Facter 4.0.48 (in [Pull Request 2245|https://github.com/puppetlabs/facter/pull/2245]) resolved a regression in gem-based Facter 4.0.x that did not check for domain name in registry on Windows machines (filed as FACT-2882).
This resolution however prioritizes network interface domain names in favor of the registry information. Puppet 6 and Facter 3 prioritized the registry entries, so this is a regression (or at least, a notable change in behavior).
This is important for domain-joined machines, which store their domain name information in the registry. They may have a network interface with a different domain name received over DHCP, which may be hard to remove depending on the networking circumstances. For these machines where both network adapters have a domain name, and the registry has a domain name, if there is a mismatch, the argument is that the registry is a more safe option to default to.
Trying to understand the timeline for aligning our upgrade process, so I have to ask: Assuming it merges quickly.. would you know when the next upcoming releases are expected for Facter itself to include the commit? And would you know when the next Puppet 7 release may be tagged including this Facter change? Would that be at the end of the linked sprint (February 3)?
Grabbed the current Facter HEAD (6bcd161) and can confirm facter domain and facter fqdn appear to properly return the operator-configured domain (registry) instead of the infrastructure/adapter one. Thank you!
Description of the problem: Facter 4 prioritises network interface domain names over the registry information on Windows. This is a problem because it affects how the agent determines its Puppet[:certname] and can cause agents to try to retrieve a new client certificate under a different name.
Description of the fix: Retrieve networking domain on Windows with priority from registry.
Description of the problem: Facter 4 prioritises prioritizes network interface domain names over the registry information on Windows. This is a problem because it affects how the agent determines its Puppet[:certname] and can cause agents to try to retrieve a new client certificate under a different name.
Description of the fix: Retrieve networking domain on Windows with priority from registry.