Re: [Puppet Users] IF statement using custom fact does not work
If $facts['versionrepokubelocal'] is an integer I don't think your
comparison will work. Try:
```
if $facts['versionrepokubelocal'] != 2 {
notify { "Upgrading repository version": }type here
}
```
--
Aaron Russo (He/Him/His)
PIXAR | Lead Systems Engineer
On Wed, Jan 10, 2024 at 7:35 AM Pato Bongi
wrote:
> The if statement doesn't work using a custom fact, i try this :
>
> notify { "FACTER value= ${facts['versionrepokubelocal']}": }
> if $facts['versionrepokubelocal'] != '2' {
> notify { "Upgrading repository version": }type here
> }
> I use notify before "if" for to check the value of the custom fact. Trying
> with puppet apply (same with puppet agent -t on remote server) get the
> following output :
>
> Notice: FACTER versionrepokubelocal value = 2
> Notice: /Stage[main]/Kube::Config/Notify[FACTER versionrepokubelocal value
> = 2]/message: defined'message' as 'FACTER versionrepokubelocal value =
> 2'
> Debug: /Stage[main]/Kube::Config/Notify[FACTER versionrepokubelocal value
> = 2]: The container Class[Kube::Config] will propagate my refresh event
> Notice: Upgrading repository version
> Notice: /Stage[main]/Kube::Config/Notify[Upgrading repository
> version]/message: defined 'message' as 'Upgrading repository version'
> Before and after the execution I checked the value of the custom fact on
> the server and it is correctly valued as above :
>
> [root@myserver manifests]$ facter versionrepokubelocal 2
>
> I can't understand why it doesn't work correctly if the fact is correctly
> valued and the syntax of the statement is correct (tested with pdk validate
> and pdk test unit), it should not print "Upgrading repository version".
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/bdb372fb-59ff-4dc6-a521-0ca7eef67b05n%40googlegroups.com
> <https://groups.google.com/d/msgid/puppet-users/bdb372fb-59ff-4dc6-a521-0ca7eef67b05n%40googlegroups.com?utm_medium=email_source=footer>
> .
>
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CAA4bxV5Cb5RLWNkuqFNoRVtze_OBZOZ-FxWV3293jnqY_JUz9Q%40mail.gmail.com.
Re: [Puppet Users] using vault
Have you looked at / considered using Puppet’s client cert to authenticate
to Vault to authenticate and generate a token?
With recent releases of Vault the issue with getting cert metadata exposed
have been fixed so you can write policies based on trusted facts/cert
extensions.
On Thu, May 25, 2023 at 08:03 'sli...@verizon.net' via Puppet Users <
puppet-users@googlegroups.com> wrote:
> Thanks I added to /etc/sysconfig/puppet and looks like agent service is up.
> However, i ran into other issue.
>
> I need to pass vault_token to my epp, where i am going to use it.
>
> So i have
>
> # vault_path is and vault_my_key should look like auth/puppet/MY_KEY
>
> $variables = {
> 'my_key' => Deferred('vault_lookup::lookup',
> ['$vault_path$vault_my_key']),
> }
>
> and then how should i add this value to epp?
>
> content => epp('cmd/some.epp', { 'param1' => $param1, 'my_key' =>
> Deferred('inline_epp', ['<%= $my_key.unwrap %>', $variables])}),
>
> However that gives me error when i run puppet agent -t
> my_key, expects a string value.
>
> What should be the corect way to pass this key to my epp?
> On Wednesday, May 24, 2023 at 4:27:23 PM UTC-4 Ben Ford wrote:
>
>> Deferred functions run on the agent. The Vault connection will be made
>> from the agent. Therefor, if you configure Vault using environment
>> variables, you'll want to do so from the agent. If you're using systemd,
>> you should be able to configure those in the .service file as you suggest.
>>
>>
>>
>>
>> On May 24, 2023, at 12:13 PM, 'sli...@verizon.net' via Puppet Users <
>> puppet...@googlegroups.com> wrote:
>>
>> Hello,
>>
>> I have vault set up using role and secret id
>> I downloaded puppetlabs-vault module and saw the code snippet with that
>> module https://www.puppet.com/integrations/vault-by-hashicorp
>>
>> *With vault_lookup::lookup deferred method, i don't want to pass my role
>> and secret, so other option is set as environment variables. Question is do
>> i need to set that up on puppet server or puppet agent? Where may be the
>> best place to set that up? if it is on puppet server, can i set that up in
>> say puppet.service file? if on agent, where may be the right place to set
>> that up?*
>>
>> *Thanks*
>>
>> *S*
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Puppet Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to puppet-users...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/puppet-users/4792f478-c0a9-4b3c-b51e-eef9bc107f0dn%40googlegroups.com
>> <https://groups.google.com/d/msgid/puppet-users/4792f478-c0a9-4b3c-b51e-eef9bc107f0dn%40googlegroups.com?utm_medium=email_source=footer>
>> .
>>
>>
>> *CAUTION:* This email originated from outside of the organization. Do
>> not click on links or open attachments unless you recognize the sender and
>> know the content is safe.
>>
>>
>>
>> This e-mail may contain information that is privileged or confidential.
>> If you are not the intended recipient, please delete the e-mail and any
>> attachments and notify us immediately.
