Page MenuHomePhabricator

puppet: compiler-update-facts error and warning
Closed, ResolvedPublic

Description

I found this error today when using compiler-update-facts in my laptop to refresh puppet catalog compiler facts:

$ PUPPET_COMPILER=compiler1001.puppet-diffs.eqiad.wmflabs PUPPET_MASTERS=puppetmaster1002.eqiad.wmnet modules/puppet_compiler/files/compiler-update-facts

### Syncing facts from puppetmaster1002.eqiad.wmnet
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 308, in ssl_wrap_socket
    context.load_verify_locations(ca_certs, ca_cert_dir)
FileNotFoundError: [Errno 2] No such file or directory

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 423, in send
    timeout=timeout
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 350, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 837, in _validate_conn
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 323, in connect
    ssl_context=context)
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 310, in ssl_wrap_socket
    raise SSLError(e)
requests.packages.urllib3.exceptions.SSLError: [Errno 2] No such file or directory

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/puppet-facts-export", line 67, in <module>
    main()
  File "/usr/local/bin/puppet-facts-export", line 42, in main
    for node in pdb.get('nodes'):
  File "/usr/local/bin/puppet-facts-export", line 26, in get
    return requests.get(self.url_for(endpoint), verify=cacert).json()
  File "/usr/lib/python3/dist-packages/requests/api.py", line 70, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/api.py", line 56, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 488, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 609, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 497, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 2] No such file or directory

Additionally, I saw this warning when using a different puppetmaster:

$ PUPPET_COMPILER=compiler1001.puppet-diffs.eqiad.wmflabs modules/puppet_compiler/files/compiler-update-facts

### Syncing facts from puppetmaster1001.eqiad.wmnet
/usr/lib/python3/dist-packages/urllib3/connection.py:337: SubjectAltNameWarning: Certificate for puppetdb1001.eqiad.wmnet has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
  SubjectAltNameWarning

(this time the facts were updated I believe)

Event Timeline

aborrero renamed this task from puppet: compiler-update-facts error to puppet: compiler-update-facts error and warning.Jan 23 2019, 10:50 AM
aborrero updated the task description. (Show Details)
aborrero updated the task description. (Show Details)
jijiki triaged this task as Medium priority.Feb 7 2019, 12:57 PM
jijiki added a subscriber: jbond.

Change 549857 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] puppet-export-facts: use the certificate provided by localcacert

https://gerrit.wikimedia.org/r/549857

@aborrero The current script references a file which is only avalible in the CA directory and therefore only available on the puppet master front end servers. I have created a CR to update this to use the localcacert location. I have also disabled the urllib warning

Thanks for working on this! +1 to your patch.
Anyway, I ran the script the other day and I found no issues.

Feel free to close this task when appropriate.

Change 549857 merged by Jbond:
[operations/puppet@production] puppet-export-facts: use the certificate provided by localcacert

https://gerrit.wikimedia.org/r/549857

jbond claimed this task.