This message was deleted.

I have no clue what

support_tasks::st0317b_purge_node

is, but if the new node using a different certificate and you don't allow duplicate, you will need to clean the certificate on server and node and regenerate, or just copy the old one from the old one if you have them.

support_tasks come from a module you can install. My Jumpstart techs had me use it to lessen the use of command line on the server. I guess my main question is if one field is the hostname to clean (the server decommissioned) what is the target? seems like I remember that being the PE host itself as it is where the cert record is. To clarify, I had to have a host rebuilt. There is no cert available any longer so I will need to redeploy. But, I now have to get it off the Puppet server records. So if I use enterprise_tasks::puppetserver_ca_clean, enter the hostname to clear its record, I still need to select a 'target' from the target list. What is that value supposed to be.

Target will most likely be PE server where you run the command as if you logged in from looking at the task

puppetserver_ca_clean
class PuppetserverCAClean < EnterpriseTaskHelper
  def task(host: nil, **_kwargs)
    ...
    test_cert_cmd = ['test', '-e', "#{ca_dir}/signed/#{host}.pem"]
    _output, cert_status = Open3.capture2e(*test_cert_cmd)
    test_csr_cmd = ['test', '-e', "#{ca_dir}/requests/#{host}.pem"]
    output, csr_status = Open3.capture2e(*test_csr_cmd)
    cmd = ['/opt/puppetlabs/bin/puppetserver', 'ca', 'clean', "--certname=#{host}"]
    output, status = Open3.capture2e(*cmd) if cert_status.exitstatus.zero? || csr_status.exitstatus.zero?

Thanks Justin. I just envisioned blowing away the PE hosts cert or something tragic. There was too long between my jumpstart and really getting going on this.

hey Jerry the target will be the primary where it will need to run the Puppet certificate commands against your list of nodes. It actually runs a check to make sure you are on the Primary https://github.com/puppetlabs/support-tasks/blob/main/tasks/st0317b_purge_node.rb#L17-L23

Thanks David as well. I've read the docs but it's now even less clear. When do you purge vs clean?

Purge if you wanna clear out all the data for that node , even in puppetdb.. If you just wanna replace the node with something new and keep the data, dont purge and just clean.

sorry I clicked wrong variant of the task heres the clean https://github.com/puppetlabs/support-tasks/blob/main/tasks/st0317a_clean_cert.rb#L22-L30

Off to make notes... I'm introducing this to more of the team next week. Really appreciate the guidance.

https://support.puppet.com/hc/en-us/articles/360012551294-Clean-or-purge-nodes-using-a-task-in-Puppet-Enterprise Theres a support article around using these tasks

Or reconfigured the web rules to allow you to clean over http, hehe

and also a more detailed article explaining the underlying commands and the differences it has on data https://support.puppet.com/hc/en-us/articles/1500010845362-Removing-nodes-Understandin[…]node-purge-node-ttl-and-node-purge-ttl-in-Puppet-Enterprise

ooh, thanks David. I like the deep dives like that.

the support article are all open now so its well worth a search in there