RE: [Puppet Users] Puppetserver ca migrate

2021-03-16 Thread Bart-Jan Vrielink 
Hello,



"swamped" is also part of my job description.

Thank you for creating the PR. I will monitor this PR and if possible 
contribute to it.



-Original message-
From: Justin Stoller 
Sent: Thursday 11th March 2021 22:10
To: puppet-users@googlegroups.com
Subject: Re: [Puppet Users] Puppetserver ca migrate



On Sat, Mar 6, 2021 at 3:18 AM Bart-Jan Vrielink mailto:bart...@vrielink.net> > wrote:
/etc/puppetlabs/puppetserver/ca is not a volume listed in the docker-compose 
file. Unless that directory is symlinked to somewhere under 
/etc/puppetlabs/puppet/, that directory would get lost whenever the container 
gets updated. Not a good thing for certificates...


Yeah, that sounds terrible  I took that to the team that owns our docker 
images. They seemed swamped but suggested a path forward, so I gave it a shot 
in this PR: https://github.com/puppetlabs/puppetserver/pull/2505. Feel free to 
contribute to the approach there if you want, otherwise I'll reply to this 
thread when it's sorted out.






-Original message-
From: Justin Stoller mailto:jus...@puppet.com> >
Sent: Friday 5th March 2021 20:35
To: puppet-users@googlegroups.com <mailto:puppet-users@googlegroups.com> 
Subject: Re: [Puppet Users] Puppetserver ca migrate



On Thu, Mar 4, 2021 at 11:44 PM Bart-Jan Vrielink mailto:bart...@vrielink.net> > wrote:
Hello,



It would be nice if Puppet's Pupperware is also updated for this new CA 
location...


Is it not? I don't actually work on that team, but I pulled the latest 
puppet/puppetserver image and saw this in the log:
 pupperware (master<>) :: docker run -it puppet/puppetserver                    
                                             
Running /docker-entrypoint.d/10-analytics.sh                                    
                                             
(/docker-entrypoint.d/10-analytics.sh) Pupperware analytics disabled; skipping 
metric submission                             
Running /docker-entrypoint.d/20-use-templates-initially.sh                      
                                             
Upgrading /opt/puppetlabs/server/data/puppetserver/vendored-jruby-gems
Running /docker-entrypoint.d/30-set-permissions.sh
Running /docker-entrypoint.d/40-update-puppetdb-conf.sh
Running /docker-entrypoint.d/50-set-certname.sh
Running /docker-entrypoint.d/55-set-masterport.sh
Running /docker-entrypoint.d/60-setup-autosign.sh
Running /docker-entrypoint.d/70-set-dns-alt-names.sh
Running /docker-entrypoint.d/80-ca.sh
Generation succeeded. Find your files in /etc/puppetlabs/puppetserver/ca
Running /docker-entrypoint.d/85-setup-storeconfigs.sh
Running /docker-entrypoint.d/90-log-config.sh
System configuration values:


That "Generation succeeded. Find your files in /etc/puppetlabs/puppetserver/ca" 
line should be coming from the "puppetserver ca" cli generating the CA files in 
the new location







-Original message-
From: Justin Stoller mailto:jus...@puppet.com> >
Sent: Thursday 4th March 2021 18:11
To: puppet-users@googlegroups.com <mailto:puppet-users@googlegroups.com> 
Subject: Re: [Puppet Users] Puppetserver ca migrate

Hi!

If you've mounted external volumes for your cadir like:

  --mount source=ca-volume,destination=/etc/puppetlabs/puppet/ssl/ca

You should instead mount the destination as /etc/puppetlabs/puppetserver/ca

If you have a Dockerfile that pre-populates your cadir you'll need to update 
your script to the destination above.

Also, make sure your build process is running puppetserver ca setup as part of 
the process (that should ensure new installs have the right directory 
structure).

If you're using this container as a lightweight vm and you've upgraded your 
server inside it, you'll need to somehow override the entrypoint to be a shell 
for you to work in (but you should look into using the container as an 
ephemeral thing with persistent mounts to save data between containers).

If you're using this in a dev setup and are fine with your certs not persisting 
outside the life of the container you can effectively ignore the warning for 
now (but hopefully one of the ideas above will help you find the root cause of 
it).


Also, you're the second person to mention having to pass the --config flag. 
That should only be necessary if you have a custom puppet.conf for some 
advanced purposes. I'm wondering if it was the help output to the CA tool that 
led you in that direction? I could see the current text being confusing, just 
wondering if we should change:

> Use the currently configured puppet.conf file in your installation, or supply 
> one using the `--config` flag.

to something like

> Uses the default puppet.conf in your installation, override by supplying the 
> --config flag.

?


Hope that helps,
Justin




On Thu, Mar 4, 2021 at 8:05 AM Gwen Clayde mailto:mifoun...@gmail.com> > wrote:
Hi, 

I want to solve this issue " The c

Re: [Puppet Users] Puppetserver ca migrate

2021-03-11 Thread Justin Stoller 
On Sat, Mar 6, 2021 at 3:18 AM Bart-Jan Vrielink 
wrote:

> /etc/puppetlabs/puppetserver/ca is not a volume listed in the
> docker-compose file. Unless that directory is symlinked to somewhere under 
> /etc/puppetlabs/puppet/,
> that directory would get lost whenever the container gets updated. Not a
> good thing for certificates...
>

Yeah, that sounds terrible  I took that to the team that owns our
docker images. They seemed swamped but suggested a path forward, so I gave
it a shot in this PR: https://github.com/puppetlabs/puppetserver/pull/2505.
Feel free to contribute to the approach there if you want, otherwise I'll
reply to this thread when it's sorted out.



