You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When running puppet in masterless mode, where you only run puppet apply on a manifest file, rather than a puppet master and puppet agent, the resulting server does not require certificates because there is no master to communicate with.
When running puppet apply however, there is an false positive warning about the client certificate not existing, when it's not relevant to that execution mode.
Expected Behavior
No warning for a client certificate not existing, when one is not expected to exist.
Notice: Compiled catalog for phenom in environment production in 0.01 seconds
Warning: Private key for 'fqdn' does not exist
Warning: Client certificate for 'fqdn' does not exist
Notice: /Stage[main]/Main/File[/tmp/composer]/ensure: defined content as '{mtime}2025-02-25 12:03:50 UTC'
Notice: Applied catalog in 0.25 seconds
The text was updated successfully, but these errors were encountered:
When there are no clientcerts, Puppet will warn when it creates an
`SSLContext` for HTTPS operations. This situation occurs when you run
entirely serverless and never generate clientcerts. It's spurious in
that case, so we don't actually need to warn about it.
This behaviour was added in OpenVoxProject@3f7f830
so that the new HTTP client could download files via HTTPS from the
puppetserver (for example, the way that pe_repo) works.
To prevent this being a failure when running `puppet apply` in
serverless mode, it explicitly marks the clientcerts as optional in
https://github.com/OpenVoxProject/puppet/blob/06bc441333c640678c9adb26412c6cb923af7f6b/lib/puppet/ssl/ssl_provider.rb#L98
and
https://github.com/OpenVoxProject/puppet/blob/06bc441333c640678c9adb26412c6cb923af7f6b/lib/puppet/ssl/ssl_provider.rb#L103
This goes one step further and sets the output to `INFO` rather than `WARN`
when running `puppet apply`.
This does have one small edge case. If,
1. You intend to run a standard server/agent setup, and
2. Before ever running `puppet agent -t` you run `puppet apply` for
provisioning purposes, and
3. Part of that Puppet run attempts to download a file from the
puppetserver
Then you will get a certificate validation error and the HTTPS request
will fail silently with only an `INFO` message as a hint explaining why.
To fix it, you obviously just generate and sign the clientcerts.
I think this is an acceptable tradeoff, but would like other opinions.
This will need specs before merging.
FixesOpenVoxProject#21
Is this a critical security issue?
Describe the Bug
When running puppet in masterless mode, where you only run
puppet apply
on a manifest file, rather than a puppet master and puppet agent, the resulting server does not require certificates because there is no master to communicate with.When running puppet apply however, there is an false positive warning about the client certificate not existing, when it's not relevant to that execution mode.
Expected Behavior
No warning for a client certificate not existing, when one is not expected to exist.
Steps to Reproduce
Make a minimal test.pp manifest file:
Execute:
Environment
Version: 8.13
Platform: Gentoo Linux
Additional Context
No response
Relevant log output
The text was updated successfully, but these errors were encountered: