QQ about certificate auto-renew https://help.puppet.com/pe/2023.8/topics/certificate-authority-service-parameters.htm I've noticed my compilers all do a cert backup + restart puppetserver at the same time, every 90 days. Are they backing up downstream agent certs? Or is the backup+service restart required when they update their own agent certs? If it's the latter, I suppose the problem is they were built at the same time, and we'd be better off staggering them a bit. (It's pretty disruptive to performance -- completely emptying out puppetserver's various caches)

It's the latter, and yeah, we know it can be disruptive. Can't give you timing, but we have an internal ticket around reloading those without restarting the services

any best practices for workarounds? just use puppetcode to randomize the

auto_renewal_cert_ttl

interval over a small range? 😄

yeah, trying to get the staggered would be the ticket - maybe set it shorter and force a puppet run on one or two, then set the period back up?

I think, if you loop through the compiler pool once and run the regen cert task on one, or a couple, compilers each day, that should stagger their renewals out going forward.

run the regen cert task on one, or a couple, compilers each day

Only cert task i see is

enterprise_tasks::backup_certs

? We're looking into extending our renewal interval and also staggering. Thanks folks 👍

It would be a

puppet infra run

sub-command. Let's see...

oh interesting. Isn't the agent cert also used as the infra cert? How does this work under the covers to pass the cert to the compiler? pxp, or does it just wait for the next agent checkin?

If I recall correctly, it runs the regen operation over PXP using a plan that coordinates submitting a certificate request from the compiler and signing it on the primary. I forget how exactly the PXP connection is maintained when the certificate switches, but I recall SSH also being a transport option.