>>
>> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/8fb404c5-8223-4d08-ad57-32f675ab288dn%40googlegroups.com
> <https://groups.google.com/d/msgid/puppet-users/8fb404c5-8223-4d08-ad57-32f675ab288dn%40googlegroups.com?utm_medium=email_source=footer>
> .
>
--
Aaron Russo (He/Him/His)
PIXAR | Network & Server Admins (NSA) | Senior Systems Engineer
aru...@pixar.com
nsa-team.pixar.com (internal-only)
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CAA4bxV5vc_OXM7UnTKXODaqXC06%3DZ3pOCTXh%2ByQ51oP4ZZNXJA%40mail.gmail.com.
[Puppet Users] Re: get secrets from vault
Don't you need a Deferred call to read into the hash, since it's a Deferred?
We use a Deferred inline_epp to do this:
```
$test = Deferred('vault_lookup::lookup', ["secret/data/test",
'https://examplevault.com:8200'])
node default {
notify { 'example':
message => Deferred('inline_epp', ['<%= $test.unwrap[data][city] %>', {
'test' => $test }]),
}
}
```
I seem to recall seeing some changes to recent stdlib that might make this
a bit easier as well.
On Thursday, March 2, 2023 at 11:02:32 AM UTC-8 monthe...@gmail.com wrote:
$d['city'] should give you the city name and this will return the name
$d['name'].
message => $d['city']
On Wednesday, March 1, 2023 at 11:45:27 AM UTC-5 prajwa...@gmail.com wrote:
Hi ,
I am trying to get secrets from vault.
*vault*.*pp:*
$d = Deferred('vault_lookup::lookup', ["secret/data/test",
'https://examplevault.com:8200'])
node default {
notify { example :
message => $d
}
}
*The above file will give output* :
Notice: {"data"=>{"city"=>"Bangalore", "name"=>"hari"},
"metadata"=>{"created_time"=>"2023-02-21T06:37:36.463680713Z",
"deletion_time"=>"", "destroyed"=>false, "version"=>3}}
but How to get particular data (city and name values)
Thanks,
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/48be2b0e-541a-4b23-a4f2-cbf7f7205f59n%40googlegroups.com.
Re: [Puppet Users] Hiera 5 and Deferred / Sensitive
If you're referring to hiera-eyaml-vault <https://github.com/crayfishx/hiera-eyaml-vault>, that's not pulling secrets out of Vault -- it's using the transit encryption provider in place of gpg keys and storing those in yaml. It's a neat approach but not what I'm looking for. There is petems-hiera_vault <https://github.com/petems/petems-hiera_vault> which is close -- it retrieves secrets straight from Vault, but the puppet server is doing the retrieving and means that the server needs privileged access to all the secrets in Vault that agents' would need. vault_lookup <https://github.com/voxpupuli/puppet-vault_lookup> uses Deferred functions to have the agent authenticate and retrieve secrets from Vault, which lets me assign a policy based on the host, so it can only see the secrets it needs. It works great! I simply want that functionality in hiera. What I've done is similar to petems-hiera_vault except I return a Deferred function to perform the vault_lookup::lookup on the agent side rather than perform the vault lookup on the server side. Thanks, Aaron -- Aaron Russo (He/Him/His) PIXAR | Senior Systems Engineer On Tue, Nov 1, 2022 at 11:34 PM 'Dirk Heinrichs' via Puppet Users < puppet-users@googlegroups.com> wrote: > Am Freitag, dem 21.10.2022 um 11:49 -0700 schrieb Aaron Russo: > > However it feels like an anti-pattern by forcing lookups into our > manifests when we want to keep that in Hiera. I found a previous related > thread[2] where Henrik suggested writing a custom backend for Hiera and > return a Deferred. > > > hiera-eyaml has a plugin for retrieving secrets from Vault. Did you try > that? > > HTH... > > Dirk > > -- > > *Dirk Heinrichs* > Senior Systems Engineer, Delivery Pipeline > OpenText ™ Discovery | Recommind > *Phone*: +49 2226 15966 18 > *Email*: dhein...@opentext.com > *Website*: www.recommind.de > Recommind GmbH, Von-Liebig-Straße 1, 53359 Rheinbach > Vertretungsberechtigte Geschäftsführer Gordon Davies, Madhu Ranganathan, > Christian Waida, Registergericht Amtsgericht Bonn, Registernummer HRB 10646 > This e-mail may contain confidential and/or privileged information. If you > are not the intended recipient (or have received this e-mail in error) > please notify the sender immediately and destroy this e-mail. Any > unauthorized copying, disclosure or distribution of the material in this > e-mail is strictly forbidden > Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte > Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail > irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und > vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte > Weitergabe dieser Mail sind nicht gestattet. > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to puppet-users+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/puppet-users/7897bf9d6301f9bad84d762de8a0e7d35dfd2572.camel%40opentext.com > <https://groups.google.com/d/msgid/puppet-users/7897bf9d6301f9bad84d762de8a0e7d35dfd2572.camel%40opentext.com?utm_medium=email_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/CAA4bxV4Ajn8W%3D4fhAa-TAOAhLjz%2B0K1jO6QNYuETGXuxHSZvfQ%40mail.gmail.com.
Re: [Puppet Users] Hiera 5 and Deferred / Sensitive
Closing the loop on this for anyone else trying this in the future.
