#1032060 puppetserver setup ca does not finish setup

Package:
puppetserver
Source:
puppetserver
Submitter:
Bastian Blank
Date:
2023-02-27 18:24:04 UTC
Severity:
normal
Tags:
#1032060#5
Date:
2023-02-27 08:46:25 UTC
From:
To:
"puppetserver setup ca" writes into config directories managed by
puppet-agent.  So I assume it should result in a working CA setup.
However this is not the case, the agent does not find a valid client
cert.

| # puppetserver ca setup
| Generation succeeded. Find your files in /etc/puppet/puppetserver/ca
| # systemctl start puppetserver
| # puppet agent -t
| Info: Using environment 'production'
| Info: Retrieving pluginfacts
| Info: Retrieving plugin
| Error: Could not retrieve catalog from remote server: Error 403 on SERVER: Forbidden request: /puppet/v3/catalog/debian-sid. (method :post). Please see the server logs for details.
| Warning: Not using cache on failed catalog
| Error: Could not retrieve catalog; skipping run
| Error: Could not send report: Error 403 on SERVER: Forbidden request: /puppet/v3/report/debian-sid. (method :put). Please see the server logs for details.

Bastian
#1032060#10
Date:
2023-02-27 15:14:33 UTC
From:
To:
Hello,

Unfortunately I'm unable to reproduce this issue. Is this a new
puppetserver installation, or an upgrade from puppet-master 5.5?

In either case, please provide the full puppet and puppetserver
configurations, as well as debug logs/output from the puppet agent and
puppetserver daemon.

Thanks,
#1032060#17
Date:
2023-02-27 16:29:17 UTC
From:
To:
This is a new installation.

However I found the reason.  The hostname setup is incomplete.  The
server considers the name for the certificate to be "debian-sid." and
uses files "debian-sid..crt" (aka it adds a trailing dot).

The agent seems to be not that kind and tries to get a new certificate,
which fails as the CN is already in use.

Bastian
#1032060#22
Date:
2023-02-27 16:46:12 UTC
From:
To:
Oh this is interesting.

Is not having a FQDN even supported in Puppet?

Maybe this could warrant a severity downgrade too... Seems like an edge
case...
#1032060#27
Date:
2023-02-27 18:21:46 UTC
From:
To:
Le 2023-02-27 à 11 h 29, Bastian Blank a écrit :
containers none of the machines' hostnames have a FQDN: only the host
part exists, and neither do puppet agent nor puppetserver add a trailing
dot to the client certificate.

Le 2023-02-27 à 11 h 46, Antoine Beaupré a écrit :
 > Is not having a FQDN even supported in Puppet?

If a certificate can be generated for it, it works, so yes one can use
puppet on machines without FQDNs.

 > Maybe this could warrant a severity downgrade too... Seems like an
edge case...

Downgraded to normal.