Jira (PDB-4540) DNS_ALT_NAMES set by docker puppetdb >= 6.6.0

26 views
Skip to first unread message

Christoph Roeder (JIRA)

unread,
Oct 3, 2019, 9:17:03 AM10/3/19
to puppe...@googlegroups.com
Christoph Roeder created an issue
 
PuppetDB / Bug PDB-4540
DNS_ALT_NAMES set by docker puppetdb >= 6.6.0
Issue Type: Bug Bug
Affects Versions: PDB 6.6.0
Assignee: Unassigned
Created: 2019/10/03 6:16 AM
Fix Versions: PDB 6.5.0
Priority: Major Major
Reporter: Christoph Roeder

Puppet Version: 6.7.0
Puppet Server Version: 6.7.0
OS Name/Version: Ubuntu 18.04

puppetdb 6.6.0 and upwards creates an dns alt cert even if no env variable DNS_ALT_NAMES is set.

Desired Behavior: create an cert for puppetdb

Actual Behavior: created an cert for puppetdb with alt name "puppetdb,"

puppetdb_1 | Running /docker-entrypoint.d/30-configure-ssl.sh
puppetdb_1 | (/ssl.sh) Using configuration values:
puppetdb_1 | (/ssl.sh) * CERTNAME: 'puppetdb' (/CN=puppetdb)
puppetdb_1 | (/ssl.sh) * DNS_ALT_NAMES: 'puppetdb,'
puppetdb_1 | (/ssl.sh) * CA: 'https://puppet:8140/puppet-ca/v1'
puppetdb_1 | (/ssl.sh) * SSLDIR: '/opt/puppetlabs/server/data/puppetdb/certs'
puppetdb_1 | (/ssl.sh) * WAITFORCERT: '120' seconds
puppetdb_1 | subject=CN = Puppet CA: puppet.home.roeder.io
puppetdb_1 | issuer=CN = Puppet CA: puppet.home.roeder.io
puppetdb_1 | (/ssl.sh) Error: CA already has signed certificate for 'puppetdb'
Add Comment Add Comment
 
This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)
Atlassian logo

Christoph Roeder (JIRA)

unread,
Oct 3, 2019, 9:23:05 AM10/3/19
to puppe...@googlegroups.com
Christoph Roeder updated an issue
Change By: Christoph Roeder
*Puppet Version: 6.7.0*
*Puppet Server Version: 6.7.0*
*OS Name/Version: Ubuntu 18.04*


puppetdb 6.6.0 and upwards creates an dns alt cert even if no env variable DNS_ALT_NAMES is set.

*Desired Behavior:* create an cert for puppetdb

*Actual Behavior:* created an cert for puppetdb with alt name "puppetdb,"


puppetdb_1 | Running /docker-entrypoint.d/30-configure-ssl.sh
puppetdb_1 | (/ssl.sh) Using configuration values:
puppetdb_1 | (/ssl.sh) * CERTNAME: 'puppetdb' (/CN=puppetdb)
{color:# FF0000 ff0000 }puppetdb_1 | (/ssl.sh) * DNS_ALT_NAMES: 'puppetdb,' {color}

puppetdb_1 | (/ssl.sh) * CA: 'https://puppet:8140/puppet-ca/v1'
puppetdb_1 | (/ssl.sh) * SSLDIR: '/opt/puppetlabs/server/data/puppetdb/certs'
puppetdb_1 | (/ssl.sh) * WAITFORCERT: '120' seconds
puppetdb_1 | subject=CN = Puppet CA: puppet.home.roeder.io
puppetdb_1 | issuer=CN = Puppet CA: puppet.home.roeder.io
puppetdb_1 | (/ssl.sh) Error: CA already has signed certificate for 'puppetdb'

Morgan Rhodes (JIRA)

unread,
Oct 4, 2019, 12:57:04 PM10/4/19
to puppe...@googlegroups.com
Morgan Rhodes assigned an issue to Morgan Rhodes
Change By: Morgan Rhodes
Assignee: Morgan Rhodes

Morgan Rhodes (JIRA)

unread,
Oct 4, 2019, 12:57:04 PM10/4/19
to puppe...@googlegroups.com
Morgan Rhodes updated an issue
Change By: Morgan Rhodes
Team: Release Engineering
Sprint: Release Engineering Kanban

Morgan Rhodes (JIRA)

unread,
Oct 10, 2019, 5:42:02 PM10/10/19
to puppe...@googlegroups.com
Morgan Rhodes commented on Bug PDB-4540
 
Re: DNS_ALT_NAMES set by docker puppetdb >= 6.6.0

Hi Christoph Roeder,

Apologies for the delay in getting back to you, it's been a rather busy week. I have a PR up with a fix, just waiting on review/merge from the developer who added the DNS_ALT_NAMES to puppetdb.

