Re: [Puppet Users] auth failure under unicorn with 2.6.1rc2

2010-08-27 Thread Brice Figureau
On Thu, 2010-08-26 at 15:09 -0600, Dan Urist wrote:
 On Thu, 26 Aug 2010 22:34:59 +0200
 Brice Figureau brice-pup...@daysofwonder.com wrote:
 
  On 26/08/10 21:55, Dan Urist wrote:
   I'm trying to set up a puppetmaster under unicorn using the ubuntu
   maverick packages (currently at version 2.6.1rc2), and I'm getting
   the following error:
   
   r...@test.puppet.cms.ucar.edu $ puppetd -t
   err: Could not retrieve catalog from remote server: Error 403 on
   SERVER: Forbidden request:
   test.puppet.cms.ucar.edu(128.117.224.193) access
   to /catalog/test.puppet.cms.ucar.edu [find] at line 98 warning: Not
   using cache on failed catalog err: Could not retrieve catalog;
   skipping run
   
   I'm using the standard auth.conf, but if I turn off auth by adding
   this to the top of the file everything works:
   
   path /
   auth no
   allow *
  
  Of course you understand the security risk if you run with this
  auth.conf :)
 
 Yes, I just tried this for testing.

OK, I prefer to check :)

   Has anyone seen this, or know of a workaround?
  
  The usual cause is that the SSL end point didn't propagate to the
  master the fact that this node's certificate validates.
  
  This is usally done by adding some HTTP headers in the request, and
  you need to tell puppet what those headers are.
  For rack you need to set:
  
  [puppetmasterd]
  ssl_client_header = SSL_CLIENT_S_DN
  ssl_client_verify_header = SSL_CLIENT_VERIFY
 
 I have this, but it's under master rather than puppetmasterd. I've
 tried it under puppetmasterd and I'm getting the same failure.

Yes, you should use master for 2.6, but puppetmasterd for 0.25.

  Off course you also need to configure the ssl endpoint to set those
  headers when the cerficate is valid (and also when it's invalid).
  You didn't mention what was the SLL endpoint in your configuration so
  I can't really help for this.
 
 I'm using nginx, and I've followed the docs at:
 http://projects.puppetlabs.com/projects/1/wiki/Using_Unicorn
 
 The relevant parts of my nginx config, per the doc, are: 
 
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Client-Verify $ssl_client_verify; 
  proxy_set_header X-Client-DN $ssl_client_s_dn;

Note that the config snippets I sent you refers those headers as
SSL_CLIENT_VERIFY and not X_CLIENT_VERIFY.
Either correct the configuration or nginx, but both should use the same
header names.

  proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
  proxy_read_timeout 120;
 
 So as far as I can see, those headers are being set. Any hints on
 debugging this?

There are several possibilities:

* check puppet uses the correct $ssldir. I've already seen people using
a different $ssldir when running the master differently, in which case
the master regenerates a CA, and client certs are not compatible
anymore.

* check that the client cert is valid (ie it was signed by your master
current $ssldir CA). This can be done with openssl

* run nginx in debug mode to check it sets correctly the upstream
headers

* use tcpdump/wireshard to capture the http traffic between nginx and
unicorn and check the headers are there and correct.

* add some Puppet.notice() statements in puppet ruby rack adapter (in
lib/puppet/network/http/rack/rest.rb) around line 93 to print the
various values and which branch of the if is taken.

Hope that helps,
-- 
Brice Figureau
Follow the latest Puppet Community evolutions on www.planetpuppet.org!

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Change date format in puppet-dashboard

2010-08-27 Thread matonb
Is it possible to change the format of the date in puppet-dashboard,
from the American style to the format the rest of the world uses?

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Re: quoting special characters in puppet.conf

2010-08-27 Thread Amos Shapira
Hi Tom,

That's what I tried but it doesn't help.

e.g. here is what I tested again right now:

diff_args = -ubB -I \$HeadURL

and here are the errors that I get:

err: /File[/usr/lib64/nagios/plugins/check_state_file.pl]: Failed to
retrieve current state of resource: Could not find value for $HeadURL

Thanks,

--Amos

On Aug 25, 11:15 pm, Tom Duckering tom.ducker...@gmail.com wrote:
 I believe the escape character is simply \

 I use it to escape quotes - \

 On 25 Aug 2010, at 12:35, Amos Shapira wrote:

  Patrick,

  I see only a quote of my question in your reply.

  Do you have an answer?

  Thanks.

  --Amos

  On Aug 25, 6:28 pm, Patrick kc7...@gmail.com wrote:
  On Aug 24, 2010, at 11:52 PM, Amos Shapira wrote:

  Hello,

  I'd like to pass the following flags to diff through puppet:

  -urbB -I $Id -I $HeadURL -I $URL

  But when I try to set diff_args in /etc/puppet/puppet.conflike this:

     diff_args = -ubB -I \$Id -I \$HeadURL -I \$URL

  Puppet tries to interpolate the $Id and fails.

  How can I quote the '$' sign so puppet will pass it as-is to diff?

  I'm using puppet 0.25.4 on CentOS 5.5 x64_86.

  Thanks.

  --
  You received this message because you are subscribed to the Google Groups 
  Puppet Users group.
  To post to this group, send email to puppet-us...@googlegroups.com.
  To unsubscribe from this group, send email to 
  puppet-users+unsubscr...@googlegroups.com.
  For more options, visit this group 
  athttp://groups.google.com/group/puppet-users?hl=en.

  --
  You received this message because you are subscribed to the Google Groups 
  Puppet Users group.
  To post to this group, send email to puppet-us...@googlegroups.com.
  To unsubscribe from this group, send email to 
  puppet-users+unsubscr...@googlegroups.com.
  For more options, visit this group 
  athttp://groups.google.com/group/puppet-users?hl=en.

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Sourcing reports from different locations.

2010-08-27 Thread Craig Dunn
It looks like puppet 2.6 loads reports from puppet/reports - is
there a way to specify another location for report files so you dont
have to manually copy the .rb file to
/usr/lib/ruby/puppet/reports?

