PuppetDB latest version has disabled APIv1 metrics

[comport3]

The latest version of PuppetDB v6.9.1 has removed localhost access to the v1 API metrics.

Ref https://puppet.com/security/cve/CVE-2020-7943/

https://puppet.com/docs/puppet/latest/release_notes_puppet.html#puppet-resolved-issues-x.12.0

Given it's only "disabled by default", this suggests there is (or, should be) a way to re-enable it, so we can continue using this excellent Icinga2 plugin -

https://github.com/xorpaul/check_puppetdb/

Does anyone know how to re-enable the presently disabled functionality?

This page should have info in my opinion, but doesn't https://puppet.com/docs/puppetdb/latest/api/metrics/v1/mbeans.html

Issue tracked here: https://github.com/xorpaul/check_puppetdb/issues/14

[Justin Stoller]

I believe a config value was added at:

metrics.metrics-webservice.mbeans.enabled

to match the jolokia one that controls v2.

However the default for the mbeans / v1 endpoint is now `false`.

Note that this is now the case for Puppet Server as well and can be re-enabled with the same config value in its respective conf.d.

hth,

Justin

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/bd6f9954-9e51-46d4-90f8-0d5fa407402b%40googlegroups.com.

[comport3]

Thanks for this info, I think it points in the right direction.

Are you able to provide any example config or a link to how to action this?

It's not immediately obvious.

[comport3]

Actually attempting to add the mentioned config to file '/etc/puppetlabs/puppetserver/conf.d/metrics.conf' results in the puppetserver service being unable to start, and this is logged -

clojure.lang.ExceptionInfo: Value does not match schema: {:metrics-webservice {:mbeans disallowed-key}}