> -Original message-
> *From:* Justin Stoller 
> *Sent:* Friday 5th March 2021 20:35
> *To:* puppet-users@googlegroups.com
> *Subject:* Re: [Puppet Users] Puppetserver ca migrate
>
>
>
> On Thu, Mar 4, 2021 at 11:44 PM Bart-Jan Vrielink 
> wrote:
>
>> Hello,
>>
>>
>> It would be nice if Puppet's Pupperware is also updated for this new CA
>> location...
>>
>
> Is it not? I don't actually work on that team, but I pulled the latest
> puppet/puppetserver image and saw this in the log:
>  pupperware (master<>) :: docker run -it puppet/puppetserver
>
> Running /docker-entrypoint.d/10-analytics.sh
>
> (/docker-entrypoint.d/10-analytics.sh) Pupperware analytics disabled;
> skipping metric submission
> Running /docker-entrypoint.d/20-use-templates-initially.sh
>
> Upgrading /opt/puppetlabs/server/data/puppetserver/vendored-jruby-gems
> Running /docker-entrypoint.d/30-set-permissions.sh
> Running /docker-entrypoint.d/40-update-puppetdb-conf.sh
> Running /docker-entrypoint.d/50-set-certname.sh
> Running /docker-entrypoint.d/55-set-masterport.sh
> Running /docker-entrypoint.d/60-setup-autosign.sh
> Running /docker-entrypoint.d/70-set-dns-alt-names.sh
> Running /docker-entrypoint.d/80-ca.sh
> Generation succeeded. Find your files in /etc/puppetlabs/puppetserver/ca
> Running /docker-entrypoint.d/85-setup-storeconfigs.sh
> Running /docker-entrypoint.d/90-log-config.sh
> System configuration values:
> 
>
> That "Generation succeeded. Find your files in
> /etc/puppetlabs/puppetserver/ca" line should be coming from the
> "puppetserver ca" cli generating the CA files in the new location....
>
>
>>
>>
>> -Original message-
>> *From:* Justin Stoller 
>> *Sent:* Thursday 4th March 2021 18:11
>> *To:* puppet-users@googlegroups.com
>> *Subject:* Re: [Puppet Users] Puppetserver ca migrate
>>
>> Hi!
>>
>> If you've mounted external volumes for your cadir like:
>>
>>   --mount source=ca-volume,destination=/etc/puppetlabs/puppet/ssl/ca
>>
>> You should instead mount the destination as
>> /etc/puppetlabs/puppetserver/ca
>>
>> If you have a Dockerfile that pre-populates your cadir you'll need to
>> update your script to the destination above.
>>
>> Also, make sure your build process is running puppetserver ca setup as
>> part of the process (that should ensure new installs have the right
>> directory structure).
>>
>> If you're using this container as a lightweight vm and you've upgraded
>> your server inside it, you'll need to somehow override the entrypoint to be
>> a shell for you to work in (but you should look into using the container as
>> an ephemeral thing with persistent mounts to save data between containers).
>>
>> If you're using this in a dev setup and are fine with your certs not
>> persisting outside the life of the container you can effectively ignore the
>> warning for now (but hopefully one of the ideas above will help you find
>> the root cause of it).
>>
>>
>> Also, you're the second person to mention having to pass the --config
>> flag. That should only be necessary if you have a custom puppet.conf for
>> some advanced purposes. I'm wondering if it was the help output to the CA
>> tool that led you in that direction? I could see the current text being
>> confusing, just wondering if we should change:
>>
>> > Use the currently configured puppet.conf file in your installation, or
>> supply one using the `--config` flag.
>>
>> to something like
>>
>> > Uses the default puppet.conf in your installation, override by
>> supplying the --config flag.
>>
>> ?
>>
>>
>> Hope that helps,
>> Justin
>>
>>
>>
>>
>> On Thu, Mar 4, 2021 at 8:05 AM Gwen Clayde  wrote:
>>
>>> Hi,
>>>
>>> I want to solve this issue " The cadir is currently configured to b

RE: [Puppet Users] Puppetserver ca migrate

2021-03-06 Thread Bart-Jan Vrielink 
/etc/puppetlabs/puppetserver/ca is not a volume listed in the docker-compose 
file. Unless that directory is symlinked to somewhere under 
/etc/puppetlabs/puppet/, that directory would get lost whenever the container 
gets updated. Not a good thing for certificates...



-Original message-
From: Justin Stoller 
Sent: Friday 5th March 2021 20:35
To: puppet-users@googlegroups.com
Subject: Re: [Puppet Users] Puppetserver ca migrate



On Thu, Mar 4, 2021 at 11:44 PM Bart-Jan Vrielink mailto:bart...@vrielink.net> > wrote:
Hello,



It would be nice if Puppet's Pupperware is also updated for this new CA 
location...


Is it not? I don't actually work on that team, but I pulled the latest 
puppet/puppetserver image and saw this in the log:
 pupperware (master<>) :: docker run -it puppet/puppetserver                    
                                             
Running /docker-entrypoint.d/10-analytics.sh                                    
                                             
(/docker-entrypoint.d/10-analytics.sh) Pupperware analytics disabled; skipping 
metric submission                             
Running /docker-entrypoint.d/20-use-templates-initially.sh                      
                                             
Upgrading /opt/puppetlabs/server/data/puppetserver/vendored-jruby-gems
Running /docker-entrypoint.d/30-set-permissions.sh
Running /docker-entrypoint.d/40-update-puppetdb-conf.sh
Running /docker-entrypoint.d/50-set-certname.sh
Running /docker-entrypoint.d/55-set-masterport.sh
Running /docker-entrypoint.d/60-setup-autosign.sh
Running /docker-entrypoint.d/70-set-dns-alt-names.sh
Running /docker-entrypoint.d/80-ca.sh
Generation succeeded. Find your files in /etc/puppetlabs/puppetserver/ca
Running /docker-entrypoint.d/85-setup-storeconfigs.sh
Running /docker-entrypoint.d/90-log-config.sh
System configuration values:


That "Generation succeeded. Find your files in /etc/puppetlabs/puppetserver/ca" 
line should be coming from the "puppetserver ca" cli generating the CA files in 
the new location







-Original message-
From: Justin Stoller mailto:jus...@puppet.com> >
Sent: Thursday 4th March 2021 18:11
To: puppet-users@googlegroups.com <mailto:puppet-users@googlegroups.com> 
Subject: Re: [Puppet Users] Puppetserver ca migrate

Hi!