The custom backend was correct the entire time and was returning the
Deferred function. However since I was defining a key prefix that wasn't
actually used in Hiera for the custom backend to key off of, I was making
use of the `lookup` function to grab perform the lookup of that key. After
re-reading the docs, I realized that `lookup` will always convert the value
to a string, which was exactly my problem. Switching to use the `alias`
function brought me success, as it does not attempt a conversion to string
if it is the only value being interpolated.
I was then able to use that value as desired, provided whatever was
consuming the value accepted (and unwrapped) the Sensitive[String] that was
returned from the Deferred function.
Cheers,
Aaron
On Monday, October 31, 2022 at 1:00:25 PM UTC-7 Aaron Russo wrote:
> So I managed to get this to work by changing hiera data slightly,
> replacing the `lookup` function with `alias` so that the type wasn't
> automatically converted to a string.
>
> ```
> # this works! note the weird quoting is to avoid hiera treating fqdn dots
> as sub-keys and is intentional.
> profile::gitlab_runner::lookup_test:
> "%{alias(\"'vault_lookup::kv/data/host/
> gitlab-runner-31.example.com/gitlab-ci>registration_token'\")}"
> ```
>
> Unfortunately, this breaks down when I want to embed that key in a config
> hash within hiera, like this:
> ```
> gitlab_ci_runner::runners:
> 'instance':
> config:
> name: "Instance Runner on %{::hostname}"
> registration-token: "%{alias(\"'vault_lookup::kv/data/host/
> gitlab-runner-31.example.com/gitlab-ci>registration_token'\")}"
> ...
> ```
>
> I'm guessing without some changes in Hiera/Puppet, this part may not be
> possible? Anyone have experience with this?
>
>
> On Fri, Oct 21, 2022 at 2:28 PM Aaron Russo wrote:
>
>> We're using the vault_lookup[1] module to retrieve secrets from Vault via
>> mTLS. It works fairly well when grabbing secrets within a manifest.
>>
>> However it feels like an anti-pattern by forcing lookups into our
>> manifests when we want to keep that in Hiera. I found a previous related
>> thread[2] where Henrik suggested writing a custom backend for Hiera and
>> return a Deferred.
>>
>> However after doing what I thought was the correct thing, and returning a
>> Deferred in our custom backend, the value in the file ends up being the
>> literal string 'Deferred ...' and not being evaluated. I even wrote a quick
>> manifest to check if a Deferred is being returned by Hiera/APL and it does
>> not seem to be the case -- Hiera is returning a String representation of it.
>>
>> So my question is -- is it possible to actually return a Deferred via a
>> Hiera lookup_key backend and if so, what might I be doing wrong? Sanitized
>> code / outputs / etc provided[3] for mocking.
>>
>> Versions:
>> puppet: 7.20.0
>> puppetserver: 7.8.0
>> puppetlabs/stdlib: 8.30
>>
>> Thanks!
>>
>> Aaron
>>
>> [1] https://forge.puppet.com/modules/puppet/vault_lookup
>> [2] https://groups.google.com/g/puppet-users/c/E-Q-ok-B0gQ/m/h-tYJFPdBwAJ
>> [3] https://gist.github.com/arusso/9eed3cac93e02aa270b6811b560b2093
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Puppet Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to puppet-users...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/puppet-users/e5e12ede-e33f-440a-b13f-ccd221110f9dn%40googlegroups.com
>>
>> <https://groups.google.com/d/msgid/puppet-users/e5e12ede-e33f-440a-b13f-ccd221110f9dn%40googlegroups.com?utm_medium=email_source=footer>
>> .
>>
>
>
> --
> Aaron Russo (He/Him/His)
> PIXAR | Network & Server Admins (NSA) | Senior Systems Engineer
> aru...@pixar.com
>
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/9226eba1-c794-4a4c-98e3-ff74160f752an%40googlegroups.com.
Re: [Puppet Users] Hiera 5 and Deferred / Sensitive
So I managed to get this to work by changing hiera data slightly, replacing
the `lookup` function with `alias` so that the type wasn't automatically
converted to a string.
```
# this works! note the weird quoting is to avoid hiera treating fqdn dots
as sub-keys and is intentional.
profile::gitlab_runner::lookup_test: "%{alias(\"'vault_lookup::kv/data/host/
gitlab-runner-31.example.com/gitlab-ci>registration_token'\")}"
```
Unfortunately, this breaks down when I want to embed that key in a config
hash within hiera, like this:
```
gitlab_ci_runner::runners:
'instance':
config:
name: "Instance Runner on %{::hostname}"
registration-token: "%{alias(\"'vault_lookup::kv/data/host/
gitlab-runner-31.example.com/gitlab-ci>registration_token'\")}"
...
```
I'm guessing without some changes in Hiera/Puppet, this part may not be
possible? Anyone have experience with this?
On Fri, Oct 21, 2022 at 2:28 PM Aaron Russo wrote:
> We're using the vault_lookup[1] module to retrieve secrets from Vault via
> mTLS. It works fairly well when grabbing secrets within a manifest.
>
> However it feels like an anti-pattern by forcing lookups into our
> manifests when we want to keep that in Hiera. I found a previous related
> thread[2] where Henrik suggested writing a custom backend for Hiera and
> return a Deferred.
>
> However after doing what I thought was the correct thing, and returning a
> Deferred in our custom backend, the value in the file ends up being the
> literal string 'Deferred ...' and not being evaluated. I even wrote a quick
> manifest to check if a Deferred is being returned by Hiera/APL and it does
> not seem to be the case -- Hiera is returning a String representation of it.
>
> So my question is -- is it possible to actually return a Deferred via a
> Hiera lookup_key backend and if so, what might I be doing wrong? Sanitized
> code / outputs / etc provided[3] for mocking.
>
> Versions:
> puppet: 7.20.0
> puppetserver: 7.8.0
> puppetlabs/stdlib: 8.30
>
> Thanks!
>
> Aaron
>
> [1] https://forge.puppet.com/modules/puppet/vault_lookup
> [2] https://groups.google.com/g/puppet-users/c/E-Q-ok-B0gQ/m/h-tYJFPdBwAJ
> [3] https://gist.github.com/arusso/9eed3cac93e02aa270b6811b560b2093
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/e5e12ede-e33f-440a-b13f-ccd221110f9dn%40googlegroups.com
> <https://groups.google.com/d/msgid/puppet-users/e5e12ede-e33f-440a-b13f-ccd221110f9dn%40googlegroups.com?utm_medium=email_source=footer>
> .
>
--
Aaron Russo (He/Him/His)
PIXAR | Network & Server Admins (NSA) | Senior Systems Engineer
aru...@pixar.com
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CAA4bxV6NY%2BFoDk-sSZZ8Bv%3D4wuAVP%3DdeQ4Hbg1RnULQXAqCc-w%40mail.gmail.com.
[Puppet Users] Hiera 5 and Deferred / Sensitive
We're using the vault_lookup[1] module to retrieve secrets from Vault via mTLS. It works fairly well when grabbing secrets within a manifest. However it feels like an anti-pattern by forcing lookups into our manifests when we want to keep that in Hiera. I found a previous related thread[2] where Henrik suggested writing a custom backend for Hiera and return a Deferred. However after doing what I thought was the correct thing, and returning a Deferred in our custom backend, the value in the file ends up being the literal string 'Deferred ...' and not being evaluated. I even wrote a quick manifest to check if a Deferred is being returned by Hiera/APL and it does not seem to be the case -- Hiera is returning a String representation of it. So my question is -- is it possible to actually return a Deferred via a Hiera lookup_key backend and if so, what might I be doing wrong? Sanitized code / outputs / etc provided[3] for mocking. Versions: puppet: 7.20.0 puppetserver: 7.8.0 puppetlabs/stdlib: 8.30 Thanks! Aaron [1] https://forge.puppet.com/modules/puppet/vault_lookup [2] https://groups.google.com/g/puppet-users/c/E-Q-ok-B0gQ/m/h-tYJFPdBwAJ [3] https://gist.github.com/arusso/9eed3cac93e02aa270b6811b560b2093 -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/e5e12ede-e33f-440a-b13f-ccd221110f9dn%40googlegroups.com.
Re: [Puppet Users] Unexpected behavior when using variable interpolation on a subkey in hiera
Hi Henrik,
I traced down the issue, and it's actually not hiera. The problem is
actually the version of hiera-eyaml backend we are running. Updating from
2.0.0 -> 2.1.0 appears to resolve the issue.
Thanks for your help,
Aaron Russo
Platforms and Infrastructure
UC Berkeley, IST
On Mon, Jun 13, 2016 at 11:26 AM, Aaron Russo <aru...@berkeley.edu> wrote:
> Hi Henrik,
>
> Yes, hiera_hash is doing it as well. That's what led me down the road to
> debugging directly with Hiera.
>
> Aaron Russo
> Platforms and Infrastructure
> UC Berkeley, IST
>
> On Fri, Jun 10, 2016 at 6:37 PM, Henrik Lindberg <
> henrik.lindb...@puppet.com> wrote:
>
>> On 10/06/16 20:14, aru...@berkeley.edu wrote:
>>
>>> Yikes. When I originally posted I cleaned up identifiable and I took
>>> away too much. I actually was passing everything through like I should.
>>> Since I deleted my test data from the original post, Here's the hiera
>>> data I am having trouble with:
>>>
>>> ucb::mail::senders:
>>> "@%{::clientcert}":
>>> relay: 'berkeley.edu'
>>>
>>> And the resulting hiera call that returns the unexpected entry:
>>>
>>> # hiera -h ucb::mail::senders ::clientcert=myhost.ist.berkeley.edu
>>> ::environment=arusso_postfix ::fqdn=myhost.ist.berkeley.edu -c
>>> /etc/hiera-test.yaml
>>> {"@%{::clientcert}"=>{"relay"=>"berkeley.edu"},
>>> "@myhost.ist.berkeley.edu"=>{"relay"=>"berkeley.edu"}}
>>>
>>>
>> It looks like hiera is doing it wrong - it ends up adding the
>> interpolated key to the hash without removing the original.
>>
>> Is the hiera_hash function doing the same from within puppet?
>>
>> - henrik
>>
>> The template generated on the host also reflects the fact that the extra
>>> entry is being sent over. I also tried it with other facts, like fqdn
>>> and hostname, and confirmed they all exhibit the same behavior.
>>>
>>> Thanks,
>>>
>>> Aaron
>>>
>>> On Friday, June 10, 2016 at 12:08:59 AM UTC-7, Johan De Wit wrote:
>>>
>>> Hi,
>>>
>>>
>>> running hiera from the command line, you have to provide the
>>> variables you use yourself like
>>>
>>>
>>> hiera somekey clientcert=node.example.net <http://node.example.net>
>>>
>>>
>>> Here is some reading
>>>
>>> https://puppet.com/blog/debugging-hiera
>>> <https://puppet.com/blog/debugging-hiera>
>>>
>>>
>>>
>>> hth
>>>
>>>
>>> Johan
>>>
>>>
>>>
>>>
>>> -Original message-
>>> *From:* aru...@berkeley.edu <aru...@berkeley.edu
>>> >
>>> *Sent:* Thursday 9th June 2016 23:17
>>> *To:* Puppet Users <puppet...@googlegroups.com >
>>> *Subject:* [Puppet Users] Unexpected behavior when using
>>> variable interpolation on a subkey in hiera
>>>
>>> Greetings,
>>>
>>> I'm having trouble using hiera variable interpolation on a
>>> sub-key. It appears that along with interpolating the variable,
>>> hiera is also returning the un-interpolated data as well, which
>>> is causing issues because the un-interpolated data is nonsense.
>>> I'm currently running Hiera 1.3.4 and Puppet 3.8.5 on RHEL6.
>>>
>>> Here's an example of what I have in hiera:
>>>
>>> # common.yaml
>>> somekey:
>>> "%{::clientcert}":
>>> subsubkey: "data"
>>>
>>> And here's what I get when I query hiera directly:
>>>
>>> $ hiera -h somekey
>>> {"myhost.example.com
>>> <http://myhost.example.com>"=>{"subsubkey"=>"data"},
>>> "%{::clientcert}"=>{"subsubkey"=>"data"}}
>>>
>>> Oddly enough, if I run it without the -h flag, I only get the
>>> un-interpolated data.
>>>
>>> $ hiera somekey
>>> {"%{::clientcert}"=>{"subsubkey"=>"data"}}
>>>
>>> Based on my reading of the docs[1], in both cases I would expect
>>&
Re: [Puppet Users] Unexpected behavior when using variable interpolation on a subkey in hiera
Hi Henrik,
Yes, hiera_hash is doing it as well. That's what led me down the road to
debugging directly with Hiera.
Aaron Russo
Platforms and Infrastructure
UC Berkeley, IST
On Fri, Jun 10, 2016 at 6:37 PM, Henrik Lindberg <henrik.lindb...@puppet.com
> wrote:
> On 10/06/16 20:14, aru...@berkeley.edu wrote:
>
>> Yikes. When I originally posted I cleaned up identifiable and I took
>> away too much. I actually was passing everything through like I should.
>> Since I deleted my test data from the original post, Here's the hiera
>> data I am having trouble with:
>>
>> ucb::mail::senders:
>> "@%{::clientcert}":
>> relay: 'berkeley.edu'
>>
>> And the resulting hiera call that returns the unexpected entry:
>>
>> # hiera -h ucb::mail::senders ::clientcert=myhost.ist.berkeley.edu
>> ::environment=arusso_postfix ::fqdn=myhost.ist.berkeley.edu -c
>> /etc/hiera-test.yaml
>> {"@%{::clientcert}"=>{"relay"=>"berkeley.edu"},
>> "@myhost.ist.berkeley.edu"=>{"relay"=>"berkeley.edu"}}
>>
>>
> It looks like hiera is doing it wrong - it ends up adding the interpolated
> key to the hash without removing the original.
>
> Is the hiera_hash function doing the same from within puppet?
>
> - henrik
>
> The template generated on the host also reflects the fact that the extra
>> entry is being sent over. I also tried it with other facts, like fqdn
>> and hostname, and confirmed they all exhibit the same behavior.
>>
>> Thanks,
>>
>> Aaron
>>
>> On Friday, June 10, 2016 at 12:08:59 AM UTC-7, Johan De Wit wrote:
>>
>> Hi,
>>
>>
>> running hiera from the command line, you have to provide the
>> variables you use yourself like
>>
>>
>> hiera somekey clientcert=node.example.net <http://node.example.net>
>>
>>
>> Here is some reading
>>
>> https://puppet.com/blog/debugging-hiera
>> <https://puppet.com/blog/debugging-hiera>
>>
>>
>>
>> hth
>>
>>
>> Johan
>>
>>
>>
>>
>> -Original message-
>> *From:* aru...@berkeley.edu <aru...@berkeley.edu
>> >
>> *Sent:* Thursday 9th June 2016 23:17
>> *To:* Puppet Users <puppet...@googlegroups.com >
>> *Subject:* [Puppet Users] Unexpected behavior when using
>> variable interpolation on a subkey in hiera
>>
>> Greetings,
>>
>> I'm having trouble using hiera variable interpolation on a
>> sub-key. It appears that along with interpolating the variable,
>> hiera is also returning the un-interpolated data as well, which
>> is causing issues because the un-interpolated data is nonsense.
>> I'm currently running Hiera 1.3.4 and Puppet 3.8.5 on RHEL6.
>>
>> Here's an example of what I have in hiera:
>>
>> # common.yaml
>> somekey:
>> "%{::clientcert}":
>> subsubkey: "data"
>>
>> And here's what I get when I query hiera directly:
>>
>> $ hiera -h somekey
>> {"myhost.example.com
>> <http://myhost.example.com>"=>{"subsubkey"=>"data"},
>> "%{::clientcert}"=>{"subsubkey"=>"data"}}
>>
>> Oddly enough, if I run it without the -h flag, I only get the
>> un-interpolated data.
