Modifying puppet.conf on foreman puppet server

jmcnally · December 24, 2024, 7:00pm

Problem:

Need to disable “strict mode” on puppetserver after Puppet 8 upgrade

Expected outcome:

I can insert “strict = warning” and “strict_variables = false” in the [main] section of puppet.conf on the foreman/puppet server. After restarting the puppetserver service, it has the desired effect and “strict mode” seems to be disabled. However, when I run foreman-installer again, the inserted lines have disappeared from puppet.conf.

Question: How to I make these changes permanent, with a foreman-installer option, perhaps?

Foreman and Proxy versions:

Foreman 3.13.0
Smart Proxy 3.13.0

Foreman and Proxy plugin versions:

foreman_discovery 25.0.0
foreman_puppet 8.0.0

Distribution and version:

Rocky Linux 9.5

Other relevant data:

puppet-server version 8.7.0
puppet-agent version 8.10.0

NOTE: This is a problem of my own making: I have puppet code that does not run with “strict” mode" enabled. I need some time to correct it, so disabling “strict mode” is a temporary workaround to let me run clean while I fix the code.

Thanks!

-jm

gvde · December 25, 2024, 10:00am

I think you should be able to add settings via --puppet-additional-settings

github.com

theforeman/puppet-puppet/blob/b4c69a6d25cc5ecc8a3923118841fbad2ea66c4c/manifests/init.pp#L266


      
          #
          # $server_storeconfigs::                    Whether to enable storeconfigs
          #
          # $server_certname::                        The name to use when handling certificates.
          #
          # === Advanced server parameters:
          #
          # $server_strict_variables::                if set to true, it will throw parse errors
          #                                           when accessing undeclared variables.
          #
          # $server_additional_settings::             A hash of additional settings.
          #                                           Example: {trusted_node_data => true, ordering => 'manifest'}
          #
          # $server_manage_user::                     Whether to manage the server user resource
          #
          # $server_user::                            Username used for the puppetserver process
          #
          # $server_group::                           Group used for the puppetserver process
          #
          # $server_dir::                             Puppet configuration directory
          #

jmcnally · December 30, 2024, 4:04am

Dear Support,

Trying to add the ‘strict_variables = false’ and ‘strict = warning’ directives to puppet.conf, I ran this command:

foreman-installer --verbose \
  --puppet-server-additional-settings=strict:warning \
  --puppet-server-additional-settings=strict_variables:false

The console output contained an error, regarding duplicate resource declaration:

2024-12-27 23:27:04 [NOTICE] [configure] Starting system configuration.
2024-12-27 23:27:10 [ERROR ] [configure] Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: Puppet::Config::Server[strict_variables] is already declared at (file: /usr/share/foreman-installer/modules/puppet/manifests/server/config.pp, line: 78); cannot redeclare (file: /usr/share/foreman-installer/modules/puppet/manifests/server/config.pp, line: 99) (file: /usr/share/foreman-installer/modules/puppet/manifests/server/config.pp, line: 99, column: 5) on node foreman2.intranet.psfc.coop
2024-12-27 23:27:10 [NOTICE] [configure] System configuration has finished.

Even curiouser, when I ran ‘foreman-installer --verbose’ again with no additional options, the same duplicate resource error appeared. I was able to get foreman-installer to run without error by commenting out lines 99-101 of config.pp, as referenced in the error, thus avoiding the resource conflict:

$puppet::server::additional_settings.each |$key,$value| {
  puppet::config::server { $key: value => $value }
}

Questions:

How do I undo the effects of the ‘–puppet-server-additional-settings’ options and properly remove the duplicate resource in config.pp?
What is the correct syntax for adding ‘strict = warning’ to the [server] section of puppet.conf? Apparently, I do not need to add ‘strict_variables = false’ as this is already present, due to a longstanding foreman default option.

Thanks for your help.

-jm

gvde · December 30, 2024, 8:10am

jmcnally:

Trying to add the ‘strict_variables = false’ and ‘strict = warning’ directives to puppet.conf, I ran this command:
foreman-installer --verbose \
  --puppet-server-additional-settings=strict:warning \
  --puppet-server-additional-settings=strict_variables:false

You can add settings with this but not change settings which are written otherwise. That’s why I have posted the link to the code above. For strict_variables there is a foreman-installer option --puppet-server-strict-variables.

That isn’t helping. That’s the code which adds the additional settings. Commenting out

github.com

theforeman/puppet-puppet/blob/b4c69a6d25cc5ecc8a3923118841fbad2ea66c4c/manifests/server/config.pp#L83


      
            puppet::config::main {
              'default_manifest': value => $puppet::server::default_manifest_path;
            }
          }
          
          puppet::config::server {
            'autosign':           value => $autosign;
            'ca':                 value => $puppet::server::ca;
            'certname':           value => $puppet::server::certname;
            'parser':             value => $puppet::server::parser;
            'strict_variables':   value => $puppet::server::strict_variables;
            'storeconfigs':       value => $puppet::server::storeconfigs;
          }
          
          if $puppet::server::ssl_dir_manage {
            puppet::config::server {
              'ssldir':           value => $puppet::server::ssl_dir;
            }
          }
          if $server_environment_timeout {
            puppet::config::server {

would have been a better idea for testing as that’s the first definition of strict_variables mentioned in the error message. Then the additional_settings should go through.

As the command line help says: --reset-puppet-server-additional-settings. You may also be able to remove it from the answer file for your scenario, e.g. /etc/foreman-installer/scenarios.d/katello-answers.yaml if using katello or /etc/foreman-installer/scenarios.d/foreman-answers.yaml if you are not using katello.

Generally, the foreman-install cli help does list really every option you can use

# foreman-installer --full-help

Consider the duplicate error you have got, I would say your syntax is correct. I don’t want to test it on my foreman server now during the holidays.

jmcnally · December 31, 2024, 3:24am

gvde,

Following your suggestions, I was able to reset-puppet-additional-settings, then set ‘strict=warning’ with this:

foreman-installer --verbose \
  --reset-puppet-additional-settings \
  --puppet-server-additional-settings=strict:warning

Foreman-installer runs normally, now with no duplicate resource error. After all my puppet code is strict-compliant, I will turn on strict mode with this:

foreman-installer --verbose \
  --reset-puppet-additional-settings \
  --puppet-server-strict-variables=true

Thanks for your help in sorting this out.

-jm