If you've mounted external volumes for your cadir like:

  --mount source=ca-volume,destination=/etc/puppetlabs/puppet/ssl/ca

You should instead mount the destination as /etc/puppetlabs/puppetserver/ca

If you have a Dockerfile that pre-populates your cadir you'll need to update 
your script to the destination above.

Also, make sure your build process is running puppetserver ca setup as part of 
the process (that should ensure new installs have the right directory 
structure).

If you're using this container as a lightweight vm and you've upgraded your 
server inside it, you'll need to somehow override the entrypoint to be a shell 
for you to work in (but you should look into using the container as an 
ephemeral thing with persistent mounts to save data between containers).

If you're using this in a dev setup and are fine with your certs not persisting 
outside the life of the container you can effectively ignore the warning for 
now (but hopefully one of the ideas above will help you find the root cause of 
it).


Also, you're the second person to mention having to pass the --config flag. 
That should only be necessary if you have a custom puppet.conf for some 
advanced purposes. I'm wondering if it was the help output to the CA tool that 
led you in that direction? I could see the current text being confusing, just 
wondering if we should change:

> Use the currently configured puppet.conf file in your installation, or supply 
> one using the `--config` flag.

to something like

> Uses the default puppet.conf in your installation, override by supplying the 
> --config flag.

?


Hope that helps,
Justin




On Thu, Mar 4, 2021 at 8:05 AM Gwen Clayde mailto:mifoun...@gmail.com> > wrote:
Hi, 

I want to solve this issue " The cadir is currently configured to be inside the 
/etc/puppetlabs/puppet/ssl directory"

The first step is : 
puppetserver ca migrate --config 

After this , I got this message : "Puppetserver service is running. Please stop 
it before attempting to run this command"

i use puppet inside a docker container, if i stop it , i couldn't execute the 
command of the first step.

Is there another way to solve this problem?

Thanks.



-- 
 You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
 To unsubscribe from this group and stop receiving emails from it, send an 
email to puppet-users+unsubscr...@googlegroups.com 
<mailto:puppet-users+unsubscr...@googlegroups.com> .
 To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/CACWwVtOMfy16NxM

Re: [Puppet Users] Puppetserver ca migrate

2021-03-05 Thread Justin Stoller 
On Thu, Mar 4, 2021 at 11:44 PM Bart-Jan Vrielink 
wrote:

> Hello,
>
>
> It would be nice if Puppet's Pupperware is also updated for this new CA
> location...
>

Is it not? I don't actually work on that team, but I pulled the latest
puppet/puppetserver image and saw this in the log:
 pupperware (master<>) :: docker run -it puppet/puppetserver

Running /docker-entrypoint.d/10-analytics.sh

(/docker-entrypoint.d/10-analytics.sh) Pupperware analytics disabled;
skipping metric submission
Running /docker-entrypoint.d/20-use-templates-initially.sh

Upgrading /opt/puppetlabs/server/data/puppetserver/vendored-jruby-gems
Running /docker-entrypoint.d/30-set-permissions.sh
Running /docker-entrypoint.d/40-update-puppetdb-conf.sh
Running /docker-entrypoint.d/50-set-certname.sh
Running /docker-entrypoint.d/55-set-masterport.sh
Running /docker-entrypoint.d/60-setup-autosign.sh
Running /docker-entrypoint.d/70-set-dns-alt-names.sh
Running /docker-entrypoint.d/80-ca.sh
Generation succeeded. Find your files in /etc/puppetlabs/puppetserver/ca
Running /docker-entrypoint.d/85-setup-storeconfigs.sh
Running /docker-entrypoint.d/90-log-config.sh
System configuration values:


That "Generation succeeded. Find your files in
/etc/puppetlabs/puppetserver/ca" line should be coming from the
"puppetserver ca" cli generating the CA files in the new location


>
> -Original message-
> *From:* Justin Stoller 
> *Sent:* Thursday 4th March 2021 18:11
> *To:* puppet-users@googlegroups.com
> *Subject:* Re: [Puppet Users] Puppetserver ca migrate
>
> Hi!
>
> If you've mounted external volumes for your cadir like:
>
>   --mount source=ca-volume,destination=/etc/puppetlabs/puppet/ssl/ca
>
> You should instead mount the destination as
> /etc/puppetlabs/puppetserver/ca
>
> If you have a Dockerfile that pre-populates your cadir you'll need to
> update your script to the destination above.
>
> Also, make sure your build process is running puppetserver ca setup as
> part of the process (that should ensure new installs have the right
> directory structure).
>
> If you're using this container as a lightweight vm and you've upgraded
> your server inside it, you'll need to somehow override the entrypoint to be
> a shell for you to work in (but you should look into using the container as
> an ephemeral thing with persistent mounts to save data between containers).
>
> If you're using this in a dev setup and are fine with your certs not
> persisting outside the life of the container you can effectively ignore the
> warning for now (but hopefully one of the ideas above will help you find
> the root cause of it).
>
>
> Also, you're the second person to mention having to pass the --config
> flag. That should only be necessary if you have a custom puppet.conf for
> some advanced purposes. I'm wondering if it was the help output to the CA
> tool that led you in that direction? I could see the current text being
> confusing, just wondering if we should change:
>
> > Use the currently configured puppet.conf file in your installation, or
> supply one using the `--config` flag.
>
> to something like
>
> > Uses the default puppet.conf in your installation, override by supplying
> the --config flag.
>
> ?
>
>
> Hope that helps,
> Justin
>
>
>
>
> On Thu, Mar 4, 2021 at 8:05 AM Gwen Clayde  wrote:
>
>> Hi,
>>
>> I want to solve this issue " The cadir is currently configured to be
>> inside the /etc/puppetlabs/puppet/ssl directory"
>>
>> The first step is :
>> puppetserver ca migrate --config
>>
>> After this , I got this message : "Puppetserver service is running.
>> Please stop it before attempting to run this command"
>>
>> i use puppet inside a docker container, if i stop it , i couldn't execute
>> the command of the first step.
>>
>> Is there another way to solve this problem?
>>
>> Thanks.
>>
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Puppet Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to puppet-users+unsubscr...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/puppet-users/CACWwVtOMfy16NxMxZtNqLV1VR-ei6DaEihzF11M1v3ut9VbSJA%40mail.gmail.com
>> <https://groups.google.com/d/msgid/puppet-users/CACWwVtOMfy16NxMxZtNqLV1VR-ei6DaEihzF11M1v3ut9VbSJA%40mail.gmail.com?utm_medium=email_source=footer>
>> .
>>
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and s

