Foreman Proxy together with Puppet in docker container

Has anybody already tried to run a Foreman Proxy in a Puppet docker container ?
I was thinking to do that based on the official Puppet container: https://hub.docker.com/r/puppet/puppetserver

My goal is to run both foreman and puppet as much as possible within docker.

I would advise against running in the same container. Since Puppet 6 we can actually use the REST API for all calls to the Puppetserver. I’ve been working on an example which deploys Puppetserver on a VM and a separate Foreman Proxy:

https://github.com/theforeman/forklift/pull/979

Note that you will need to do some work to get reports and autosigning to work.

Foreman :: Manual lists how to configure the proxy for the Puppet feature.

Foreman :: Manual hasn’t been updated for Puppet 6 but puppetca_http_api.yml is very much the same.

I’d be interested to see what you come up with because properly supporting a remote Puppetserver is very much on my medium term agenda. I’m working on a draft RFC. puppet.md · GitHub is still incomplete and rough, but it goes over the various integration points.

Short feedback:
Basic puppet setup seems to be fine (at least more or less)

  • puppetserver based on official image is up and running
  • used “puppetserver ca import” to import the ca that I’ve already setup in production
  • r10k setup is ok

When it comes to foreman integration I have issue with ENC:

puppetmaster1_1_fdacb75fb209 | 2019-07-19 14:20:19,089 WARN  [c.p.p.ShellUtils] Executed an external process which logged to STDERR: During fact upload occured an exception: 404 "Not Found"
puppetmaster1_1_fdacb75fb209 | /etc/puppetlabs/puppet/external_node_v2.rb:414: warning: constant ::TimeoutError is deprecated
puppetmaster1_1_fdacb75fb209 | Serving cached ENC: Could not send facts to Foreman: 404 "Not Found"
puppetmaster1_1_fdacb75fb209 | Unable to read from Cache file: No such file or directory @ rb_sysopen - /opt/puppetlabs/server/data/puppetserver/yaml/foreman/test-foreman-01.lab.net.yaml
puppetmaster1_1_fdacb75fb209 | 
puppetmaster1_1_fdacb75fb209 | 2019-07-19 14:20:19,103 ERROR [puppetserver] Puppet Failed when searching for node test-foreman-01.kstm.net: Failed to find test-foreman-01.lab.net via exec: Execution of '/etc/puppetlabs/puppet/external_node_v2.rb test-foreman-01.lab.net' returned 1: 
....
puppetmaster1_1_fdacb75fb209 | 2019-07-19 14:20:19,106 ERROR [puppetserver] Puppet Server Error: Failed when searching for node test-foreman-01.lab.net: Failed to find test-foreman-01.lab.net via exec: Execution of '/etc/puppetlabs/puppet/external_node_v2.rb test-foreman-01.lab.net' returned 1: 

On the agent node (test-foreman-01.lab.net)

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Failed when searching for node test-foreman-01.lab.net: Failed to find test-foreman-01.lab.net via exec:    Execution of '/etc/puppetlabs/puppet/external_node_v2.rb test-foreman-01.lab.net' returned 1: 
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

I compared with productive puppet master and found that following folder (and hosts fact file as well of course) is indeed missing (which is reference in ENC script and afaiu is used to store facts and to upload it to foreman)

/opt/puppetlabs/server/data/puppetserver/yaml/foreman/test-foreman-01.lab.net.yaml

For an unrelated reason I played with implementing the ENC as a hiera backend. Could you have a look if this works in your environment?

Will this make sure that the puppet environment assigned by foreman is used ?

I am still stuck with foreman ENC. However, I wanted to share my setup right now, and maybe you have suggestions:

I am running 2 containers:

  • puppet-server (Puppetmaster based on Puppet6)
  • foreman-server (based on Foreman v1.23.0-dev)

Both containers are more or less standard and they seem to function properly. This means I am able to run puppet agents against the puppet master to apply some configurations and I am able to login to foreman (GUI) and create hosts or whatever. (at least I assume that, because I havent full setup with OS, Installation media, prov. templates and so on)

Now I want to extend my setup by using the foreman ENC feature. Since I dont know how to configure hiera backend as suggested:

I did some more investigation with ruby based node classifier (https://github.com/theforeman/puppet-foreman/blob/master/files/foreman-report_v2.rb). Now I am able to run this script against the foreman container (foreman-server), but the request is not successfull, because of (at least ) the following 2 issues:

  1. there is a warning: no smart proxy found on … (this is clear, because I havent installed any, and from what you said it isnt required anymore, isnt it ?)

    … and is not in trusted host. (This is also clear, I think, because this is a feature of smart proxy itself)

  2. redirection to http://foreman-server.lab.net:3000/users/login
    Anything I can do, here ? Is that maybe just a question of client certificate I have to provide and configure ?

Foreman log:

2019-07-24T16:34:28 [I|app|6ad99ccc] Started GET "/node/test-foreman-01.lab.net?format=yml" for 172.17.0.1 at 2019-07-24 16:34:28 +0200
2019-07-24T16:34:28 [I|app|6ad99ccc] Processing by HostsController#externalNodes as YML
2019-07-24T16:34:28 [I|app|6ad99ccc]   Parameters: {"name"=>"test-foreman-01.lab.net"}
2019-07-24T16:34:28 [W|app|6ad99ccc] No smart proxy server found on ["172.17.0.1"] and is not in trusted_hosts
2019-07-24T16:34:28 [I|app|6ad99ccc] Redirected to http://foreman-server.lab.net:3000/users/login
2019-07-24T16:34:28 [I|app|6ad99ccc] Filter chain halted as #<Proc:0x0000561f78ec8310@/home/foreman/app/controllers/concerns/foreman/controller/smart_proxy_auth.rb:14> rendered or redirected
2019-07-24T16:34:28 [I|app|6ad99ccc] Completed 403 Forbidden in 361ms (ActiveRecord: 137.0ms)

regarding puppet reports: there is an issue with as well (at least in my setup).
I configured in puppet.conf on the master:

[main]
...
reports = log, foreman
....

During puppet agent run I see in on puppetmaster:

puppetmaster-v6    | 2019-07-26 09:41:04,810 WARN  [puppetserver] Puppet Loaded report file for foreman but report was not defined
puppetmaster-v6    | 2019-07-26 09:41:04,812 WARN  [puppetserver] Puppet No report named 'foreman'