Avoid registration in Foreman

mfuhrmann · December 21, 2020, 8:24pm

Problem: Is there maybe a way to avoid the registration for specific hosts that matches for example name patterns?
Right now all nodes that are registered in Puppet appear in Foreman.
I don’t use Pupoetdb.

Expected outcome: Avoid registration of specific nodes.

Foreman and Proxy versions: 2.0

Marek_Hulan · January 4, 2021, 11:50am

I don’t think there’s a way to do it. The best place to implement such filtering would probably be here for facts upload registrations and here for reports based registration. The blacklist could be stored in foreman.yaml that both of these callbacks use.

ekohl · January 4, 2021, 12:05pm

Could you help me understand why you would not want all Puppet hosts to be registered?

mfuhrmann · January 4, 2021, 9:08pm

We use Kitchen and Chef to spin up AWS VMs to create CI tests to test if Puppet modules do that what we expect. The tests deliver useful output, so Foreman is not required in this case. But of course the nodes appear in Foreman.

ekohl · January 8, 2021, 5:14pm

You would need to disable fact uploading. Here is where it’s checked:

github.com

theforeman/puppet-foreman/blob/c3c090ce8645a3f3da9cf7290ac13cab1503d8c6/files/external_node_v2.rb#L406


else
  certname = ARGV[0] || raise("Must provide certname as an argument")
  #
  # query External node
  begin
    result = ""
    Timeout.timeout(tsecs) do
      # send facts to Foreman - enable 'facts' setting to activate
      # if you use this option below, make sure that you don't send facts to foreman via the rake task or push facts alternatives.
      #
      if SETTINGS[:facts]
        req = generate_fact_request certname, "#{puppetdir}/yaml/facts/#{certname}.yaml"
        upload_facts(certname, req)
      end

      result = enc(certname)
      cache(certname, result)
    end
  rescue TimeoutError, SocketError, Errno::EHOSTUNREACH, Errno::ECONNREFUSED, FactUploadError => e
    $stderr.puts "Serving cached ENC: #{e}"
    # Read from cache, we got some sort of an error.

You can set it to false in the settings, but that disables it for all hosts on that server. If you have a dedicated test puppetserver, that’s fine. Otherwise you would need to to modify the ENC script to do some filtering.

After that, I don’t think the ENC makes sense (it should fail). That means you can probably short circuit it with an early return.

Lastly, the report uploading should also be disabled for those hosts.