Re: [Puppet Users] "puppetserver ca migrate" error

2021-03-05 Thread Molly Waggett 
On Thu, Mar 4, 2021 at 4:07 AM Erwin Bogaard 
wrote:

> Hi Molly,
>
> thanks for opening the ticket. No further info to add from my side.
> I just executed the manual migration. To me it seems that way is actually
> easier than the puppetserver migrate-way, where yhou have to look for the
> location of your config file  ;-)
>

For what it's worth, you shouldn't have to look for your config file. The
command will use your puppet.conf file by default, but you can use the
--config flag if you want to use a different config file.

>
> On Wednesday, 3 March 2021 at 22:39:08 UTC+1 Molly Waggett wrote:
>
>> Hi Erwin,
>>
>> I have opened SERVER-2979
>>  to investigate your
>> issue. Any additional info you can add to that ticket would be greatly
>> appreciated.
>>
>> In the meantime, you can manually migrate your CA directory:
>> 1. stop the puppetserver service:
>> systemctl stop puppetserver
>> 2. move your CA directory to the new location:
>> mv /etc/puppetlabs/puppet/ssl/ca /etc/puppetlabs/puppetserver/ca
>> 3. to maintain backwards compatibility, create a symlink from the new
>> location to the old location:
>> ln -sf /etc/puppetlabs/puppetserver/ca /etc/puppetlabs/puppet/ssl/ca
>> 4. restart the puppetserver service:
>> systemctl start puppetserver
>>
>> Let us know if you have any other issues.
>>
>> Thanks!
>>
>> On Fri, Feb 26, 2021 at 6:40 AM Erwin Bogaard 
>> wrote:
>>
>>> Hi Molly,
>>>
>>> We don't really run an unusual setup: just a regular machine with
>>> hostname in local DNS available, no IPv6.
>>> The installed Puppet component versions are as follows:
>>> puppet-agent-7.4.1-1.el7.x86_64
>>> puppet-client-tools-1.2.6-1.el7.x86_64
>>> puppetdb-7.2.0-1.el7.noarch
>>> puppetdb-termini-7.2.0-1.el7.noarch
>>> puppet-release-1.0.0-15.el7.noarch
>>> puppetserver-7.0.3-1.el7.noarch
>>>
>>> The requested configuration is as follows:
>>> networking => {
>>>   dhcp => "192.168.100.1",
>>>   domain => "kntr.xxx.loc",
>>>   fqdn => "puppet01.kntr.xxx.loc",
>>>   hostname => "puppet01",
>>> ...
>>> }
>>> os => {
>>>   architecture => "x86_64",
>>>   family => "RedHat",
>>>   hardware => "x86_64",
>>>   name => "CentOS",
>>>   release => {
>>> full => "7.9.2009",
>>> major => "7",
>>> minor => "9"
>>>   },
>>>   selinux => {
>>> enabled => false
>>>   }
>>> }
>>> ruby => {
>>>   platform => "x86_64-linux",
>>>   sitedir => "/opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0",
>>>   version => "2.7.2"
>>> }
>>> On Thursday, 25 February 2021 at 19:52:23 UTC+1 Molly Waggett wrote:
>>>
 Hi Erwin,

 The puppetserver ca migrate command must be run while the puppetserver
 service is stopped, but it looks like we're not catching the particular
 connection error you're getting when we check to see whether the service is
 running.

 I'm wondering if you have an unusual networking setup, e.g. custom DNS
 config, IPv6, etc.
 I was not able to reproduce your issue on a first attempt, so it would
 also be helpful to know which version of puppetserver you're running, what
 OS platform you're running on, and which version of Ruby you're using.

 Thanks!

 On Thu, Feb 25, 2021 at 2:59 AM Erwin Bogaard 
 wrote:

>
> Hi,
>
> I'm trying to solve the notofocation about "The cadir is currently
> configured to be inside the /etc/puppetlabs/puppet/ssl directory".
> When I follow the steps, and run:
>
> #  puppetserver ca migrate --config /etc/puppetlabs/puppet/puppet.conf
>
> I get the message: "Puppetserver service is running. Please stop it
> before attempting to run this command."
>
> If I then stop the puppetserver service and run the command again, I
> get the following Error: "Fatal error when running action 'migrate'
>   Error: Failed connecting to https://xxx.loc:8140/status/v1/simple/ca
>   Root cause: Failed to open TCP connection to xxx.loc:8140 (Invalid
> argument - connect(2) for "xxx.loc" port 8140)"
>
> That no connection is possible seems logical, as I stopped the service
> prevously.
>
> If "puppetsever ca migrate" won't run when the service is running, but
> it needs to connect to the service, how is that ever going to work? I'm
> baffeled.
>
> As a work around: is there maybe a manual way to execute this
> migration?
>
> --
> You received this message because you are subscribed to the Google
> Groups "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to puppet-users...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/c4627ffb-887d-490e-9dc6-7b730cdf3622n%40googlegroups.com
>

RE: [Puppet Users] Puppetserver ca migrate

2021-03-04 Thread Bart-Jan Vrielink 
Hello,



It would be nice if Puppet's Pupperware is also updated for this new CA 
location...