What I'd like to do is tell puppetmasterd to also look in
/usr/share/puppet-dashboard/ext/ for instance.

Is this doable? I've looked through the code and from what I can see
it's not, though my Ruby is not that grand!

Cheers
Craig

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Re: quoting special characters in puppet.conf

2010-08-27 Thread Darren Chamberlain
* Amos Shapira amos.shapira at gmail.com [2010/08/27 01:06]:
 e.g. here is what I tested again right now:
 
 diff_args = -ubB -I \$HeadURL
 
 and here are the errors that I get:
 
 err: /File[/usr/lib64/nagios/plugins/check_state_file.pl]: Failed to
 retrieve current state of resource: Could not find value for $HeadURL

In many config files, such as mutt's, you need to double all the
backslashes, to protect them from the dereferencing that happens
during parsing.  So, in \\\$HeadURL, the first \ would escape the
second \, and the third \ would escape the $, so that what gets
passed through is \$HeadURL.

Thus, this is untested speculation, but it can't hurt to try:

  diff_args = -ubB -I \\\$HeadURL

-- 
Darren Chamberlain dar...@boston.com

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] inventory of managed resources

2010-08-27 Thread Adam Winberg
i discovered by accident that i can sort of get the functionality i want by
using puppets apache logs (i run puppet via apache+passenger). In the access
log each attempt to fetch a file from puppets fileserver is logged, if the
file is absent it logs a 404 and if it is a match a 200 return code:

clientX - - [27/Aug/2010:12:02:50 +] GET
/production/file_metadata/lindafiles/etc/rsyslog.d/rsyslog-puppet.conf--
HTTP/1.1 404 75 - -
clientX - - [27/Aug/2010:12:02:50 +] GET
/production/file_metadata/lindafiles/etc/rsyslog.d/rsyslog-puppet.conf--NOTEBOOK
HTTP/1.1 404 83 - -
clientX - - [27/Aug/2010:12:02:50 +] GET
/production/file_metadata/lindafiles/etc/rsyslog.d/rsyslog-puppet.conf--DEFAULT
HTTP/1.1 200 357 - -

in the above exemple it is the file rsyslog-puppet.conf--DEFAULT that is
matched for my clientX. i could do a simple grep/awk/sort script which looks
through the log file and collects fileserver entries with the 200 return
code. not so pretty though, would be nice to have a native command in the
puppetmaster for this.

//Adam

On 11 August 2010 08:28, Adam Winberg adam.winb...@gmail.com wrote:

 i've tested the localconfig.yaml parser and it works well, but it only
 shows which files puppet handles from a client point of view. i.e it shows
 that puppet manages /etc/my.cnf for my client but i really want to see
 which file it manages from a server point of view, i.e.
 /path/to/fileshare/etc/my.cnf--DBGROUP1.

 as far as i can see, storeconfigs gives me about the same information as
 mr. Pienaars localconfig-parserscript. That is, i can see that puppet
 manages /etc/my.cnf for this client but i cant see from which source this
 file is taken. If I'm wrong, I would be very grateful for an example query.

 //Adam


 On 10 August 2010 22:59, R.I.Pienaar r...@devco.net wrote:


 - Luke Kanies l...@puppetlabs.com wrote:

  That really does seem like something storeconfigs can give you, at
  least if you write the query.
 
 
  It's basically finding all files owned by the host in question.
  Something like (in ActiveRecord):
 
 
  Puppet::Rails::Node.resources.find_all { |resource| resource.type ==
  file }.collect { |resource| resource.title }
 
 
  That should return an array of file names. Haven't tested it mind you,
  but something like that should work.
 
 
  Another option involves client-side opening the catalog and reading
  the files. I've written a script that does this for a bank that
  delivers its output to their auditors. Ended up being very simple.


 I have a script like this at
 http://www.devco.net/archives/2010/02/26/what_does_puppet_manage_on_a_node-2.php

 Not tested on 2.6 yet though.

 --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to
 puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
 .
 For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.




-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Change date format in puppet-dashboard

2010-08-27 Thread Rob McBroom
On Aug 27, 2010, at 3:41 AM, matonb wrote:

 Is it possible to change the format of the date in puppet-dashboard,
 from the American style to the format the rest of the world uses?

I'd settle for having it display in my time zone instead of UTC. :)

My dashboard installation (1.0.3) shows dates like

2010-08-27 12:30 UTC

Isn't that “the format the rest of the world uses” – largest to smallest? 
American style (which makes no sense to me) would be more like

08-27-2010 12:30 UTC

-- 
Rob McBroom
http://www.skurfer.com/

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Re: [Puppet-dev] ANNOUNCE: Facter 1.5.8rc2

2010-08-27 Thread Todd Zullinger
James Turnbull wrote:
 For 40 days and 40 nights Facter wandered in the wilderness sustained
 only by the occasional patch and bottle of Kool-Aid.

 Slightly less tanned and equally happy Facter 1.5.8rc2 has followed rc1
 out of the desert.

For those using Fedora or RHEL/CentOS, I've updated the yum repos at:

http://tmz.fedorapeople.org/repo/puppet/

Packages for EL 4 - 6 and Fedora 12 - 14 are available for testing.
Add the puppet.repo file from either the epel or fedora directories to
/etc/yum.repos.d to enable.

If you find problems with the packaging, please let me know.  If you
find other bugs, please file them in redmine:

http://projects.puppetlabs.com/projects/facter/issues

-- 
ToddOpenPGP - KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~
My comment was that the FBI is either incompetent or lying, or both...
-- Bruce Schneier, of Counterpane Internet Security, on FBI claims
that they don't have specialised machines that can break DES



pgpDlv7BZOHXB.pgp
Description: PGP signature


[Puppet Users] Re: [Puppet-dev] ANNOUNCE: Puppet 2.6.1 - Release Candidate 3 available!

2010-08-27 Thread Todd Zullinger
James Turnbull wrote:
 In the long Puppet tradition of fast releases and agile iteration
 comes the 2.6.1 release!