Will update here when that's been merged/published

Morgan Rhodes (JIRA)

unread,
Oct 14, 2019, 6:14:04 PM10/14/19
to puppe...@googlegroups.com
Morgan Rhodes commented on Bug PDB-4540

A fix for this has been published in puppet/puppetdb:6.7.1

John Jeffers (JIRA)

unread,
Oct 16, 2019, 11:56:04 PM10/16/19
to puppe...@googlegroups.com
John Jeffers commented on Bug PDB-4540

Still crashing for me on 6.7.1

puppetdb Running /docker-entrypoint.d/30-configure-ssl.sh
 
puppetdb (/ssl.sh) Using configuration values:
 
puppetdb (/ssl.sh) * CERTNAME: 'puppetdb' (/CN=puppetdb)
 
puppetdb (/ssl.sh) * DNS_ALT_NAMES: ''
 
puppetdb (/ssl.sh) * CA: 'https://puppet:8140/puppet-ca/v1'
 
puppetdb (/ssl.sh) * SSLDIR: '/opt/puppetlabs/server/data/puppetdb/certs'
 
puppetdb (/ssl.sh) * WAITFORCERT: '120' seconds
 
puppetdb subject=CN = Puppet CA: puppet-7bcd8b4474-p6fzk.puppet.svc.cluster.local
 
puppetdb issuer=CN = Puppet CA: puppet-7bcd8b4474-p6fzk.puppet.svc.cluster.local
 
puppetdb (/ssl.sh) Error: CA already has signed certificate for 'puppetdb'

Last version that works as expected is 6.5.0.

 

Morgan Rhodes (JIRA)

unread,
Oct 17, 2019, 12:29:03 PM10/17/19
to puppe...@googlegroups.com
Morgan Rhodes commented on Bug PDB-4540

Hi Christoph Roeder, can you send me more information on how you're running the containers? I see in your output that the DNS alt names aren't getting set any more, but I need more details to diagnose the issue. If you're starting this up with compose a copy of the docker-compose.yml file you're using would be helpful.

John Jeffers (JIRA)

unread,
Oct 17, 2019, 5:42:03 PM10/17/19
to puppe...@googlegroups.com
John Jeffers commented on Bug PDB-4540

Morgan Rhodes I believe that was directed at me, not Christoph.

I'm running in Kubernetes, pulling images straight from Docker Hub. Not modifying the puppetdb image in any way, just attempting to use it as-is.

If I use the 6.5.0 image in my deployment, puppetdb starts up just fine. Anything later than that, and I get the error above.

Please let me know what other info you need.

Morgan Rhodes (JIRA)

unread,
Oct 17, 2019, 6:11:03 PM10/17/19
to puppe...@googlegroups.com
Morgan Rhodes commented on Bug PDB-4540

John Jeffers ah, yes, you're right

Ok, I have an idea for what the issue might be here. We moved the SSL dir for more consistency with other containers. So, in your k8s config if you have a volume mounting to `/etc/puppetlabs/puppet/ssl/` in the pdb container, try changing that to `/opt/puppetlabs/server/data/puppetdb/certs/`.

If that doesn't work, and info on volumes / env variables would be helpful for trying to replicate.

John Jeffers (JIRA)

unread,
Oct 17, 2019, 6:51:03 PM10/17/19
to puppe...@googlegroups.com
John Jeffers commented on Bug PDB-4540

Morgan Rhodes That was it. I updated the path in the volume mount to `/opt/puppetlabs/server/data/puppetdb/certs/` and it started successfully with 6.7.1. Thanks!

 

Morgan Rhodes (JIRA)

unread,
Oct 17, 2019, 6:56:04 PM10/17/19
to puppe...@googlegroups.com
Morgan Rhodes commented on Bug PDB-4540

Awesome, glad to hear it John Jeffers! Apologies for the breakage, we're unfortunately still in a state where there are some potentially disruptive changes we want to make, but also not a great way to communicate those.

John Jeffers (JIRA)

unread,
Oct 17, 2019, 6:57:04 PM10/17/19
to puppe...@googlegroups.com
John Jeffers commented on Bug PDB-4540

Gotcha. Appreciate the quick reply!

Austin Blatt (JIRA)

unread,
Oct 22, 2019, 9:19:02 PM10/22/19
to puppe...@googlegroups.com
Austin Blatt updated an issue
 
Change By: Austin Blatt
Fix Version/s: PDB 6.7.2
Reply all
Reply to author
Forward
0 new messages