-Original message-
From: Justin Stoller 
Sent: Thursday 4th March 2021 18:11
To: puppet-users@googlegroups.com
Subject: Re: [Puppet Users] Puppetserver ca migrate

Hi!

If you've mounted external volumes for your cadir like:

  --mount source=ca-volume,destination=/etc/puppetlabs/puppet/ssl/ca

You should instead mount the destination as /etc/puppetlabs/puppetserver/ca

If you have a Dockerfile that pre-populates your cadir you'll need to update 
your script to the destination above.

Also, make sure your build process is running puppetserver ca setup as part of 
the process (that should ensure new installs have the right directory 
structure).

If you're using this container as a lightweight vm and you've upgraded your 
server inside it, you'll need to somehow override the entrypoint to be a shell 
for you to work in (but you should look into using the container as an 
ephemeral thing with persistent mounts to save data between containers).

If you're using this in a dev setup and are fine with your certs not persisting 
outside the life of the container you can effectively ignore the warning for 
now (but hopefully one of the ideas above will help you find the root cause of 
it).


Also, you're the second person to mention having to pass the --config flag. 
That should only be necessary if you have a custom puppet.conf for some 
advanced purposes. I'm wondering if it was the help output to the CA tool that 
led you in that direction? I could see the current text being confusing, just 
wondering if we should change:

> Use the currently configured puppet.conf file in your installation, or supply 
> one using the `--config` flag.

to something like

> Uses the default puppet.conf in your installation, override by supplying the 
> --config flag.

?


Hope that helps,
Justin




On Thu, Mar 4, 2021 at 8:05 AM Gwen Clayde mailto:mifoun...@gmail.com> > wrote:
Hi, 

I want to solve this issue " The cadir is currently configured to be inside the 
/etc/puppetlabs/puppet/ssl directory"

The first step is : 
puppetserver ca migrate --config 

After this , I got this message : "Puppetserver service is running. Please stop 
it before attempting to run this command"

i use puppet inside a docker container, if i stop it , i couldn't execute the 
command of the first step.

Is there another way to solve this problem?

Thanks.



-- 
 You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
 To unsubscribe from this group and stop receiving emails from it, send an 
email to puppet-users+unsubscr...@googlegroups.com 
<mailto:puppet-users+unsubscr...@googlegroups.com> .
 To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/CACWwVtOMfy16NxMxZtNqLV1VR-ei6DaEihzF11M1v3ut9VbSJA%40mail.gmail.com.


-- 
 You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
 To unsubscribe from this group and stop receiving emails from it, send an 
email to puppet-users+unsubscr...@googlegroups.com 
<mailto:puppet-users+unsubscr...@googlegroups.com> .
 To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/CA%2B%3DBEqUKBsBfQ1FQ5sP5n%2BsM9RBqW7uMkB_3f%2BhFVPi9J-72%3DQ%40mail.gmail.com.
 

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/zarafa.6041e157.124f.16489cbc0b82ef82%40anjie.dontpanic.nl.

Re: [Puppet Users] Puppetserver ca migrate

2021-03-04 Thread Justin Stoller 
Hi!

If you've mounted external volumes for your cadir like:

  --mount source=ca-volume,destination=/etc/puppetlabs/puppet/ssl/ca

You should instead mount the destination as /etc/puppetlabs/puppetserver/ca

If you have a Dockerfile that pre-populates your cadir you'll need to
update your script to the destination above.

Also, make sure your build process is running puppetserver ca setup as part
of the process (that should ensure new installs have the right directory
structure).

If you're using this container as a lightweight vm and you've upgraded your
server inside it, you'll need to somehow override the entrypoint to be a
shell for you to work in (but you should look into using the container as
an ephemeral thing with persistent mounts to save data between containers).

If you're using this in a dev setup and are fine with your certs not
persisting outside the life of the container you can effectively ignore the
warning for now (but hopefully one of the ideas above will help you find
the root cause of it).


Also, you're the second person to mention having to pass the --config flag.
That should only be necessary if you have a custom puppet.conf for some
advanced purposes. I'm wondering if it was the help output to the CA tool
that led you in that direction? I could see the current text being
confusing, just wondering if we should change:

> Use the currently configured puppet.conf file in your installation, or
supply one using the `--config` flag.

to something like

> Uses the default puppet.conf in your installation, override by supplying
the --config flag.

?


Hope that helps,
Justin




On Thu, Mar 4, 2021 at 8:05 AM Gwen Clayde  wrote:

> Hi,
>
> I want to solve this issue " The cadir is currently configured to be
> inside the /etc/puppetlabs/puppet/ssl directory"
>
> The first step is :
> puppetserver ca migrate --config
>
> After this , I got this message : "Puppetserver service is running. Please
> stop it before attempting to run this command"
>
> i use puppet inside a docker container, if i stop it , i couldn't execute
> the command of the first step.
>
> Is there another way to solve this problem?
>
> Thanks.
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/CACWwVtOMfy16NxMxZtNqLV1VR-ei6DaEihzF11M1v3ut9VbSJA%40mail.gmail.com
> 
> .
>

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/CA%2B%3DBEqUKBsBfQ1FQ5sP5n%2BsM9RBqW7uMkB_3f%2BhFVPi9J-72%3DQ%40mail.gmail.com.