 The third release candidate is now available and is a maintenance
 release in the 2.6.x branch.

For those using Fedora or RHEL/CentOS, I've updated the yum repos at:

http://tmz.fedorapeople.org/repo/puppet/

Packages for EL 4 - 6 and Fedora 12 - 14 are available for testing.
Add the puppet.repo file from either the epel or fedora directories to
/etc/yum.repos.d to enable.

If you find problems with the packaging, please let me know.  If you
find other bugs, please file them in redmine:

http://projects.puppetlabs.com/projects/puppet/issues

(These and the facter packages have been there for a few days, but I
figure it's been a little while since I plugged these repos here and
not everyone may know about them.)

-- 
ToddOpenPGP - KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~
To be stupid, selfish, and have good health are three requirements for
happiness, though if stupidity is lacking, all is lost.
-- Gustave Flaubert



pgp2xKuK6nBnm.pgp
Description: PGP signature


[Puppet Users] can checksum be set to none on a file if content is defined?

2010-08-27 Thread John Lyman
On a file resource, if the content parameter is set and checksum is
set to none, I am getting Parameter content failed: Munging
failed...

This appears to be a bug, but maybe I missed something in the
documentation and it isn't supposed to work.

cat test.pp
file { /tmp/foo:
checksum = none,
content  = this is foo\n,
}

puppet test.pp --debug
debug: Failed to load library 'selinux' for feature 'selinux'
Parameter content failed: Munging failed for value this is foo\n in
class content: undefined method `none' for
#Puppet::Type::File::Content:0x90212d8

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Rob McBroom
On Aug 10, 2010, at 10:53 PM, James Turnbull wrote:

 1. The types and providers documentation (lib/puppet/types/typename.rb 
 lib/puppet/providers/provider...)
 2. The functions and metaparameter documentation
 (lib/puppet/parser/functions/functioname.rb)
 3. The configuration reference (lib/puppet/default.rb)
 4. And the report, network and indirection references
 
 …
 
 All you need to go is clone the Puppet git repo and follow the
 development life cycle documentation -
 http://projects.puppetlabs.com/projects/puppet/wiki/Development_Lifecycle -
 (or feel free to ask for help on #puppet on IRC or either list).

So I cloned the repo today to see if I could help out and I'm not finding any 
of the paths referenced above. You were referring to the main Puppet source, 
right? Should I be cloning a specific branch or something? Also, should I fork 
it on GitHub and work from that, or just clone the real deal?

Maybe this is all answered on the Wiki, but it seems to be down right now.

-- 
Rob McBroom
http://www.skurfer.com/


-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Brice Figureau
On Fri, 2010-08-27 at 10:29 -0400, Rob McBroom wrote:
 On Aug 10, 2010, at 10:53 PM, James Turnbull wrote:
 
  1. The types and providers documentation (lib/puppet/types/typename.rb 
  lib/puppet/providers/provider...)
  2. The functions and metaparameter documentation
  (lib/puppet/parser/functions/functioname.rb)
  3. The configuration reference (lib/puppet/default.rb)
  4. And the report, network and indirection references
  
  …
  
  All you need to go is clone the Puppet git repo and follow the
  development life cycle documentation -
  http://projects.puppetlabs.com/projects/puppet/wiki/Development_Lifecycle -
  (or feel free to ask for help on #puppet on IRC or either list).
 
 So I cloned the repo today to see if I could help out and I'm not
 finding any of the paths referenced above. You were referring to the
 main Puppet source, right? 

Yes, the documentation is embedded in the source code.
You need to patch this part of the code.

 Should I be cloning a specific branch or something? 

I think you can safely base on the 2.6.x branch (and if I'm wrong it
should be easy to rebase on master).

 Also, should I fork it on GitHub and work from that, or just clone the
 real deal?

The usual workflow is:
* fork on github
* clone your own repository
* create a branch in which you want to work
* do the changes
* commit
* push as a remote branch
* ask for a merge giving your remote branch

-- 
Brice Figureau
Follow the latest Puppet Community evolutions on www.planetpuppet.org!

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Re: Is a puppet server essential?

2010-08-27 Thread bonobo
Thank you very much.  That was very helpful.

  --Bonobo

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Re: Change date format in puppet-dashboard

2010-08-27 Thread Steve Nielsen
I think date format should be a configurable option.

Steve

On Fri, Aug 27, 2010 at 8:08 AM, matonb brett.ma...@googlemail.com wrote:
 Hi Rob,

  Your quite correct, I wasn't being very clear!

  I was referring to the Daily Run status graph which shows mm-dd-yy
 on my dashboard (1.0.3).
  And yes it would be nice to use the local time zone instead of UTC!

  and to be honest, the only way to make it really unambiguous would
 be to use MMM instead of MM

 On Aug 27, 1:35 pm, Rob McBroom mailingli...@skurfer.com wrote:
 On Aug 27, 2010, at 3:41 AM, matonb wrote:

  Is it possible to change the format of the date in puppet-dashboard,
  from the American style to the format the rest of the world uses?

 I'd settle for having it display in my time zone instead of UTC. :)

 My dashboard installation (1.0.3) shows dates like

     2010-08-27 12:30 UTC

 Isn't that “the format the rest of the world uses” – largest to smallest? 
 American style (which makes no sense to me) would be more like

     08-27-2010 12:30 UTC

 --
 Rob McBroom
 http://www.skurfer.com/

 --
 You received this message because you are subscribed to the Google Groups 
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to 
 puppet-users+unsubscr...@googlegroups.com.
 For more options, visit this group at 
 http://groups.google.com/group/puppet-users?hl=en.



-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Is a puppet server essential?

2010-08-27 Thread Charles Yeomans


On Aug 26, 2010, at 10:04 PM, bonobo wrote:


It appears that running a puppet server is essential.  In his book
Pulling Strings with Puppet, James Turnbull says:

... the node will request whatever configuration is specified for
that node.  The master server will then compile and deliver that
configuration. [p. 25]

Our firewall environment is very restrictive, and there's no way a
server on our publicly accessible network will be allowed to initiate
a connection to a puppet server on our internal network.  (Of course,
I could run the puppet server on the publicly accessible network, but
you have no idea what a hassle that would be.)

