.com/archives/C0W298S9G/p1686079727120559>

<@UBZ2TFG1M> what version of the puppet agent are you using? this appears to be similar to earlier issue: <https://puppetcommunity.slack.com/archives/C0W298S9G/p1686079727120559> -- you want to be on puppet 6.24 or later <https://www.puppet.com/docs/puppet/6/release_notes_puppet.html#enhancements_puppet_x-7-9-0-PUP-5704>

that is puppet 6.24 added support for "The exec provider supports commands as an Array"

right ! didn't see that we deployed puppet 6, but on the faulty server I got :
``` -bash-4.2$ rpm -qa | grep puppet
puppet-agent-5.5.22-1.el7.x86_64```

thank you for pointing me to the right path !

:beaker: _:teacher:Puppet Forge_ is about to start up in <#CFD8Z9A4T|>

who was born on September 24th, 1985? :slightly_smiling_face:

`dropsonde/gems/` is wayyyyy off the beaten path. Whatever is in there is most likely just an example file that was included with a gem install.

`/etc/puppetlabs/puppet/fileserver.conf` is the default location used by the `puppetserver` package:

```# puppet config print --section server fileserverconfig
/etc/puppetlabs/puppet/fileserver.conf```

Any word on when puppetserver/puppetdb will be released for ubuntu 22(Jammy)

Thanks for your help validating the fix <@U2S1MUUQ7>!