[Puppet Users] Puppetserver ca migrate

2021-03-04 Thread Gwen Clayde 
Hi,

I want to solve this issue " The cadir is currently configured to be inside
the /etc/puppetlabs/puppet/ssl directory"

The first step is :
puppetserver ca migrate --config

After this , I got this message : "Puppetserver service is running. Please
stop it before attempting to run this command"

i use puppet inside a docker container, if i stop it , i couldn't execute
the command of the first step.

Is there another way to solve this problem?

Thanks.

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/CACWwVtOMfy16NxMxZtNqLV1VR-ei6DaEihzF11M1v3ut9VbSJA%40mail.gmail.com.

Re: [Puppet Users] "puppetserver ca migrate" error

2021-03-04 Thread Erwin Bogaard 
Hi Molly,

thanks for opening the ticket. No further info to add from my side.
I just executed the manual migration. To me it seems that way is actually 
easier than the puppetserver migrate-way, where yhou have to look for the 
location of your config file  ;-)

On Wednesday, 3 March 2021 at 22:39:08 UTC+1 Molly Waggett wrote:

> Hi Erwin,
>
> I have opened SERVER-2979 
>  to investigate your 
> issue. Any additional info you can add to that ticket would be greatly 
> appreciated.
>
> In the meantime, you can manually migrate your CA directory:
> 1. stop the puppetserver service:
> systemctl stop puppetserver
> 2. move your CA directory to the new location:
> mv /etc/puppetlabs/puppet/ssl/ca /etc/puppetlabs/puppetserver/ca
> 3. to maintain backwards compatibility, create a symlink from the new 
> location to the old location:
> ln -sf /etc/puppetlabs/puppetserver/ca /etc/puppetlabs/puppet/ssl/ca
> 4. restart the puppetserver service:
> systemctl start puppetserver 
>
> Let us know if you have any other issues.
>
> Thanks!
>
> On Fri, Feb 26, 2021 at 6:40 AM Erwin Bogaard  wrote:
>
>> Hi Molly,
>>
>> We don't really run an unusual setup: just a regular machine with 
>> hostname in local DNS available, no IPv6.
>> The installed Puppet component versions are as follows:
>> puppet-agent-7.4.1-1.el7.x86_64
>> puppet-client-tools-1.2.6-1.el7.x86_64
>> puppetdb-7.2.0-1.el7.noarch
>> puppetdb-termini-7.2.0-1.el7.noarch
>> puppet-release-1.0.0-15.el7.noarch
>> puppetserver-7.0.3-1.el7.noarch
>>
>> The requested configuration is as follows:
>> networking => {
>>   dhcp => "192.168.100.1",
>>   domain => "kntr.xxx.loc",
>>   fqdn => "puppet01.kntr.xxx.loc",
>>   hostname => "puppet01",
>> ...
>> }
>> os => {
>>   architecture => "x86_64",
>>   family => "RedHat",
>>   hardware => "x86_64",
>>   name => "CentOS",
>>   release => {
>> full => "7.9.2009",
>> major => "7",
>> minor => "9"
>>   },
>>   selinux => {
>> enabled => false
>>   }
>> }
>> ruby => {
>>   platform => "x86_64-linux",
>>   sitedir => "/opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0",
>>   version => "2.7.2"
>> }
>> On Thursday, 25 February 2021 at 19:52:23 UTC+1 Molly Waggett wrote:
>>
>>> Hi Erwin,
>>>
>>> The puppetserver ca migrate command must be run while the puppetserver 
>>> service is stopped, but it looks like we're not catching the particular 
>>> connection error you're getting when we check to see whether the service is 
>>> running. 
>>>
>>> I'm wondering if you have an unusual networking setup, e.g. custom DNS 
>>> config, IPv6, etc.
>>> I was not able to reproduce your issue on a first attempt, so it would 
>>> also be helpful to know which version of puppetserver you're running, what 
>>> OS platform you're running on, and which version of Ruby you're using.
>>>
>>> Thanks!
>>>
>>> On Thu, Feb 25, 2021 at 2:59 AM Erwin Bogaard  
>>> wrote:
>>>

 Hi,

 I'm trying to solve the notofocation about "The cadir is currently 
 configured to be inside the /etc/puppetlabs/puppet/ssl directory".
 When I follow the steps, and run:

 #  puppetserver ca migrate --config /etc/puppetlabs/puppet/puppet.conf

 I get the message: "Puppetserver service is running. Please stop it 
 before attempting to run this command."

 If I then stop the puppetserver service and run the command again, I 
 get the following Error: "Fatal error when running action 'migrate'
   Error: Failed connecting to https://xxx.loc:8140/status/v1/simple/ca
   Root cause: Failed to open TCP connection to xxx.loc:8140 (Invalid 
 argument - connect(2) for "xxx.loc" port 8140)"

 That no connection is possible seems logical, as I stopped the service 
 prevously.

 If "puppetsever ca migrate" won't run when the service is running, but 
 it needs to connect to the service, how is that ever going to work? I'm 
 baffeled.

 As a work around: is there maybe a manual way to execute this migration?

 -- 
 You received this message because you are subscribed to the Google 
 Groups "Puppet Users" group.
 To unsubscribe from this group and stop receiving emails from it, send 
 an email to puppet-users...@googlegroups.com.
 To view this discussion on the web visit 
 https://groups.google.com/d/msgid/puppet-users/c4627ffb-887d-490e-9dc6-7b730cdf3622n%40googlegroups.com
  
 
 .