Since the configuration is compiled on the server, is it impossible to
run puppet without allowing clients to initiate connection to the
puppet server?




We are running puppet in standalone mode on nodes in a setup that does  
not require punching holes in the firewall.  We use rsync to push  
configuration information to nodes. Our Puppet configurations live on  
a server running gitosis.  As changes are committed by sys admins,  
gitosis hook scripts move the data along and run rsync.




--
Charles Yeomans
Senior Software Engineer
Dakim, Inc.
char...@dakim.com




--
You received this message because you are subscribed to the Google Groups Puppet 
Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Is a puppet server essential?

2010-08-27 Thread Mike Devlin
you lose all the reporting functionality, but as long as you get all your
puppet manifests and files accessible by the servers you want to run puppet
on (rsync, nfswhatever), you can just run puppet directly, although it
now has to compile everything, even if its not needed, so its slower to run.


  - Mike

On Thu, Aug 26, 2010 at 10:04 PM, bonobo limnsn...@gmail.com wrote:

 It appears that running a puppet server is essential.  In his book
 Pulling Strings with Puppet, James Turnbull says:

 ... the node will request whatever configuration is specified for
 that node.  The master server will then compile and deliver that
 configuration. [p. 25]

 Our firewall environment is very restrictive, and there's no way a
 server on our publicly accessible network will be allowed to initiate
 a connection to a puppet server on our internal network.  (Of course,
 I could run the puppet server on the publicly accessible network, but
 you have no idea what a hassle that would be.)

 Since the configuration is compiled on the server, is it impossible to
 run puppet without allowing clients to initiate connection to the
 puppet server?

 BTW, this seems different from CfEngine.  I believe compilation of the
 configuration occurs on the client, not the server, but I'm not sure.

 Any information or insight would be appreciated.

 Thanks

 --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to
 puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
 .
 For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.



-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Is a puppet server essential?

2010-08-27 Thread bonobo
It appears that running a puppet server is essential.  In his book
Pulling Strings with Puppet, James Turnbull says:

... the node will request whatever configuration is specified for
that node.  The master server will then compile and deliver that
configuration. [p. 25]

Our firewall environment is very restrictive, and there's no way a
server on our publicly accessible network will be allowed to initiate
a connection to a puppet server on our internal network.  (Of course,
I could run the puppet server on the publicly accessible network, but
you have no idea what a hassle that would be.)

Since the configuration is compiled on the server, is it impossible to
run puppet without allowing clients to initiate connection to the
puppet server?

BTW, this seems different from CfEngine.  I believe compilation of the
configuration occurs on the client, not the server, but I'm not sure.

Any information or insight would be appreciated.

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Rob McBroom
On Aug 27, 2010, at 12:03 PM, Brice Figureau wrote:

 Yes, the documentation is embedded in the source code.
 You need to patch this part of the code.

That's what I thought, but where are the files James mentions? I don't see 
`lib/puppet/types`, `lib/puppet/providers`, `functioname.rb`, etc. in master or 
2.6.x.

-- 
Rob McBroom
http://www.skurfer.com/

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Brice Figureau
On 27/08/10 19:16, Rob McBroom wrote:
 On Aug 27, 2010, at 12:03 PM, Brice Figureau wrote:
 
 Yes, the documentation is embedded in the source code.
 You need to patch this part of the code.
 
 That's what I thought, but where are the files James mentions? I don't see 
 `lib/puppet/types`, `lib/puppet/providers`, `functioname.rb`, etc. in master 
 or 2.6.x.

They're not real filenames just pointers to where the files are.
That means all files in:
lib/puppet/types/*.rb
lib/puppet/providers/*.rb
lib/puppet/parser/functions/*.rb

-- 
Brice Figureau
My Blog: http://www.masterzen.fr/

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Re: Is a puppet server essential?

2010-08-27 Thread Nikolay Sturm
On Aug 27, 4:04 am, bonobo limnsn...@gmail.com wrote:
 Our firewall environment is very restrictive, and there's no way a
 server on our publicly accessible network will be allowed to initiate
 a connection to a puppet server on our internal network.

Another option would be to replicate your puppetmaster into your other
networks. We have a similar problem I intend to solve by adding a
puppetmaster
to my DMZ (without critical internal data, of course).

cheers,

Nikolay

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Re: Change date format in puppet-dashboard

2010-08-27 Thread Rob McBroom
On Aug 27, 2010, at 2:19 PM, Rustler wrote:

 Yes you can -
 
 See the file environment.rb in the puppet-dashboard/config directory
 
 I changed my entry to:
 
 config.time_zone = 'Pacific Time (US  Canada)'

I think he was talking about the way the dates appear, not the time zone, but 
still, that's a great tip. Thanks.

-- 
Rob McBroom
http://www.skurfer.com/

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Is a puppet server essential?

2010-08-27 Thread Dan Bode
On Fri, Aug 27, 2010 at 9:21 AM, Mike Devlin mdev...@aisle10.net wrote:

 you lose all the reporting functionality, but as long as you get all your
 puppet manifests and files accessible by the servers you want to run puppet
 on (rsync, nfswhatever), you can just run puppet directly, although it
 now has to compile everything, even if its not needed, so its slower to run.


there is an additional bit of functionality that you lose in this setup,
authentication/least access.

In client server mode, the CA is required to sign the clients cert before
that client can connect to the server. This ensures that:

1. Only an authorized client can connect to the puppetmaster and request a
catalog.
2. The client only has access to the compiled catalog, not the source code.
This means it only has access to the information it needs and nothing else.



