Puppet Community

can you check the puppetserver.log on the compiler?

Nothing is really jumping out related to that.

We ran into this before and puppet said something about the snakeyaml issue here:

<https://bitbucket.org/snakeyaml/snakeyaml/issues/553/loaderoptionssetcodepointlimit-not-honored>

We think we ran into that again, but with a different yaml file...

This is the result of a CVE fix that shipped a few months ago. The Java library used to parse YAML files added a hard limit on file complexity in order to close a denial of service vulnerability.

Check your Hiera data for files larger than 3 MB in size. If there are any, they'll need to be split into smaller pieces.

Often with large blocks of text, there's a good chunk of boilerplate that can be moved to a template leaving behind a smaller amount of data that varies between Hierarchy levels.

for huge eyaml blobs I now prefer hashicorp vault, for example

Thanks, all. We are looking into options.

Is there an option we can put that would/could expand the limit?

It looks like the SnakeYAML library does have `setCodePointLimit` and `setNestingDepthLimit` methods --- but those are not exposed at the JRuby level yet:

<https://github.com/jruby/jruby/issues/7543>

So, the limits are fixed to the SnakeYAML defaults of 3 MB for size and 50 for nesting depth.

Does anyone know if there is any caching of the larger yaml files at the agent level? We are "smallerizing" the yaml files or even converting to json at the compiler, but still getting the code point error.

It would be helpful if the output would name the file that is violating...