>>>
>>>
>>> -- 
>>> *Molly Waggett*
>>> she/her
>>> Senior Software Engineer @ Puppet
>>>
>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "Puppet Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to puppet-users...@googlegroups.com.
>>
> To view this discussion on

Re: [Puppet Users] "puppetserver ca migrate" error

2021-03-03 Thread Molly Waggett 
Hi Erwin,

I have opened SERVER-2979
 to investigate your
issue. Any additional info you can add to that ticket would be greatly
appreciated.

In the meantime, you can manually migrate your CA directory:
1. stop the puppetserver service:
systemctl stop puppetserver
2. move your CA directory to the new location:
mv /etc/puppetlabs/puppet/ssl/ca /etc/puppetlabs/puppetserver/ca
3. to maintain backwards compatibility, create a symlink from the new
location to the old location:
ln -sf /etc/puppetlabs/puppetserver/ca /etc/puppetlabs/puppet/ssl/ca
4. restart the puppetserver service:
systemctl start puppetserver

Let us know if you have any other issues.

Thanks!

On Fri, Feb 26, 2021 at 6:40 AM Erwin Bogaard 
wrote:

> Hi Molly,
>
> We don't really run an unusual setup: just a regular machine with hostname
> in local DNS available, no IPv6.
> The installed Puppet component versions are as follows:
> puppet-agent-7.4.1-1.el7.x86_64
> puppet-client-tools-1.2.6-1.el7.x86_64
> puppetdb-7.2.0-1.el7.noarch
> puppetdb-termini-7.2.0-1.el7.noarch
> puppet-release-1.0.0-15.el7.noarch
> puppetserver-7.0.3-1.el7.noarch
>
> The requested configuration is as follows:
> networking => {
>   dhcp => "192.168.100.1",
>   domain => "kntr.xxx.loc",
>   fqdn => "puppet01.kntr.xxx.loc",
>   hostname => "puppet01",
> ...
> }
> os => {
>   architecture => "x86_64",
>   family => "RedHat",
>   hardware => "x86_64",
>   name => "CentOS",
>   release => {
> full => "7.9.2009",
> major => "7",
> minor => "9"
>   },
>   selinux => {
> enabled => false
>   }
> }
> ruby => {
>   platform => "x86_64-linux",
>   sitedir => "/opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0",
>   version => "2.7.2"
> }
> On Thursday, 25 February 2021 at 19:52:23 UTC+1 Molly Waggett wrote:
>
>> Hi Erwin,
>>
>> The puppetserver ca migrate command must be run while the puppetserver
>> service is stopped, but it looks like we're not catching the particular
>> connection error you're getting when we check to see whether the service is
>> running.
>>
>> I'm wondering if you have an unusual networking setup, e.g. custom DNS
>> config, IPv6, etc.
>> I was not able to reproduce your issue on a first attempt, so it would
>> also be helpful to know which version of puppetserver you're running, what
>> OS platform you're running on, and which version of Ruby you're using.
>>
>> Thanks!
>>
>> On Thu, Feb 25, 2021 at 2:59 AM Erwin Bogaard 
>> wrote:
>>
>>>
>>> Hi,
>>>
>>> I'm trying to solve the notofocation about "The cadir is currently
>>> configured to be inside the /etc/puppetlabs/puppet/ssl directory".
>>> When I follow the steps, and run:
>>>
>>> #  puppetserver ca migrate --config /etc/puppetlabs/puppet/puppet.conf
>>>
>>> I get the message: "Puppetserver service is running. Please stop it
>>> before attempting to run this command."
>>>
>>> If I then stop the puppetserver service and run the command again, I get
>>> the following Error: "Fatal error when running action 'migrate'
>>>   Error: Failed connecting to https://xxx.loc:8140/status/v1/simple/ca
>>>   Root cause: Failed to open TCP connection to xxx.loc:8140 (Invalid
>>> argument - connect(2) for "xxx.loc" port 8140)"
>>>
>>> That no connection is possible seems logical, as I stopped the service
>>> prevously.
>>>
>>> If "puppetsever ca migrate" won't run when the service is running, but
>>> it needs to connect to the service, how is that ever going to work? I'm
>>> baffeled.
>>>
>>> As a work around: is there maybe a manual way to execute this migration?
>>>
>>> --
>>> You received this message because you are subscribed to the Google
>>> Groups "Puppet Users" group.
>>> To unsubscribe from this group and stop receiving emails from it, send
>>> an email to puppet-users...@googlegroups.com.
>>> To view this discussion on the web visit
>>> https://groups.google.com/d/msgid/puppet-users/c4627ffb-887d-490e-9dc6-7b730cdf3622n%40googlegroups.com
>>> 
>>> .
>>>
>>
>>
>> --
>> *Molly Waggett*
>> she/her
>> Senior Software Engineer @ Puppet
>>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/d58e26d1-1cba-4b43-997d-819df7a8381an%40googlegroups.com
> 
> .
>


-- 
*Molly Waggett*
she/her
Senior Software Engineer @ Puppet

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email

Re: [Puppet Users] "puppetserver ca migrate" error

2021-02-26 Thread Erwin Bogaard 
Hi Molly,

We don't really run an unusual setup: just a regular machine with hostname 
in local DNS available, no IPv6.
The installed Puppet component versions are as follows:
puppet-agent-7.4.1-1.el7.x86_64
puppet-client-tools-1.2.6-1.el7.x86_64
puppetdb-7.2.0-1.el7.noarch
puppetdb-termini-7.2.0-1.el7.noarch
puppet-release-1.0.0-15.el7.noarch
puppetserver-7.0.3-1.el7.noarch