   - Mike


 On Thu, Aug 26, 2010 at 10:04 PM, bonobo limnsn...@gmail.com wrote:

 It appears that running a puppet server is essential.  In his book
 Pulling Strings with Puppet, James Turnbull says:

 ... the node will request whatever configuration is specified for
 that node.  The master server will then compile and deliver that
 configuration. [p. 25]

 Our firewall environment is very restrictive, and there's no way a
 server on our publicly accessible network will be allowed to initiate
 a connection to a puppet server on our internal network.  (Of course,
 I could run the puppet server on the publicly accessible network, but
 you have no idea what a hassle that would be.)

 Since the configuration is compiled on the server, is it impossible to
 run puppet without allowing clients to initiate connection to the
 puppet server?

 BTW, this seems different from CfEngine.  I believe compilation of the
 configuration occurs on the client, not the server, but I'm not sure.

 Any information or insight would be appreciated.

 Thanks

 --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to
 puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
 .
 For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.


  --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to
 puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
 .
 For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.


-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Rob McBroom
On Aug 27, 2010, at 2:11 PM, Brice Figureau wrote:

 They're not real filenames just pointers to where the files are.
 That means all files in:
 lib/puppet/types/*.rb
 lib/puppet/providers/*.rb

I don't think you understand (or I don't).

% ls lib/puppet/types/*.rb
ls: No match.
% ls lib/puppet/providers/*.rb
ls: No match.

Those directories aren't there. And in case you think something is screwed up 
on my system, take a look at 
http://github.com/reductivelabs/puppet/tree/master/lib/puppet/

There are no directories named `types` or `providers`.

There are no files anywhere in the entire repo named `typename.rb` or 
`functioname.rb`.

-- 
Rob McBroom
http://www.skurfer.com/

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] can checksum be set to none on a file if content is defined?

2010-08-27 Thread Patrick

On Aug 27, 2010, at 7:07 AM, John Lyman wrote:

 On a file resource, if the content parameter is set and checksum is
 set to none, I am getting Parameter content failed: Munging
 failed...
 
 This appears to be a bug, but maybe I missed something in the
 documentation and it isn't supposed to work.
 
 cat test.pp
 file { /tmp/foo:
checksum = none,
content  = this is foo\n,
 }
 
 puppet test.pp --debug
 debug: Failed to load library 'selinux' for feature 'selinux'
 Parameter content failed: Munging failed for value this is foo\n in
 class content: undefined method `none' for
 #Puppet::Type::File::Content:0x90212d8

What are you trying to do?  You want it to create the file with that content if 
the file doesn't exist, but not change the file if the file exists but doesn't 
match?

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



RE: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Kinzel, David
There are no directories named `types` or `providers`.

There are no files anywhere in the entire repo named 
`typename.rb` or `functioname.rb`.


Perhaps he means types as in these: lib/puppet/type/*.rb? Same goes for
providers.

This email communication and any files transmitted with it may contain 
confidential and or proprietary information and is provided for the use of the 
intended recipient only.  Any review, retransmission or dissemination of this 
information by anyone other than the intended recipient is prohibited.  If you 
receive this email in error, please contact the sender and delete this 
communication and any copies immediately.  Thank you.
http://www.encana.com


-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread James Turnbull
Rob McBroom wrote:
 On Aug 27, 2010, at 2:11 PM, Brice Figureau wrote:
 
 They're not real filenames just pointers to where the files are.
 That means all files in:
 lib/puppet/types/*.rb
 lib/puppet/providers/*.rb

That's my typo - mea culpa:

lib/puppet/type/*.rb
lib/puppet/provider/*.rb

 There are no files anywhere in the entire repo named `typename.rb` or 
 `functioname.rb`.

Those are examples - the actual files are named after the types and
providers - host.rb, template.rb etc.

Although thanks to some people in the community and a sprint from me
we've updated all this code now to Markdown!

Thanks to everyone contributed!

Regards

James Turnbull

-- 
Puppet Labs - http://www.puppetlabs.com
C: 503-734-8571

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] can checksum be set to none on a file if content is defined?

2010-08-27 Thread Dan Bode
On Fri, Aug 27, 2010 at 11:49 AM, Patrick kc7...@gmail.com wrote:


 On Aug 27, 2010, at 7:07 AM, John Lyman wrote:

  On a file resource, if the content parameter is set and checksum is
  set to none, I am getting Parameter content failed: Munging
  failed...
 
  This appears to be a bug, but maybe I missed something in the
  documentation and it isn't supposed to work.
 
  cat test.pp
  file { /tmp/foo:
 checksum = none,
 content  = this is foo\n,
  }
 
  puppet test.pp --debug
  debug: Failed to load library 'selinux' for feature 'selinux'
  Parameter content failed: Munging failed for value this is foo\n in
  class content: undefined method `none' for
  #Puppet::Type::File::Content:0x90212d8

 What are you trying to do?  You want it to create the file with that
 content if the file doesn't exist, but not change the file if the file
 exists but doesn't match?


if this is the behavior you want, try

  replace = false


 --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to
 puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
 .
 For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.



-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Rob McBroom
On Aug 27, 2010, at 2:53 PM, James Turnbull wrote:

 Rob McBroom wrote:
 On Aug 27, 2010, at 2:11 PM, Brice Figureau wrote:
 
 They're not real filenames just pointers to where the files are.
 That means all files in:
 lib/puppet/types/*.rb
 lib/puppet/providers/*.rb
 
 That's my typo - mea culpa:
 
 lib/puppet/type/*.rb
 lib/puppet/provider/*.rb
 
 There are no files anywhere in the entire repo named `typename.rb` or 
 `functioname.rb`.
 
 Those are examples - the actual files are named after the types and
 providers - host.rb, template.rb etc.

OK, I see now. Sorry.

 Although thanks to some people in the community and a sprint from me
 we've updated all this code now to Markdown!

Sounds like it's mostly taken care of. Is there any need for someone to go 
through http://github.com/reductivelabs/puppet-docs ?

-- 
Rob McBroom
http://www.skurfer.com/


-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread James Turnbull
Rob McBroom wrote:
 
 Sounds like it's mostly taken care of. Is there any need for someone to go 
 through http://github.com/reductivelabs/puppet-docs ?
 

