Trouble getting ENC data from external puppet server to foreman 3.5


I can’t get puppet facts from a external puppet server to foreman using the node.rb.
I’m obviously missing some necessary component(s) on foreman, but I don’t know what exactly or how to install them correctly.

Here are my attempts so far:

  • Deployed a new foreman+katello 3.5.1 instance on el8 with default options on foreman-installer.
    (foreman-installer --scenario katello)

  • Configured the external puppet server and foreman.yaml for node.rb accordingly. Fixed couple of ssl verification issues.

  • When running the node.rb I get error messages in the foreman production.log about no route matching /node/[hostfqdn]. Another problem is that despite having “:fact_extension: json” in foreman.yaml, node.rb still complains about not being able to open per-agent yaml-files since my puppet7 writes json-files instead. But the bigger problem is the missing /node functionality on my foreman instance.

  • Realized that foreman /node functionality comes with rubygem-foreman_puppet package, which hasn’t been installed.

  • Installed said package with yum, restarted foreman, foreman fails to start. Error message is about UndefinedTable and relation “environments” not existing. Removed package, restarted foreman, foreman works. Guessing the missing environments are related to the fact that I also no longer have any puppet context in the configure menu of the new foreman deployment either. Also guessing the rubygem-foreman_puppet needs to be installed in some different way.

  • Tried rerunning foreman-installer with --enable-puppet (also updated from 3.5.1 → 3.5.2), but the results of the above attempts are still the same regardless.

Expected outcome:

  • Foreman instance having the /node tree accessible via https while still not thinking it’s the puppet server for our environment.
  • node.rb using json instead of yaml

Foreman and Proxy versions:
Currently 3.5.2, originally tested with 3.5.1.
Standalone puppet server is 7.9.5-1

Foreman and Proxy plugin versions:
foreman-tasks 7.1.1
foreman_remote_execution 8.2.0
katello 4.7.3

Distribution and version:
Oracle Linux 8.7

Other relevant data:

The puppet server is actually running on the same host as foreman. It’s just installed separately.

node.rb results:

# sudo -u puppet /etc/puppetlabs/puppet/node.rb myhost-fqdn
Serving cached ENC: Error retrieving node myhost-fqdn: Net::HTTPNotFound
Check Foreman's /var/log/foreman/production.log for more information.
Unable to read from Cache file: No such file or directory @ rb_sysopen - /opt/puppetlabs/server/data/puppetserver/yaml/foreman/myhost-fqdn.yaml

production log on /node access:

 791d269c | ActionController::RoutingError (No route matches [GET] "/node/myhost-fqdn"):
 791d269c |   
 791d269c | lib/foreman/middleware/logging_context_request.rb:11:in `call'
 791d269c | katello (4.7.3) lib/katello/prevent_json_parsing.rb:12:in `call'

production log on startup with rubygem-foreman_puppet installed with yum:

2023-03-15T13:39:11 [W|app|] ForemanPuppet: skipping engine hook (PG::UndefinedTable: ERROR:  relation "environments" does not exist
 | LINE 8:  WHERE a.attrelid = '"environments"'::regclass
 |                             ^
 | )

To enable the puppet module/integration it’s best to refer to the docs Configuring Hosts Using Puppet

Unfortunately that documentation only says “Additionally, you can deploy Puppet server to Foreman externally and integrate it with Foreman for reporting, facts, and external node classification (ENC).” and doesn’t go into specifics more than that.

I’m trying to have a completely separate external puppet server that only talks to foreman when exporting the ENC data. I do not want it to be part of the Foreman instance or part of a Foreman smart-proxy. Whether this is even possible, I’m not 100% sure, but on the other hand I don’t see any technical reason why it couldn’t be.