Jira (PUP-7734) puppet.conf bad environment setting breaks ENC correct environment setting

6 views
Skip to first unread message

Christopher Wood (JIRA)

unread,
Jun 27, 2017, 11:35:04 AM6/27/17
to puppe...@googlegroups.com
Christopher Wood created an issue
 
Puppet / Bug PUP-7734
puppet.conf bad environment setting breaks ENC correct environment setting
Issue Type: Bug Bug
Affects Versions: PUP 4.10.1
Assignee: Unassigned
Created: 2017/06/27 8:34 AM
Environment:
  1. cat /etc/redhat-release
    CentOS release 6.9 (Final)
  1. # uname -a
    Linux mail10c7 2.6.32-696.3.2.el6.x86_64 #1 SMP Tue Jun 20 01:26:55 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
  1. rpm -q puppet-agent
    puppet-agent-1.10.1-1.el6.x86_64
Priority: Minor Minor
Reporter: Christopher Wood

This happens whenever the existing environment doesn't match what the ENC sets, which is fine (names in this post have been changed):

Notice: Local environment: 'production' doesn't match server specified node environment 'realenv', switching agent to 'realenv'.

If I use "environment = otherrealenv" (something which exists) in the [agent] section of puppet.conf then I get the same error message, which is fine.

Notice: Local environment: 'otherrealenv' doesn't match server specified node environment 'realenv', switching agent to 'realenv'.

However, when I use an environment that has never existed or previously existed but was removed, things break.

Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: Find /puppet/v3/node/myhost.me.com?environment=fakeenv&configured_environment=fakeenv&t... resulted in 404 with the message:

{"message":"Not Found: Could not find environment 'fakeenv'","issue_kind":"RUNTIME_ERROR"}

Info: Retrieving pluginfacts
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve information from environment fakeenv source(s) puppet:///pluginfacts
Info: Retrieving plugin
Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve information from environment fakeenv source(s) puppet:///plugins

(Many failing resources here.)

Error: Could not retrieve catalog from remote server: Find /puppet/v3/catalog/myhost.me.com?environment=fakeenv&facts_format=pson&facts=%257B... resulted in 404 with the message:

{"message":"Not Found: Could not find environment 'fakeenv'","issue_kind":"RUNTIME_ERROR"}

The documentation seems to indicate that the ENC environment overrides the agent-requested environment. Not sure if that makes this a documentation bug or a puppet bug, but it's behaviour I did not expect.

https://docs.puppet.com/puppet/4.10/configuration.html#environment

https://docs.puppet.com/puppet/4.10/nodes_external.html#considerations-and-differences-from-node-definitions

"In Puppet 3 and later, ENCs can set an environment for a node, overriding whatever environment the node requested."

For use case background:

The informational message about how the current environment "doesn't match server specified node environment" was causing some consternation so I used the environment setting to make it go away. (Apparently it sounded like an error message.)

This breaks a bit when we have ephemeral environments; somebody may remove an environment (via r10k) but forget to change the ENC classification and do an agent run first. When they remove the environment before those steps the fix is to manually update puppet.conf to remove the environment line, which works against the lesson that people should only use puppet to update server configs.

Add Comment Add Comment
 
This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe)
Atlassian logo

Henrik Lindberg (JIRA)

unread,
Jun 28, 2017, 4:02:02 AM6/28/17
to puppe...@googlegroups.com
Henrik Lindberg updated an issue
Change By: Henrik Lindberg
This happens whenever the existing environment doesn't match what the ENC sets, which is fine (names in this post have been changed):
{code}
Notice: Local environment: 'production' doesn't match server specified node environment 'realenv', switching agent to 'realenv'.
{code}
If I use "environment = otherrealenv" (something which exists) in the [agent] section of puppet.conf then I get the same error message, which is fine. 
{code}
Notice: Local environment: 'otherrealenv' doesn't match server specified node environment 'realenv', switching agent to 'realenv'.
{code}
However, when I use an environment that has never existed or previously existed but was removed, things break.
{code}
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: Find /puppet/v3/node/myhost.me.com?environment=fakeenv&configured_environment=fakeenv&t... resulted in 404 with the message: {"message":"Not Found: Could not find environment 'fakeenv'","issue_kind":"RUNTIME_ERROR"}
Info: Retrieving pluginfacts
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve information from environment fakeenv source(s) puppet:///pluginfacts
Info: Retrieving plugin
Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve information from environment fakeenv source(s) puppet:///plugins

(Many failing resources here.)

Error: Could not retrieve catalog from remote server: Find /puppet/v3/catalog/myhost.me.com?environment=fakeenv&facts_format=pson&facts=%257B... resulted in 404 with the message: {"message":"Not Found: Could not find environment 'fakeenv'","issue_kind":"RUNTIME_ERROR"}
{code}
The documentation seems to indicate that the ENC environment overrides the agent-requested environment. Not sure if that makes this a documentation bug or a puppet bug, but it's behaviour I did not expect.

https://docs.puppet.com/puppet/4.10/configuration.html#environment

https://docs.puppet.com/puppet/4.10/nodes_external.html#considerations-and-differences-from-node-definitions

"In Puppet 3 and later, ENCs can set an environment for a node, overriding whatever environment the node requested."

For use case background:

The informational message about how the current environment "doesn't match server specified node environment" was causing some consternation so I used the environment setting to make it go away. (Apparently it sounded like an error message.)

This breaks a bit when we have ephemeral environments; somebody may remove an environment (via r10k) but forget to change the ENC classification and do an agent run first. When they remove the environment before those steps the fix is to manually update puppet.conf to remove the environment line, which works against the lesson that people should only use puppet to update server configs.

Henrik Lindberg (JIRA)

unread,
Jun 28, 2017, 4:18:02 AM6/28/17
to puppe...@googlegroups.com

Henrik Lindberg (JIRA)

unread,
Jun 28, 2017, 4:18:02 AM6/28/17
to puppe...@googlegroups.com
Henrik Lindberg commented on Bug PUP-7734
 
Re: puppet.conf bad environment setting breaks ENC correct environment setting

The master side is normally authoritative on which env to use for a node. It can however allow a node to select which env to use. Doing so is opening up a security vulnerability though. That said, it is not reasonable that an environment that is not going to be used is flagged as an error when it does not exists if at the same time the ENC is authoritative. When the ENC honours an agent specified environment it must however error if the agent specifies an environment that does not exist.

Anthony Chevalet (JIRA)

unread,
Oct 10, 2019, 8:58:02 AM10/10/19
to puppe...@googlegroups.com

Any update?

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)
Atlassian logo

Josh Cooper (Jira)

unread,
Jun 5, 2020, 6:34:03 PM6/5/20
to puppe...@googlegroups.com
Josh Cooper commented on Bug PUP-7734

This is a duplicate of PUP-6802

This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)
Atlassian logo

Josh Cooper (Jira)

unread,
Jun 5, 2020, 6:36:03 PM6/5/20
to puppe...@googlegroups.com
Josh Cooper commented on Bug PUP-7734

When puppet makes a catalog request, it specifies which environment the agent thinks it's supposed to be in. The server attempts to resolve this environment before checking the ENC. So if the environment directory doesn't exist, then the request will fail.

Reply all
Reply to author
Forward
0 new messages