Totally!  Any improvements or additions to that would be gratefully
received.  We'd also welcome people updating the existing Markdown
references - source/references/* to more viable Markdown (fixing the
tables for example).

Regards

James Turnbull

-- 
Puppet Labs - http://www.puppetlabs.com
C: 503-734-8571

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] auth failure under unicorn with 2.6.1rc2

2010-08-27 Thread Dan Urist
I took your suggestion and tried Puppet.notice() statements in rest.rb
and was able to dump out the whole request (after a crash course in
ruby syntax). I didn't realize there was a mapping from the nginx
config file parameters to the actual request parameters; this appears to
have fixed it in puppet.conf (these are the actual request parameters):

   ssl_client_header = HTTP_X_CLIENT_DN
   ssl_client_verify_header = HTTP_X_CLIENT_VERIFY

The relevant lines from my nginx config are:

   proxy_set_header X-Client-Verify $ssl_client_verify; 
   proxy_set_header X-Client-DN $ssl_client_s_dn;

Thanks for your help.

On Fri, 27 Aug 2010 09:34:03 +0200
Brice Figureau brice-pup...@daysofwonder.com wrote:

 On Thu, 2010-08-26 at 15:09 -0600, Dan Urist wrote:
  On Thu, 26 Aug 2010 22:34:59 +0200
  Brice Figureau brice-pup...@daysofwonder.com wrote:
  
   On 26/08/10 21:55, Dan Urist wrote:
I'm trying to set up a puppetmaster under unicorn using the
ubuntu maverick packages (currently at version 2.6.1rc2), and
I'm getting the following error:

r...@test.puppet.cms.ucar.edu $ puppetd -t
err: Could not retrieve catalog from remote server: Error 403 on
SERVER: Forbidden request:
test.puppet.cms.ucar.edu(128.117.224.193) access
to /catalog/test.puppet.cms.ucar.edu [find] at line 98 warning:
Not using cache on failed catalog err: Could not retrieve
catalog; skipping run

I'm using the standard auth.conf, but if I turn off auth by
adding this to the top of the file everything works:

path /
auth no
allow *
   
   Of course you understand the security risk if you run with this
   auth.conf :)
  
  Yes, I just tried this for testing.
 
 OK, I prefer to check :)
 
Has anyone seen this, or know of a workaround?
   
   The usual cause is that the SSL end point didn't propagate to the
   master the fact that this node's certificate validates.
   
   This is usally done by adding some HTTP headers in the request,
   and you need to tell puppet what those headers are.
   For rack you need to set:
   
   [puppetmasterd]
   ssl_client_header = SSL_CLIENT_S_DN
   ssl_client_verify_header = SSL_CLIENT_VERIFY
  
  I have this, but it's under master rather than puppetmasterd.
  I've tried it under puppetmasterd and I'm getting the same
  failure.
 
 Yes, you should use master for 2.6, but puppetmasterd for 0.25.
 
   Off course you also need to configure the ssl endpoint to set
   those headers when the cerficate is valid (and also when it's
   invalid). You didn't mention what was the SLL endpoint in your
   configuration so I can't really help for this.
  
  I'm using nginx, and I've followed the docs at:
  http://projects.puppetlabs.com/projects/1/wiki/Using_Unicorn
  
  The relevant parts of my nginx config, per the doc, are: 
  
   proxy_set_header Host $host;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For
   $proxy_add_x_forwarded_for; proxy_set_header X-Client-Verify
   $ssl_client_verify; proxy_set_header X-Client-DN $ssl_client_s_dn;
 
 Note that the config snippets I sent you refers those headers as
 SSL_CLIENT_VERIFY and not X_CLIENT_VERIFY.
 Either correct the configuration or nginx, but both should use the
 same header names.
 
   proxy_set_header X-SSL-Issuer $ssl_client_i_dn;
   proxy_read_timeout 120;
  
  So as far as I can see, those headers are being set. Any hints on
  debugging this?
 
 There are several possibilities:
 
 * check puppet uses the correct $ssldir. I've already seen people
 using a different $ssldir when running the master differently, in
 which case the master regenerates a CA, and client certs are not
 compatible anymore.
 
 * check that the client cert is valid (ie it was signed by your master
 current $ssldir CA). This can be done with openssl
 
 * run nginx in debug mode to check it sets correctly the upstream
 headers
 
 * use tcpdump/wireshard to capture the http traffic between nginx and
 unicorn and check the headers are there and correct.
 
 * add some Puppet.notice() statements in puppet ruby rack adapter (in
 lib/puppet/network/http/rack/rest.rb) around line 93 to print the
 various values and which branch of the if is taken.
 
 Hope that helps,



-- 
Dan Urist
dur...@ucar.edu
303-497-2459

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] Re: can checksum be set to none on a file if content is defined?

2010-08-27 Thread John Lyman
That is the behavior I want, and I am actually using replace =
false (though I didn't in my example).  My only problem is that I
have nodes that run in noop mode, and even though the file doesn't
change, they will complain that the checksum has changed eventually.
I think puppet forgets the checksum after a while, because the nodes
all start complaining at the same time.  If the behavior I want is not
possible, I will just turn off reporting for that resource.

On Aug 27, 2:53 pm, Dan Bode d...@puppetlabs.com wrote:
 On Fri, Aug 27, 2010 at 11:49 AM, Patrick kc7...@gmail.com wrote:

  On Aug 27, 2010, at 7:07 AM, John Lyman wrote:

   On a file resource, if the content parameter is set and checksum is
   set to none, I am getting Parameter content failed: Munging
   failed...

