Page MenuHomePhabricator

ensure additional puppetmaster files are managed by puppet
Closed, ResolvedPublic

Description

During the recent re image of puppetmaster2001 it was noticed that the following files where not present

  • /srv/config-master/puppet-sha1.txt (broke puppet-merge)
  • /var/lib/puppet/server/ssl/certs/ca.pem (prevented apache starting)

Event Timeline

/srv/config-master/puppet-sha1.txt should not be writable by gitpuppet

Change 540126 had a related patch set uploaded (by CDanis; owner: CDanis):
[operations/puppet@production] config-master: ensure perms on puppet-merge sha files

https://gerrit.wikimedia.org/r/540126

Change 540126 merged by CDanis:
[operations/puppet@production] config-master: ensure perms on puppet-merge sha files

https://gerrit.wikimedia.org/r/540126

thanks chris but i still need to explore /var/lib/puppet/server/ssl/certs/ca.pem

jbond triaged this task as Medium priority.Oct 2 2019, 3:35 PM

Change 542954 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] profile::pupetmaster::frontend: manage ca.pem used in apache config

https://gerrit.wikimedia.org/r/542954

Change 542954 merged by Jbond:
[operations/puppet@production] profile::pupetmaster::frontend: manage ca.pem used in apache config

https://gerrit.wikimedia.org/r/542954

re-open as the previous change didn't take into account wmcs

Mentioned in SAL (#wikimedia-cloud) [2019-10-17T14:30:23Z] <jeh> cleaning up failed nova fullstack vms related to puppet ca T234332

Change 545575 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] puppetmnasters: use localcacert setting for CA file in apache

https://gerrit.wikimedia.org/r/545575

Change 549450 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] profile::base::puppet: move the puppetca to a global variable

https://gerrit.wikimedia.org/r/549450

Change 549451 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] profile::puppetmaster: update to allow managing the CA file

https://gerrit.wikimedia.org/r/549451

Change 549450 merged by Jbond:
[operations/puppet@production] profile::base::puppet: move the puppetca to a global variable

https://gerrit.wikimedia.org/r/549450

Change 549451 merged by Jbond:
[operations/puppet@production] profile::puppetmaster: update to allow managing the CA file

https://gerrit.wikimedia.org/r/549451

Change 545575 merged by Jbond:
[operations/puppet@production] puppetmnasters: use localcacert setting for CA file in apache

https://gerrit.wikimedia.org/r/545575