Puppet invoking yum with a proxy inconsistently

[mer...@mrc-mbu.cam.ac.uk]

Greetings

This is my first post here, so hi everyone!

I have been using puppet to manage our fleet of 120 Macs for a few years now and have recently decided to setup a new TheForeman installation to manage our Linux servers...

The problem I have is yum refusing to download updated packages on some of these machines.
Some of our machines need to use a proxy to access the Internet while others don't.
When I run 'puppet agent --test' (as root) on the command-line all of my clients work as expected.
Initially all servers are running CentOS 6.5 and have Puppet 3.7.2 (from the puppetlabs repo).
I was attempting to upgrade the clients to Puppet 3.7.3 when I realised I had this issue - (I have since updated some of them manually).

I will now only be talking about the machines that need a proxy..
I have http_proxy, https_proxy (and uppercase variants) configured in the .bash_profile for root and I am also able to use yum on the command-line of all these machines.

As I said, they are able apply new packages if I invoke the puppet command manually - but some of these servers will not get packages when run from the daemon. I get a classic, can't get on the network error:

Could not update: Execution of '/usr/bin/yum -d 0 -e 0 -y install puppet-3.7.3-1.el6' returned 1: Error Downloading Packages: puppet-3.7.3-1.el6.noarch: failure: puppet-3.7.3-1.el6.noarch.rpm from puppetlabs: [Errno 256] No more mirrors to try. Wrapped exception: Execution of '/usr/bin/yum -d 0 -e 0 -y install puppet-3.7.3-1.el6' returned 1: Error Downloading Packages: puppet-3.7.3-1.el6.noarch: failure: puppet-3.7.3-1.el6.noarch.rpm from puppetlabs: [Errno 256] No more mirrors to try.

I have now added the proxy configuration to yum.conf on one of the machines affected and this has fixed the problem. But I am perplxed as to the fact that this is only affecting some of my proxied machines.
I have looked in /etc/profile.d and not found any proxy entries (I also did a 'grep -r <proxyserver> /etc/' to find anything configured with our server).

Can anyone think of anywhere else I should look to work out why it *does* work on some of my machines?

I imagine it is something very simple that I have overlooked!

Thanks all


Merlin

[Walid]

could it be the version of yum on these nodes? why not have the proxy configuration ( user, password, and url) managed by puppet  too. i am assuming you are using yumrepo resource.

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/0a1e92b0-9b18-4173-b545-b8b73d08e070%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[jcbollinger]

It's bad news for a system service (such as the Puppet agent) to rely on environment variables that it does not manage itself.  In particular, it generally does not work to rely on such environment variables to be set via standard shell setup files.  Configuring yum with the proper proxy settings is a good way to go, and obviously you could (and probably should) use Puppet to configure yum.

I can only speculate as to why that seems unneeded on some of your systems.  Possibly the proxy configuration is set on the agent (http_proxy_* configuration parameters or command-line options) and that is being exported to subprocesses.  Or possibly the hosts that work without proxy configuration are able to connect directly.  Or possibly their traffic is running through a NAT server or a similar network device that serves as a transparent proxy.

Consider, too, managing internal mirrors of the repositories you rely upon, and pointing yum there.  If the proxy is needed only for access outside your own network, then that could smooth things out.  It has multiple other advantages, too, among them reducing the load on your network uplink and giving you control over which packages are available for installation / upgrade.


John