   This appears to be a bug, but maybe I missed something in the
   documentation and it isn't supposed to work.

   cat test.pp
   file { /tmp/foo:
          checksum = none,
          content  = this is foo\n,
   }

   puppet test.pp --debug
   debug: Failed to load library 'selinux' for feature 'selinux'
   Parameter content failed: Munging failed for value this is foo\n in
   class content: undefined method `none' for
   #Puppet::Type::File::Content:0x90212d8

  What are you trying to do?  You want it to create the file with that
  content if the file doesn't exist, but not change the file if the file
  exists but doesn't match?

 if this is the behavior you want, try

   replace = false

  --
  You received this message because you are subscribed to the Google Groups
  Puppet Users group.
  To post to this group, send email to puppet-us...@googlegroups.com.
  To unsubscribe from this group, send email to
  puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
  .
  For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] parameterized class, external nodes?

2010-08-27 Thread Frederik Wagner
Hi,

On Sat, Jul 31, 2010 at 2:43 AM, Jeff McCune j...@puppetlabs.com wrote:
 On Fri, Jul 30, 2010 at 5:01 PM, Alan Sparks aspa...@doublesparks.net wrote:
 How do you (if you can) represent a parameterized class reference in an
 external node YAML description (exec terminus)?
 -Alan

 You can't at the moment, unfortunately.  If you have any thoughts
 about what this API should look like, please describe some of your use
 cases or how you'd like this interface to operate.

 It's definitely something that I'm thinking about as well, I just
 don't think anyone has hammered out a design yet.

Is there some progress on this point? I would also need this feature,
in particular to use the new staging feature.
I would like to include the classes through an external node yaml
file. I would also like give the desired stage where the class should
be applied.

Alternatively: It seems not to be possible to set the stage
metaparameter with a default value in a class definition?!

something like this wont run in Stage pre:

stage{ pre: before = Stage[main] }
class someclass ($stage=pre ) { ... }
class { someclass: }

Thanks and Bye,
Frederik

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Is a puppet server essential?

2010-08-27 Thread Patrick

On Aug 27, 2010, at 11:33 AM, Dan Bode wrote:

 
 On Fri, Aug 27, 2010 at 9:21 AM, Mike Devlin mdev...@aisle10.net wrote:
 you lose all the reporting functionality, but as long as you get all your 
 puppet manifests and files accessible by the servers you want to run puppet 
 on (rsync, nfswhatever), you can just run puppet directly, although it 
 now has to compile everything, even if its not needed, so its slower to run.
 
 
 there is an additional bit of functionality that you lose in this setup, 
 authentication/least access.
 
 In client server mode, the CA is required to sign the clients cert before 
 that client can connect to the server. This ensures that:
 
 1. Only an authorized client can connect to the puppetmaster and request a 
 catalog. 
 2. The client only has access to the compiled catalog, not the source code. 
 This means it only has access to the information it needs and nothing else.

That's almost true.  The default access rules allow all authorized clients to 
access all files that are being served from files folders.

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Tony G.
Is there any way to contribute translating the current docs into different
languages?

Thanks.

On Fri, Aug 27, 2010 at 3:16 PM, James Turnbull ja...@puppetlabs.comwrote:

 Rob McBroom wrote:
 
  Sounds like it's mostly taken care of. Is there any need for someone to
 go through http://github.com/reductivelabs/puppet-docs ?
 

 Totally!  Any improvements or additions to that would be gratefully
 received.  We'd also welcome people updating the existing Markdown
 references - source/references/* to more viable Markdown (fixing the
 tables for example).

 Regards

 James Turnbull

 --
 Puppet Labs - http://www.puppetlabs.com
 C: 503-734-8571

 --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to
 puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
 .
 For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.




-- 
Tony
http://blog.tonyskapunk.net

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Re: Change date format in puppet-dashboard

2010-08-27 Thread Igal Koshevoy
 Regarding the timezone and date-time format discussion: we'd like to
resolve this and have an issue assigned to one of the next releases. Do
the details below capture the intended behavior?

http://projects.puppetlabs.com/issues/4605

Application should use the timezone and format set in a site-specific
configuration

Currently:

* Timezone is set in |config/environment.rb| and this file must be
  edited to alter it. This is bad because this file is versioned and
  is part of the app. Worse still, not everything in the application
  uses it — such as Status::by_interval uses the timezone that’s set
  on the operating system instead.
* Time/date formats are set in
  |config/initializers/time_formats.rb|. These now use international
  format, but we should accommodate people with other preferences.
* Charts use their own format, ignoring the timezone and formatting
  used in the rest of the application..

Desired behavior:

* Site-wide settings should be implemented, see #4604
  http://projects.puppetlabs.com/issues/4604
* Timezone setting should be added to the site-wide settings
* Date-time format setting should be added to the site-wide settings
* Everything should use the timezone settings, e.g. the views,
  Status::by_interval, charts, etc.
* Everything should use the date-time formatting settings, e.g. the
  Rails views and charts.

-igal

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread James Turnbull
Tony G. wrote:
 Is there any way to contribute translating the current docs into
 different languages?
 

We'd love to see this.  What languages did you have in mind?

Regards

James Turnbull

-- 
Puppet Labs - http://www.puppetlabs.com
C: 503-734-8571

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Is a puppet server essential?

2010-08-27 Thread John Arundel
On Fri, Aug 27, 2010 at 5:23 PM, Thomas Bellman bell...@nsc.liu.se wrote:
 Running a Puppet server (puppetmasterd) is only essential if you
 are running Puppet in its client-server mode.  You can also run
 Puppet in a stand-alone mode, using the 'puppet' executable.

 However, then you need some other way of getting the manifests
 out to the machines, like having the manifests on an NFS server
 which the managed client mounts, or rsync:ing the manifests from
 cron, or doing a 'git fetch; git reset --hard origin' from cron.

Stephen Nelson-Smith wrote an excellent piece on using Git to do just this:

http://bitfieldconsulting.com/scaling-puppet-with-git

Regards,
John
-- 
Bitfield Consulting: we make software that makes things work
http://bitfieldconsulting.com/

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



Re: [Puppet Users] Documentation contribution opportunity - Please help!

2010-08-27 Thread Tony G.
I recall someone started a translation to Chinese, I'll be happy to help
with Spanish, and I've seen some French speakers into the list that might be
interested.

Thanks.