>>
>> $ hiera somekey
>> {"%{::clientcert}"=>{"subsubkey"=>"data"}}
>>
>> Based on my reading of the docs[1], in both cases I would expect
>> to get back: {{"myhost.example.com
>> <http://myhost.example.com>"=>{"subsubkey"=>"data"}}
>>
>> I also tested variable interpolation with the value of
>> subsubkey, and hiera properly interpolated it correctly, even on
>> the returned entry where %{::clientcert} was left un-interpolated.
>>
>> Initially I thought this was somehow related to deep_merge, but
>> I tested it out by disabling deep_merge (removing the
>> merge_behavior key) and I get the same results.
>>
>> Am I misunderstanding how interpolation on sub-keys in hiera
>> should work, or is this unintended behavior?
>>
>> Thanks,
>>
>
Re: [Puppet Users] Puppet 3.7 Directory Environments and Vagrant Configuration
Hey Brendan,
I did notice you aren't setting environmentpath in the config section in
your gist. Maybe try setting environmentpath in vagrant? See below for what
I would try.
@@ -31,6 +31,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
puppet.options = --config /vagrant/puppet.conf
--fileserverconfig=/vagrant/fileserver.conf
puppet.module_path =
['/Users/bmurtagh/Dropbox/renan/puppet/environments/vagrant',
'/Users/bmurtagh/Dropbox/renan/puppet/modules']
puppet.hiera_config_path = 'hiera.yaml'
+ puppet.environmentpath =
'/Users/bmurtagh/Dropbox/renan/puppet/environments/'
puppet.facter = {
fqdn = 'centos65.renan.com'
}
Otherwise, I believe puppet is going to look in the default location for
the directory environments, and it's not clear to me that you're populating
/etc/puppet/environments/vagrant nor syncing it from your filesystem
anywhere.
This doesn't give you a friendly guide, but I did update my vagrant
environment to Puppet 3.7 + Directory Environments a week or so ago.
Although I think I elected to not use directory environments since I didn't
need them, I started off going that route and it did work.
Might be of use if you don't mind digging through the code a bit and you're
still stuck.
https://github.com/ucbunix/vagrant-puppet
Something to note is I have a bootstrap process to bring up a real puppet
master that subsequent vagrant boxes will connect to.
Best,
Aaron
On Sun, Sep 28, 2014 at 5:43 PM, Brendan Murtagh
brendan.r.murt...@gmail.com wrote:
Hello,
I am having trouble trying to configure my Vagrant Puppet 3.7 to use
Directory Environments for development. I haven't found a guide to help
update Vagrant to utilize Directory Environments. I'm unsure what I'm
missing. Any help is appreciated. My current Vagrantfile, my provision
output, and puppet.conf are Gist'd below.
https://gist.github.com/bmurtagh/418080e5779357eb8515
Thanks,
Brendan
--
You received this message because you are subscribed to the Google Groups
Puppet Users group.
To unsubscribe from this group and stop receiving emails from it, send an
email to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/1ff7733a-d5ea-496f-a2ae-4e3c81ad6b73%40googlegroups.com
https://groups.google.com/d/msgid/puppet-users/1ff7733a-d5ea-496f-a2ae-4e3c81ad6b73%40googlegroups.com?utm_medium=emailutm_source=footer
.
For more options, visit https://groups.google.com/d/optout.
--
You received this message because you are subscribed to the Google Groups
Puppet Users group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CAJ4yqfRu4Uf%3DoQ0uiNB1OZgS2_uG70UkjjbPmrj4KHbgoKHkOQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
Re: [Puppet Users] How do I generate a sequence number in a template
On Mon, Feb 4, 2013 at 5:41 PM, David Kerr ker...@gmail.com wrote: My template for this chunk looks like: % Array(ipaddress).zip(Array(pgport)).each do |ipaddress,port| -% % backend = 0 % backend_hostname%= backend -% = %= ipaddress % backend_port%= backend -% = %= port % backend_weight%= backend -% = 1 backend_data_directory%= backend -% = '/db/pg' backend_flag%= backend -% = 'ALLOW_TO_FAILOVER' % backend += 1 % % end % I think your problem is you are re-initializing the 'backend' variable each iteration of the loop. Try: % backend = 0 -% % Array(ipaddress).zip(Array(pgport)).each do |ipaddress,port| -% backend_hostname%= backend -% = %= ipaddress % backend_port%= backend -% = %= port % backend_weight%= backend -% = 1 backend_data_directory%= backend -% = '/db/pg' backend_flag%= backend -% = 'ALLOW_TO_FAILOVER' % backend += 1 -% % end % Cheers, Aaron Russo IST Infrastructure Services, Unix Group UC Berkeley --- Desk: 510-643-5550Mobile: 510-206-1532 IM: aru...@berkeley.edu (XMPP/Jabber) -- You received this message because you are subscribed to the Google Groups Puppet Users group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To post to this group, send email to puppet-users@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-users?hl=en. For more options, visit https://groups.google.com/groups/opt_out.
Re: [Puppet Users] Is it possible to generate a sequence in a template?
