Puppet Community

it was what I was doing, but the links are different in buster vs. bullseye for example

maybe `    unless  =&gt; "[ '$facts['timezone']' == 'UTC' ]",`

```unless $facts['timezone'] == 'UTC' {  
  exec { 'set UTC time':
    command =&gt; '/usr/bin/timedatectl set-timezone UTC',
  }
}```

or you can make timezone parameter to the class and use that

maybe you will need non-utc in the future

```Jeralds-MacBook-Pro:qualys jsheets$ facter timezone
EDT```


so, like <@U2S1MUUQ7> noted, the facts hash looking at the timezone would be a better, more style-compliant route.

<@U0V0QHGBZ> is going to be keynoting PlatformCon this Friday and it looks super interesting. <@U038WTY0D6X> posted a bit more info in the <#C0W1XGVNU|> channel if you wanna check it out, <https://puppetcommunity.slack.com/archives/C0W1XGVNU/p1654526552641649>

:wave:  I am currently looking at writing some custom facts , however these are based around our Antivirus product.

The facts are password protected, what do you feel would be a reasonable approach to passing this password into the fact so it can be used as part of the lookup ?

ability to deploy parametrized lib/ objects in puppet has been limited. You can deploy secrets in a file and read that file from a custom fact, will require two runs though

I mean is the end value of the fact expected to change often?  Or basically an installed/not-installed value?

Yea, so this is probably something based on what your security team is comfortable with.  Facter runs on the agents before any hiera/eyaml runs on the server.

So the agents need the password info.  Either from a file on disk, or possibly an ENV variable.

Or the fact has to be smart enough to make a call out to a 3rd party system.

Yeah I have went down the route of writing a module which runs on the puppet master only.

The device will check in and report it’s device UDID which is an unprivileged, the master will then do a lookup against an array of provided key/values and then make the appropriate API calls.

Password never has to be written to disk or on any clients and we can use a low privilege service account with only labels permission on the compile master

<@U028DNXEJJY> We use vault_lookup module for secrets mgmt within puppet.  Something to try if you have vault.

For better context this is , list associated tags of an agent to then CRUD associated Tags in line with puppet config.

Example use case would be.

• HTTP Lookup expected values
• Inspect agent for values
• Apply diff.
for doing dynamic group assignment in AV service

my first install of puppet, and I'm wondering if the instructions are clear - to sudo or not sudo

#agent config:
puppet config set server myserver --section main

shouldn't that be run as sudo/root ?   Along with the puppet ssl bootstrap command?

i ran it as my normal user, ubuntu.  But obviously, it didn't update /etc/puppetlabs/puppet/puppet.conf

Thanks.  I'll attempt to fix.   Most likely be back with questions.

I don’t see anything in the source that allows you to pass an environment variable into the provider:

<https://github.com/puppetlabs/puppet/blob/main/lib/puppet/provider/package/pip.rb>

It's the #4 top voted issue (for the package type in general) <https://tickets.puppetlabs.com/browse/PUP-1526>. Please add your use cases to that ticket if you haven't already

See the `puppet-python` module at <https://forge.puppet.com/puppet/python?src=slack&amp;channel=puppet>

`puppet query 'factsets { certname = "$FQDN"}'` should do it

otherwise `puppet facts show` on a node provides you the same informaiton

And for a specific fact like "'boardproductname"?

`As a PQL: query='factsets {name = "boardproductname" }'?`

do you want all nodes with that fact or do you want the values for that fact across all nodes?

The (unique)  list of all the values that fact assumes across alla nodes...

Hmm, that gives me the certnames as well...

Ahh, I could project the value using "facts[value]..."

I forgot to thank you, bastelfreak... I was in a big rush. So a belated thank you! :smile:

users of <https://github.com/voxpupuli/puppetboard> - to add ssl and authentication, do you go through a reverse proxy or something?