The requested configuration is as follows:
networking => {
  dhcp => "192.168.100.1",
  domain => "kntr.xxx.loc",
  fqdn => "puppet01.kntr.xxx.loc",
  hostname => "puppet01",
...
}
os => {
  architecture => "x86_64",
  family => "RedHat",
  hardware => "x86_64",
  name => "CentOS",
  release => {
full => "7.9.2009",
major => "7",
minor => "9"
  },
  selinux => {
enabled => false
  }
}
ruby => {
  platform => "x86_64-linux",
  sitedir => "/opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0",
  version => "2.7.2"
}
On Thursday, 25 February 2021 at 19:52:23 UTC+1 Molly Waggett wrote:

> Hi Erwin,
>
> The puppetserver ca migrate command must be run while the puppetserver 
> service is stopped, but it looks like we're not catching the particular 
> connection error you're getting when we check to see whether the service is 
> running. 
>
> I'm wondering if you have an unusual networking setup, e.g. custom DNS 
> config, IPv6, etc.
> I was not able to reproduce your issue on a first attempt, so it would 
> also be helpful to know which version of puppetserver you're running, what 
> OS platform you're running on, and which version of Ruby you're using.
>
> Thanks!
>
> On Thu, Feb 25, 2021 at 2:59 AM Erwin Bogaard  wrote:
>
>>
>> Hi,
>>
>> I'm trying to solve the notofocation about "The cadir is currently 
>> configured to be inside the /etc/puppetlabs/puppet/ssl directory".
>> When I follow the steps, and run:
>>
>> #  puppetserver ca migrate --config /etc/puppetlabs/puppet/puppet.conf
>>
>> I get the message: "Puppetserver service is running. Please stop it 
>> before attempting to run this command."
>>
>> If I then stop the puppetserver service and run the command again, I get 
>> the following Error: "Fatal error when running action 'migrate'
>>   Error: Failed connecting to https://xxx.loc:8140/status/v1/simple/ca
>>   Root cause: Failed to open TCP connection to xxx.loc:8140 (Invalid 
>> argument - connect(2) for "xxx.loc" port 8140)"
>>
>> That no connection is possible seems logical, as I stopped the service 
>> prevously.
>>
>> If "puppetsever ca migrate" won't run when the service is running, but it 
>> needs to connect to the service, how is that ever going to work? I'm 
>> baffeled.
>>
>> As a work around: is there maybe a manual way to execute this migration?
>>
>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "Puppet Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to puppet-users...@googlegroups.com.
>> To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/puppet-users/c4627ffb-887d-490e-9dc6-7b730cdf3622n%40googlegroups.com
>>  
>> 
>> .
>>
>
>
> -- 
> *Molly Waggett*
> she/her
> Senior Software Engineer @ Puppet
>

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/d58e26d1-1cba-4b43-997d-819df7a8381an%40googlegroups.com.

Re: [Puppet Users] "puppetserver ca migrate" error

2021-02-25 Thread Molly Waggett 
Hi Erwin,

The puppetserver ca migrate command must be run while the puppetserver
service is stopped, but it looks like we're not catching the particular
connection error you're getting when we check to see whether the service is
running.

I'm wondering if you have an unusual networking setup, e.g. custom DNS
config, IPv6, etc.
I was not able to reproduce your issue on a first attempt, so it would also
be helpful to know which version of puppetserver you're running, what OS
platform you're running on, and which version of Ruby you're using.

Thanks!

On Thu, Feb 25, 2021 at 2:59 AM Erwin Bogaard 
wrote:

>
> Hi,
>
> I'm trying to solve the notofocation about "The cadir is currently
> configured to be inside the /etc/puppetlabs/puppet/ssl directory".
> When I follow the steps, and run:
>
> #  puppetserver ca migrate --config /etc/puppetlabs/puppet/puppet.conf
>
> I get the message: "Puppetserver service is running. Please stop it before
> attempting to run this command."
>
> If I then stop the puppetserver service and run the command again, I get
> the following Error: "Fatal error when running action 'migrate'
>   Error: Failed connecting to https://xxx.loc:8140/status/v1/simple/ca
>   Root cause: Failed to open TCP connection to xxx.loc:8140 (Invalid
> argument - connect(2) for "xxx.loc" port 8140)"
>
> That no connection is possible seems logical, as I stopped the service
> prevously.
>
> If "puppetsever ca migrate" won't run when the service is running, but it
> needs to connect to the service, how is that ever going to work? I'm
> baffeled.
>
> As a work around: is there maybe a manual way to execute this migration?
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/puppet-users/c4627ffb-887d-490e-9dc6-7b730cdf3622n%40googlegroups.com
> 
> .
>


-- 
*Molly Waggett*
she/her
Senior Software Engineer @ Puppet

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/CAFOE68BoFH--d632-qBiB%2BsfL80BX%3Do7JXExOiN04HU1p9d2NQ%40mail.gmail.com.

[Puppet Users] "puppetserver ca migrate" error

2021-02-25 Thread Erwin Bogaard 

Hi,

I'm trying to solve the notofocation about "The cadir is currently 
configured to be inside the /etc/puppetlabs/puppet/ssl directory".
When I follow the steps, and run:

#  puppetserver ca migrate --config /etc/puppetlabs/puppet/puppet.conf

I get the message: "Puppetserver service is running. Please stop it before 
attempting to run this command."

If I then stop the puppetserver service and run the command again, I get 
the following Error: "Fatal error when running action 'migrate'
  Error: Failed connecting to https://xxx.loc:8140/status/v1/simple/ca
  Root cause: Failed to open TCP connection to xxx.loc:8140 (Invalid 
argument - connect(2) for "xxx.loc" port 8140)"

That no connection is possible seems logical, as I stopped the service 
prevously.

If "puppetsever ca migrate" won't run when the service is running, but it 
needs to connect to the service, how is that ever going to work? I'm 
baffeled.

As a work around: is there maybe a manual way to execute this migration?

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/puppet-users/c4627ffb-887d-490e-9dc6-7b730cdf3622n%40googlegroups.com.