On Mon, Feb 4, 2013 at 7:37 PM, David Kerr ker...@gmail.com wrote: % @foo = 0 % % Array(bar).each do |flan| -% value %= @foo % % @foo += 1 % % end % This code worked for me. I just used an inline template, but otherwise I had exactly what you had: link: https://gist.github.com/arusso23/4712284 (I'm on 3.0.1 btw) Cheers, Aaron Russo IST Infrastructure Services, Unix Group UC Berkeley --- Desk: 510-643-5550Mobile: 510-206-1532 IM: aru...@berkeley.edu (XMPP/Jabber) -- You received this message because you are subscribed to the Google Groups Puppet Users group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To post to this group, send email to puppet-users@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-users?hl=en. For more options, visit https://groups.google.com/groups/opt_out.
Re: [Puppet Users] Hostname wildcards in module
I think you might have an error in your regex. In particular, it looks like
you're missing a '.', so /^uklab*$/ should probably be /^uklab.*$/
Cheers,
Aaron Russo
IST Infrastructure Services, Unix Group
UC Berkeley
---
Desk: 510-643-5550Mobile: 510-206-1532
IM: aru...@berkeley.edu (XMPP/Jabber)
On Thu, Dec 27, 2012 at 5:29 AM, Allan Mullan ammul...@gmail.com wrote:
case $hostname {
/^uklab*$/: {
$file = resolv-isg.conf
}
default: {
$file = resolv-internal.conf
}
--
You received this message because you are subscribed to the Google Groups
Puppet Users group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Web interface to Facter information, system config reporting?
I wrote a Mediawiki bot that connects to our puppet master, grabs all of the facter data that has been reported by clients, and shoves that into the host's page on our wiki. We format the facter data in our wiki by using a custom tag: bb facter_key/. Once the bot runs, it expands to bb facter_keyfacter_value/bb. I have this set to run every 5 minutes to keep our wiki up to date. The important code for said bot is here: http://github.com/arusso23/bobbie (bot framework) https://github.com/arusso23/libpuppet (puppet rest library) The documentation is admittedly lacking, but if you're interested in using it, feel free to email me off-list. Cheers, Aaron Russo IST Infrastructure Services, Unix Group UC Berkeley --- Desk: 510-643-5550Mobile: 510-206-1532 IM: aru...@berkeley.edu (XMPP/Jabber) On Wed, Dec 19, 2012 at 11:27 AM, Forrie for...@gmail.com wrote: In our department, we recently bought an install of HP's SIM agent -- it's some hacky configuration reporting and management platform that also facilitates firmware updates, etc. I don't care for it. For one, it requires root logins, but it also has agents that report -- it also may have the ability to change the system. My boss is looking for information that is presented in a GUI and easily reportable. I'm thinking Facter is a good candidate here - we can tell it what version of software (SSH, etc), OS, etc. But, it's all command-line. I'm wondering if there is (or if someone is working on) a web-based GUI that can report these statistics (we don't need the overhead of something like puppet-dashboard). And for misc things, we can always write custom facts. Of course, this would only apply to systems that are running puppet. We have others that are not. I've seen some other hacks out there that do different types of reporting - if there's some better approach (open source), that would be great to know about. Thanks. -- You received this message because you are subscribed to the Google Groups Puppet Users group. To view this discussion on the web visit https://groups.google.com/d/msg/puppet-users/-/7L0fdmA0VNIJ. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en. -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Having puppetmaster checkout manifests from subversion
Thomas, Have you looked at SVN's post-commit hooks? I think it can do what you want (though, I'm a git guy, so don't take my word for it). Maybe something like rsync/scp your files over to the puppet masters in your post-commit hook? FWIW, we use git and the post-receive hooks to distribute the code to our masters, then another post-receive hook on each master to handle setting up our dynamic environments. The code we run is here: https://github.com/arusso23/git-hooks/blob/master/vcs/post-receive_distribute https://github.com/arusso23/git-hooks/blob/master/puppet/post-receive_environments Cheers, Aaron Russo IST Infrastructure Services, Unix Group UC Berkeley On Thu, Dec 6, 2012 at 3:55 PM, Peter Brown rendhal...@gmail.com wrote: Hi Thomas, About the only way I can see that working is if you setup a cron job on the puppet master that updates the svn and then do the remote puppet runs. Git may be a better way to achieve this. On 6 December 2012 21:19, Thomas Rasmussen rasmussen.tho...@gmail.comwrote: Hi I'm looking into a setup where we'd like the puppetmaster to checkout/update all the manifests from subversion before it compiles the manifests served to puppet nodes. I have been looking through the documentation, and I can't seem to find a way of doing this. We'd like to be able to develop our manifests on our local computers and when committed to subversion, force a puppet agent run and this run would then use the newest manifests available. We are not using automated puppet agent runs, so the problem of a commit suddenly breaking code without noticing should not be a problem. The subversion server is not running on the same server as puppetmaster, so any interaction from subversion to puppet is not possible. Any ideas how this problem can be solved? We are running puppet 2.7.18 on our master server. Regards Thomas -- You received this message because you are subscribed to the Google Groups Puppet Users group. To view this discussion on the web visit https://groups.google.com/d/msg/puppet-users/-/eIWMOngAR90J. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en. -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en. -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Puppet 2.7 v 3.0 in the PuppetLabs yum repo
