Puppet CA error in foreman WEB UI

proxy

#1

Problem:
We can no longer see clients certificates using Foreman Web GUI after upgrading to puppetserver 6.0

Failure: ERF50-5345 [Foreman::WrappedException]: Unable to connect ([ProxyAPI::ProxyException]: ERF12-5356 [ProxyAPI::ProxyException]: Unable to get PuppetCA certificates ([RestClient::NotAcceptable]: 406 Not Acceptable) for proxy https://techops02.dev.int.luminoso.com:8443/puppet/ca)

Expected outcome:
We are expecting to see the list of all puppet certs using foreman Web GUI

Foreman and Proxy versions:
1.20.0

Foreman and Proxy plugin versions:
1.20.0

Other relevant data:
It seems like i can see the root of the issue but i can’t find the place to fix it. Puppetserver version 6.0 replaced puppet command to list the certificates from /opt/puppetlabs/bin/puppet cert to /opt/puppetlabs/bin/puppetserver ca. However, the logs from /var/log/foreman-proxy/proxy.log have the following:

2018-11-29T14:46:02 f9403b09 [D] Found puppetca at /opt/puppetlabs/bin/puppet
2018-11-29T14:46:02 f9403b09 [D] Found sudo at /usr/bin/sudo
2018-11-29T14:46:02 f9403b09 [D] Executing /usr/bin/sudo -S /opt/puppetlabs/bin/puppet cert --ssldir /etc/puppetlabs/puppet/ssl --list --all
2018-11-29T14:46:02 f9403b09 [W] Failed to run puppetca:
2018-11-29T14:46:02 f9403b09 [E] Failed to list certificates: Execution of puppetca failed, check log files
2018-11-29T14:46:02 f9403b09 [D] Failed to list certificates: Execution of puppetca failed, check log files
2018-11-29T14:46:02 f9403b09 [I] Finished GET with 406 (65.12 ms)

That tells me foreman-proxy didn’t switch to a new command. I can’t find any place to fix it. I also modified /etc/sudoers.d/foreman-proxy file to respect new puppetserver ca command but it didn’t solve the issue:

foreman-proxy ALL = (root) NOPASSWD : /opt/puppetlabs/bin/puppetserver ca *
Defaults:foreman-proxy !requiretty

Thank you very much in advance.


#2

At the moment Puppetserver 6.0 isn’t supported. There is an open PR to use the REST API which I’d recommend to take a look at.


#3

Thank you very much for the response. Do you know by any chance if it is something that will be supported in future foreman releases or no?


#4

That smart-proxy PR is looking in good shape, most of the installer support is there so I hope we can add support in 1.21 which is planned for early next year (early February).


#5

Thank you very much for information and clarification.