Puppet Community

How do I enter a bash command with curly braces inside an exec?

`command  =&gt; 'var=$(awk -F: '($2 == "" ) { print $1 }' /etc/shadow)',`

this is giving me an error : syntax error at line 58 '{'

<@U05C95Y478F>
It's definitely a syntax error. Your single-quotes are mismatched.

Try `command  =&gt; "var=\$(awk -F: '($2 == \"\" )' { print \$1 }" /etc/shadow)',`

tried to run that, its giving me this error :

*`Syntax error at ')' (file: /home/ccpro/env_var_test.pp, line: 3, column: 87`*

I'm thinking the curly braces need to be escaped or some sort?

Sorry; I mis-parsed your intent. End-of-string is just before the comma.

`command  =&gt; "var=\$(awk -F: '(\$2 == \"\" )' { print \$1 } /etc/shadow)"`

dollar-signs and quotes are your problem.

Yeah, I didn't want to get into why calling awk from an exec is probably the wrong thing to do...

will do some testing, thank you for the help! Much appreciated! <@U029LLEG9QQ>

<@U05C95Y478F>

As <@U1PC2RAH0> pointed out, calling `awk` from a Puppet `exec` is probably a bad idea, regardless.

I was assuming that you were just playing around for educational purposes, but setting a `var` environment variable within a Puppet `exec` resource will have zero net effect.

where does the puppet master write it’s performance/telemetry if you’ve not to puppetdb installed ?

what kind of performance/telemetry do you have in mind

for the actual puppetserver that's never written to puppetdb

puppet agent reports contain some information about the catalog application, those can be written to puppetdb

(I’m reading the operational_dashboard module) and it looked like it was trying to query puppetdb

right, they are stored in postgres on my setup, and I see that in the module

it queries puppetdb to get puppetdb performance data

right, I see what you’re saying, I’m not using puppetdb so I don’t need that

Untitled

[root@usdc01adpppt001 ~]# puppet --version
7.21.0
[root@usdc01adpppt001 ~]# puppetserver --version
puppetserver version: 7.9.3

IM not actually seeing “decrypt error” as any standard puppet output, this could be coming from an extension or a module

try `puppet facts show`. this might throw the same error

closest thing i can think of is “tlsv1 alert decrypt error” which i mention only because you mentioned changing certs but this would happen at retrieve catalog and not apply catalog

given the feedback on modules, I'm guessing:

binford2k-node_encrypt (v0.4.1)

See the `binford2k-node_encrypt` module at <https://forge.puppet.com/binford2k/node_encrypt?src=slack&amp;channel=puppet>

deprecated. looks like there is a replacement. I'm going to pull it out and swap to the replacement and see if that helps. Thanks for pointing me a direction

If this is `node_encrypt`, it sort of seems like the catalog is being encrypted with the old key and the agent is failing to decrypt with the new key --- or vice versa.

it works for agents in the field, it is only the puppetserver that fails to pull catalog.

I swapped to the recommended version, that failed. I'm now removing all secret references to rule it out

I did a lot of cert regenerations in the past and never saw that error with node_encrypt

can you do another puppet run with `--debug --http_debug`?

new error on that one:
Error: Could not run: Could not create PID file: /var/run/puppetlabs/agent.pid

ran a couple ways to make sure it wasn't a generic permission issue, only get the pid error with --http_debug

It is definitely node_decrypt. I've removed the module and removed all references in my modules and now it is running clean

Eh. Catalog is still owned and only readable by `root:root`. The only difference is some values are not obfuscated by a key that is also owned and only readable by `root:root`.

So, it is theoretically less secure. Practically, if you've got a hostile `root` account, you need to tear the node down, rebuild it, and rotate credentials regardless of whether `node_encrypt` is in use or not.

`node_encrypt` mainly defends against hostile security teams that most often have better things they could be doing with their time than zeroing in on files that are owned by the `root` acount.

agreed. the node_encrypt was leftover from an ad-join password that was used commonly... we've since changed to a rotating pass and restricted the account, so the vulnerability is mitigated in other ways

thanks all for getting me down the right direction

does anyone have a one liner to run `puppet agent -t` in a loop until the node fully converges?

`until puppet agent -t; do echo "trying..."; done` maybe?

the max in my envs is currently 4 as well

that can run forever :slightly_smiling_face:

its usually 3 but sometimes service restarts cause issues

4 is when installed agent outdated and get updated on first run

the main culprit for me is modules using package which aren't ordered on yumrepo resources... and then redhat has a huge number of packages which monkey with config files from post scripts (this drives me crazy)... which then causes puppet to restart services on run number 3...

We are good with that, normally, but, AD integration requires a restart of puppet

it messes with at least half a dozen files that puppet is managing

I have the same with NSS :slightly_smiling_face:

ok, how about `until [[ $I -gt 5 ]]; do ((I++)); if puppet agent -t; then break; fi; done` ?

if you need to do multiple runs anyway you might improve your life quality by using tags, for example `--tags yumrepo` on the first run

I am considering going back to using a catch all resource collector for ordering

I stopped doing that at some point and I recall why now

so `((I=I+1))` and `((I+=1))` are both fine but `((I++))` has a non-zero exit

bash logic... for when you want to make cat logic look reasonable.

<@U1PC2RAH0> ++ for doing yumrepos by tags... I'm doing a wave of leapp upgrades and that has cut down on the noise a fair ammount

I'm doing "double leapps" from EL7 -&gt; EL8 -&gt; EL9 for ceph nodes and its... painful

upgrades were pretty painless too as I would build a stage3 tarball per quarter and then rsync/untar it across all the hosts

this was before puppet but after I had run screaming from cfengine for the second time

this was also after having played with bcfg2... gentoo in prod was considered less painful :wink:

wow... ftp links: <http://bcfg2.org/download/>

I found that for our catalog 4 is the max