full disclosure: I don't use the puppetlabs repos. Below are just some observations and concerns I wanted to voice. On Tue, Oct 2, 2012 at 5:36 PM, Michael Stahnke stah...@puppetlabs.comwrote: On Tue, Oct 2, 2012 at 1:30 PM, Jeff McCune j...@puppetlabs.com wrote: On Tue, Oct 2, 2012 at 1:17 PM, Robert Rothenberg rob...@gmail.com wrote: I am using CentOS 6 with the PuppetLabs yum repo from http://yum.puppetlabs.com I noticed that today version 3 is available on the repo, so of course, an upgrade to Puppet is available. Yes, this major version update went live on Monday. There are a number of breaking-changes between 2.7 and 3.0 which are described at: http://links.puppetlabs.com/telly_breaking_changes Ideally, it would have been better if v3 had a different distribution name, so that systems with v2.7.x are not upgraded (especially if there will be future releases if v2.7). We sent out several notices about this prior to doing it. The Puppet Labs repositories are designed to be the place you get the latest software from Puppet Labs. This was a conscious choice. Where was this announced? On the list? Not everyone who follows the official install instructions ( http://docs.puppetlabs.com/guides/installation.html) is cool enough to join the mailing list :-P The real problem, IMHO, is there is no clear policy regarding the PuppetLabs repo (or at least none I could find easily). These repos contain the latest available packages for Puppet, ... is somewhat ambiguous (or maybe its just me) -- does that mean the latest of the current release or the latest version overall? We now know it's the latter. To that affect, I think it would benefit the community if there was a clearly defined policy with respect to the repos, much like EPEL does ( http://fedoraproject.org/wiki/EPEL/GuidelinesAndPolicies). The closest thing I found was ( http://docs.puppetlabs.com/guides/puppetlabs_package_repositories.html), which I don't think is adequate to describe the intention of the repos. Second-to-lastly, my biggest concern with this problem in its current state, is the potential fallout of users (and the people they influence) who now find puppet to be too volatile or too unstable, and decide to look for alternatives. I won't argue against that these users should have had better practices to prevent this, because it doesn't change the fact that these people are still put off. Personally, I would have liked to see a separate repo for each version of puppet (so that users of 2.6.x, 2.7.x and 3.0.x could continue to receive the latest and greatest for their version). But I also don't have to manage the thing, so I respect that it didn't turn out this way. However, I think the method of communicating to the community can be improved to compensate. And finally, thanks for all the work guys. Puppet is a fantastic product, and has a fantastic community behind it. Cheers, Aaron Russo Could you please file an issue (with impact data) about the distribution name issue. I believe we considered doing what you describe, but decided against it. I don't know the reasons off the top of my head though, an issue will give us a clear place to track the request, the impact it has on you and your organization, and the decision we come to (or have already come to). I am concerned about things breaking. So is there a document detailing incompatibilities? Will there be future 2.7 releases? There will be. I'd imagine you'll see activity slow on it though. There will be future releases of 2.7. We will continue to fix bugs in the 2.7 series, but we are intending to avoid adding any new features or make any large changes to the behavior of Puppet 2.7. Hope this helps, -Jeff -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en. -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en. -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet-lint crashes and burns
Had this exact same problem last night. String.starts_with? wasn't introduced until Ruby 1.8.7. Make sure you have Ruby 1.8.7 or greater installed. Regards, Aaron On Jul 11, 2012, at 7:11 AM, Peter Berghold salty.cowd...@gmail.com wrote: Hi there, After seeing a tweet about puppet-lint I went ahead and installed puppet-lint using the gem install gambit. Noticed there was now a puppet-lint in my path and ran it against one of my manifests to try it out. This was the result: [peter@chits1 manifests]$ puppet-lint templates.pp /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/../lib/puppet-lint/plugin.rb:64:in `run': undefined method `start_with?' for methods:String (NoMethodError) from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/../lib/puppet-lint/plugin.rb:63:in `select' from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/../lib/puppet-lint/plugin.rb:63:in `run' from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/../lib/puppet-lint.rb:158:in `run' from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/../lib/puppet-lint.rb:157:in `each' from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/../lib/puppet-lint.rb:157:in `run' from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/puppet-lint:92 from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/puppet-lint:89:in `each' from /usr/lib/ruby/gems/1.8/gems/puppet-lint-0.1.13/bin/puppet-lint:89 from /usr/bin/puppet-lint:19:in `load' from /usr/bin/puppet-lint:19 Perhaps I have a case of versionitis? Peter L. Berghold salty.cowd...@gmail.com http://blog.berghold.net “Whatever you are, be a good one. - Abraham Lincolnhttp://www.quotesdaddy.com/quote/1174540/abraham-lincoln/whatever-you-are-be-a-good-one ” Get this email app! http://www.wisestamp.com/apps/quotes?utm_source=extensionutm_medium=emailutm_term=quotesutm_campaign=apps Want a signature like mine? http://r1.wisestamp.com/r/landing?promo=16dest=http%3A%2F%2Fwww.wisestamp.com%2Femail-install%3Futm_source%3Dextension%26utm_medium%3Demail%26utm_campaign%3Dpromo_16 Click here.http://r1.wisestamp.com/r/landing?promo=16dest=http%3A%2F%2Fwww.wisestamp.com%2Femail-install%3Futm_source%3Dextension%26utm_medium%3Demail%26utm_campaign%3Dpromo_16 -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en. -- You received this message because you are subscribed to the Google Groups Puppet Users group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
