This message was deleted.
# office-hourss
Slackbot
04/27/2023, 9:19 PMThis message was deleted.
b
binford2k
04/27/2023, 10:01 PMbinford2k
04/27/2023, 10:02 PMPuppet will use the hostname as its certname. If it doesn't have a cert for that name, it will start the cert request process.
binford2k
04/27/2023, 10:02 PMaka, your hostname is changing
k
Ken
04/27/2023, 10:12 PMbut - my hostname isn't changing. It's configured as <hostname> only. The only way a .lan or .home can be found is using like dns lookups or something like that.
both hostname and hostname -f return simply <hostname>
Is there a best practice to avoid this - maybe put a local /etc/hosts entry too or something?
b
binford2k
04/27/2023, 10:14 PMSorry. Will clarify. Per the docs
Defaults to the Host's fully qualified domain name, as determined by Facter
k
Ken
04/27/2023, 10:14 PMahhh... the plot thickens
b
binford2k
04/27/2023, 10:14 PMAka,
facter fqdn👍 1
binford2k
04/27/2023, 10:15 PMFacter has to guess sometimes because fqdn can be surprisingly non deterministic is some circumstances
k
Ken
04/27/2023, 10:15 PMwell, facter fqdn also returns just <hostname>
b
binford2k
04/27/2023, 10:16 PMRun as root, with a limited environment like a system service would have
k
Ken
04/27/2023, 10:18 PMno change, <hostname> everywhere, I even grepped facter for .lan and .home
Ken
04/27/2023, 10:59 PMy'know though - I could force the name in puppet.conf with that certname parameter set with <hostname> I bet.
b
binford2k
04/27/2023, 11:05 PMif you know what you want the certname to be, then you can just specify it in puppet.conf https://www.puppet.com/docs/puppet/latest/config_about_settings.html
k
Ken
04/27/2023, 11:17 PMyep, that's what I'm trying now on one of these filthy machines
Ken
04/27/2023, 11:30 PMwelp, that didn't work either - I put the certname parameter under the [agent] section. Maybe put it under the [server] section? I dunno man, this is nuts
g
glee
04/27/2023, 11:48 PMcertname should be under [main] section in the agent's puppet.conf https://www.puppet.com/docs/puppet/8/config_file_main.html
👀 1
b
bastelfreak
04/28/2023, 6:50 AMThere's a reason facter looks for the FQDN, not hostname. There's a bigger chance that the FQDNs are unique across all your servers, the hostname isn't
bastelfreak
04/28/2023, 6:50 AMand you can only have one certificate per common name. So a certificate for the FQDN is recommended
bastelfreak
04/28/2023, 6:51 AMI would never set certname to a hostname
👍 1
agreed 1
k
Ken
04/28/2023, 11:00 AMagreed - but for our small 'test' network, this would be fine. But yea, for our main 'prod' network, for sure. Thanks!