[Pkg-puppet-devel] autopkgtest issues in Ubuntu

[Nish Aravamudan]

On 24.02.2017 [11:58:29 -0800], Nish Aravamudan wrote:
> On 24.02.2017 [11:54:11 -0800], Nish Aravamudan wrote:
> > On 24.02.2017 [11:48:45 +0200], Apollon Oikonomopoulos wrote:
> > > Hi Nish,
> > > 
> > > On 13:48 Thu 23 Feb     , Nish Aravamudan wrote:
> > > > Ok, so adding ca-certificates did not seem to make any difference (and
> > > > in fact, it seems like it is already installed in the Ubuntu autopkgtest
> > > > environment so that was a red herring anyways). Any ideas why, e.g.:
> > > 
> > > Puppet has its own CA system and does not rely on ca-certificates on any 
> > > way, so having ca-certificates installed or not should not make a 
> > > difference.
> > 
> > Got it.
> > 
> > > > https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty-nacc-lp1570472/zesty/amd64/p/puppet/20170223_203421_4dd8e@/log.gz
> > > > 
> > > > there is no certificate for the hostname by default on Ubuntu but there
> > > > is on Debian? I don't see anything in the tests that ensure it exists
> > > > and only puppet-master-passenger generates it in a postinst (hence those
> > > > tests now pass, but I think it's technically incidental and dependent on
> > > > the .postinst's behavior, which might be fine).
> > > 
> > > The certificate should have been generated by the master process itself 
> > > if it does not exist, using Puppet's CA. Could you get the list of files 
> > > under /var/lib/puppet/ssl and /var/cache/puppet/ssl at the end of the 
> > > test?
> > 
> > So I just did a quick test in a LXD of 17.04 after installing
> > puppet-master and ruby-serverspec.
> > 
> > # ps aux | grep puppet
> > puppet    4421  0.0  0.2 216624 45424 ?        Ssl  19:52   0:00 /usr/bin/ruby /usr/bin/puppet master
> > 
> > # find /var/lib/puppet/ssl/
> > /var/lib/puppet/ssl/
> > /var/lib/puppet/ssl/certificate_requests
> > /var/lib/puppet/ssl/public_keys
> > /var/lib/puppet/ssl/public_keys/oriented-squirrel.lxd.pem
> > /var/lib/puppet/ssl/certs
> > /var/lib/puppet/ssl/certs/ca.pem
> > /var/lib/puppet/ssl/certs/oriented-squirrel.lxd.pem
> 
> Ah that seems to be the disconnect?
> 
> # puppet cert print $(hostname --fqdn).lxd
> 
> *does* work, which seems tied to
> 
> # puppet master --configprint hostcert
> /var/lib/puppet/ssl/certs/mighty-clam.lxd.pem
> 
> Note that this is all tied to LXD of course, and I can spin up a VM of
> Zesty but I expect we might see something similar there?

Ah:

# ruby -e 'require "facter"' -e 'puts Facter.value :domain'
lxd

while

# hostname --fqdn
mighty-clam

And the tests then disagree with puppet? :)

-- 
Nishanth Aravamudan
Ubuntu Server
Canonical Ltd