On Fri, Aug 27, 2010 at 5:39 PM, James Turnbull ja...@puppetlabs.comwrote:

 Tony G. wrote:
  Is there any way to contribute translating the current docs into
  different languages?
 

 We'd love to see this.  What languages did you have in mind?

 Regards

 James Turnbull

 --
 Puppet Labs - http://www.puppetlabs.com
 C: 503-734-8571

 --
 You received this message because you are subscribed to the Google Groups
 Puppet Users group.
 To post to this group, send email to puppet-us...@googlegroups.com.
 To unsubscribe from this group, send email to
 puppet-users+unsubscr...@googlegroups.compuppet-users%2bunsubscr...@googlegroups.com
 .
 For more options, visit this group at
 http://groups.google.com/group/puppet-users?hl=en.




-- 
Tony
http://blog.tonyskapunk.net

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.



[Puppet Users] ANNOUNCE: Facter 1.5.8

2010-08-27 Thread James Turnbull
For 40 days and 40 nights Facter wandered in the wilderness sustained
only by the occasional patch and bottle of Kool-Aid.

Slightly less tanned and equally happy Facter 1.5.8 has arrived!

1.5.8 is a feature and maintenance release containing a number of fixes,
updates and additional tests.

You can get the release at:

http://reductivelabs.com/downloads/facter/facter-1.5.8.tar.gz

Please log any bugs to Redmine (http://projects.puppetlabs.com).

CHANGELOG
=

ca2da36  Updated install.rb and created man page
3671c9f  [#4583] Refactor uptime to use Resolution.exec
fca8861  [#4594] Reintroduce fix for #1291 from original patch
32c0cb0  [#4594] Revert fixes #2573, #2085, #1291...
e7df4c0  Updated CHANGELOG for 1.5.8rc2
9c9cabd  Better fix for Bug 4569: Uptime Fact is incorrect on Windows
01a515f  [#4289] operatingsystemrelease fact for oel, ovs
b6c0a6b  Fix for bug #4569
51bcebe  Fixed Rakefile package task version detection
81ccb48  Removed references to Reductive Labs in the Rakefile
9c9cabd  Better fix for Bug 4569: Uptime Fact is incorrect on Windows
01a515f  [#4289] operatingsystemrelease fact for oel, ovs
b6c0a6b  Fix for bug #4569
51bcebe  Fixed Rakefile package task version detection
81ccb48  Removed references to Reductive Labs in the Rakefile
4398b36  Updated CHANGELOG rake task
e02be1d  [#4156] Updating spec to match Kai's change
bff84c2  [#4156] Applying patch by Kai
b7fe989  [#2330] Update uptime calculation to use /bin/cat
e9a60bc  Facter::Manufacturer - sunos test + simplified regex
be411c0  Facter::Manufacturer - test for SunOS and FreeBSD
67f6604  [#4062] Implement operating system facts for MeeGo
a2bcacd  [#2330] Uptime should not make redundant system calls
ce7bd9f  Refactor rakefile to use spec.ops, separate rcov task
faaa169  Fix #4352 - Support for detecting KVM virtuals on FreeBSD
82286e4  Fix #4352 - Support for detecting virtuals (jails) on FreeBSD
b2c2114  Properly wrapped the windows ipaddress fact in a setcode block.
1bd2ca2  Fixed #3929 - Added user confine to AIX memory facts
8106bc3  Adding HP-UX support to Facter's IP facts
83b3ea6  Fixed #3393 - Updates to Facter for MS Windows
ffcae46  Fixed #3403 - Added fact to query vlans; added spec test
d4b8401  Merged Jos Backus patch to remove requirement for ftools altogether
73dcbb9  Fixed #2355 read hang on /proc/xen/capabilties on RHEL 4.7
d109def  Fix #1365 - load all facts via cli
6c87917  Fixed failing test introduced by previous commit
c5b8d3b  Fixes #3740 - split dmi output on regex
25bf5c2  Fix virtual unit test on non-linux by stubbing kernel
9a00eae  Fixed #2313 - Somewhat essential hardware facts not available
on OpenBSD, patch included
e19024b  Fixed #2938 - interfaces that don't match ^\w+[.:]?\d+ are ignored
97879f9  Added support for Slackware in operatingsystem and
operatingsystemrelease
802e6c2  Fixed #3542 - Ruby 1.9: broken unittest, String#each no longer
exists
2f016f3  Fixed #3541 - Ruby 1.9: broken unittest, unexpected invocation:
Process.waitall()
84d3d9f  Fixed #3445 - Facter does not handle solaris branded zones properly
b5a8de0  Fix for #3411 install.rb should not put . first in the tmp_dirs
8ea33eb  Fixed #3447 - OVS and OEL not matching in operatingsystemrelease
aeee83c  Fixed #3410 - Warnings in rake spec
8bf8cb5  Fixes #3397 - is_virtual fact does not detect Linux-VServer
62b6773  Add kvm support to virtual fact
dca615c  fixes #2573, #2085, #1291 - fixes domain and fqdn facts resolution
86447c8  Revert use popen3 in Resolution.exec
7750f03  Fix #2341 - stricter handling of dmidecode split
f4269d9  Fix #2746 - add architecture support for GNU/kFreeBSD
50cef83  Fix missing error case
356cf15  Remove whitespace in DMI facts (#3008, #3011)
feecd39  Only ignore IPs starting with 127.
68fc123  Added package signing task
33fb770  use popen3 in Resolution.exec to catch stderr
8109806  introduce a warn mechanism for debugging
b2c1ca5  Add docs to Mac OS X package creation script and clean out old
docs in the preflight
5412eab  Fixed : 2788 - ftools missing in Ruby 1.9
5b95a12  Fixes #2704. Problem finding install.rb three levels up
9aef69e  Removed all ChangeLog

Regards

James Turnbull

-- Puppet Labs - http://www.puppetlabs.com C: 503-734-8571

-- 
You received this message because you are subscribed to the Google Groups 
Puppet Users group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to 
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/puppet-users?hl=en.