[Pkg-puppet-devel] autopkgtest issues in Ubuntu

[Nish Aravamudan]

On 24.02.2017 [12:34:24 -0800], Nish Aravamudan wrote:
> On 24.02.2017 [12:11:55 -0800], Nish Aravamudan wrote:
> > On 24.02.2017 [11:58:29 -0800], Nish Aravamudan wrote:
> > > On 24.02.2017 [11:54:11 -0800], Nish Aravamudan wrote:
> > > > On 24.02.2017 [11:48:45 +0200], Apollon Oikonomopoulos wrote:
> > > > > Hi Nish,
> > > > > 
> > > > > On 13:48 Thu 23 Feb     , Nish Aravamudan wrote:
> > > > > > Ok, so adding ca-certificates did not seem to make any difference (and
> > > > > > in fact, it seems like it is already installed in the Ubuntu autopkgtest
> > > > > > environment so that was a red herring anyways). Any ideas why, e.g.:
> > > > > 
> > > > > Puppet has its own CA system and does not rely on ca-certificates on any 
> > > > > way, so having ca-certificates installed or not should not make a 
> > > > > difference.
> > > > 
> > > > Got it.
> > > > 
> > > > > > https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-zesty-nacc-lp1570472/zesty/amd64/p/puppet/20170223_203421_4dd8e@/log.gz
> > > > > > 
> > > > > > there is no certificate for the hostname by default on Ubuntu but there
> > > > > > is on Debian? I don't see anything in the tests that ensure it exists
> > > > > > and only puppet-master-passenger generates it in a postinst (hence those
> > > > > > tests now pass, but I think it's technically incidental and dependent on
> > > > > > the .postinst's behavior, which might be fine).
> > > > > 
> > > > > The certificate should have been generated by the master process itself 
> > > > > if it does not exist, using Puppet's CA. Could you get the list of files 
> > > > > under /var/lib/puppet/ssl and /var/cache/puppet/ssl at the end of the 
> > > > > test?
> > > > 
> > > > So I just did a quick test in a LXD of 17.04 after installing
> > > > puppet-master and ruby-serverspec.
> > > > 
> > > > # ps aux | grep puppet
> > > > puppet    4421  0.0  0.2 216624 45424 ?        Ssl  19:52   0:00 /usr/bin/ruby /usr/bin/puppet master
> > > > 
> > > > # find /var/lib/puppet/ssl/
> > > > /var/lib/puppet/ssl/
> > > > /var/lib/puppet/ssl/certificate_requests
> > > > /var/lib/puppet/ssl/public_keys
> > > > /var/lib/puppet/ssl/public_keys/oriented-squirrel.lxd.pem
> > > > /var/lib/puppet/ssl/certs
> > > > /var/lib/puppet/ssl/certs/ca.pem
> > > > /var/lib/puppet/ssl/certs/oriented-squirrel.lxd.pem
> > > 
> > > Ah that seems to be the disconnect?
> > > 
> > > # puppet cert print $(hostname --fqdn).lxd
> > > 
> > > *does* work, which seems tied to
> > > 
> > > # puppet master --configprint hostcert
> > > /var/lib/puppet/ssl/certs/mighty-clam.lxd.pem
> > > 
> > > Note that this is all tied to LXD of course, and I can spin up a VM of
> > > Zesty but I expect we might see something similar there?
> > 
> > Ah:
> > 
> > # ruby -e 'require "facter"' -e 'puts Facter.value :domain'
> > lxd
> > 
> > while
> > 
> > # hostname --fqdn
> > mighty-clam
> > 
> > And the tests then disagree with puppet? :)
> 
> So I think the following changes are needed/reasonable for Debian, but
> I'd like some feedback. Also, are there plans to send
> d/p/0005-use-systemd-as-the-default-service-provider.patch upstream? I
> think we'd want to make the same change in Ubuntu there as well.
> 
>   * d/t/spec/puppet-master/install_spec.rb: the default puppet-master
>     certificate uses Facter(:fqdn) not `hostname --fqdn` and they can
>     differ. Specifically, on LXD containers, the former is
>     <containername>.lxd while the latter is <containername>.
>   * d/t/spec/puppet-master-passenger/zz_puppet3_compat_spec.rb: specify
>     to curl that 'puppet' should not be proxied.
> 
> diff -Nru puppet-4.8.2/debian/tests/spec/puppet-master/install_spec.rb puppet-4.8.2/debian/tests/spec/puppet-master/install_spec.rb
> --- puppet-4.8.2/debian/tests/spec/puppet-master/install_spec.rb	2017-02-15 04:23:19.000000000 -0800
> +++ puppet-4.8.2/debian/tests/spec/puppet-master/install_spec.rb	2017-02-24 12:29:14.000000000 -0800
> @@ -1,4 +1,5 @@
>  require 'spec_helper'
> +require 'facter'
>  
>  describe package('puppet-master') do
>    it { should be_installed }
> @@ -13,7 +14,7 @@
>    it { should be_listening.with('tcp') }
>  end
>  
> -describe command('puppet cert print $(hostname --fqdn)') do
> +describe command('puppet cert print #{Facter.value(:fqdn)}') do

Err, with s/'/"/g I think.

Note that while this does affect LXD locally for sure, it also affects
Ubuntu's autopkgtest runners, where I think again Facter disagrees with
hostname; there, Facter states the fqdn is 'autopkgtest.localdomain',
while hostname --fqdn has the actual nova instance's name.

Thanks,
Nish
-- 
Nishanth Aravamudan
Ubuntu Server
Canonical Ltd