@Andrew Do you anticipate any issues if we set profile::puppetserver::autosign to true (or something) in the deployment-prep project? profile::puppetserver::autosign was mentioned in T421244#11847986.

Change #1302978 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):

[operations/puppet@production] modules/profile/files/puppet/bin: cleanup puppet SSL on CA server mismatch

https://gerrit.wikimedia.org/r/1302978

In T429413#12027023, @dancy wrote:

@Andrew Do you anticipate any issues if we set profile::puppetserver::autosign to true (or something) in the deployment-prep project? profile::puppetserver::autosign was mentioned in T421244#11847986.

That should be fine. You'll still have to do part of the dance to clear out the old certs on clients unfortunately.

Mentioned in SAL (#wikimedia-releng) [2026-06-24T17:26:18Z] <dancy> Set profile::puppetserver::autosign: /usr/local/sbin/validatecloudvpsfqdn.py in hiera config for deployment-puppetserver prefix (T429413)

In T429413#12033569, @Andrew wrote:

In T429413#12027023, @dancy wrote:

@Andrew Do you anticipate any issues if we set profile::puppetserver::autosign to true (or something) in the deployment-prep project? profile::puppetserver::autosign was mentioned in T421244#11847986.

That should be fine. You'll still have to do part of the dance to clear out the old certs on clients unfortunately.

This is handled by https://gerrit.wikimedia.org/r/c/operations/puppet/+/1302978 which has been tested successfully in deployment-prep.

TODO: Update https://wikitech.wikimedia.org/wiki/Help:Project_puppetserver after https://gerrit.wikimedia.org/r/c/operations/puppet/+/1302978 is merged.

Change #1302978 merged by Andrew Bogott:

[operations/puppet@production] modules/profile/files/puppet/bin: cleanup puppet SSL on CA server change

https://gerrit.wikimedia.org/r/1302978

In T429413#12066960, @dancy wrote:

TODO: Update https://wikitech.wikimedia.org/wiki/Help:Project_puppetserver after https://gerrit.wikimedia.org/r/c/operations/puppet/+/1302978 is merged.

This is done.

In T429413#12067672, @dancy wrote:

Resolved by setting profile::puppetserver::autosign: /usr/local/sbin/validatecloudvpsfqdn.py in deployment-puppetserver Prefix Puppet Hiera Config. Noting that https://wikitech.wikimedia.org/wiki/Help:Project_puppetserver#Autosigning discourages the use of autosigning if there are local secrets in puppet, which there are in deployment-prep. It would be nice to address this in some way in the future (for example by allowing the puppetserver to be informed about newly created VMs so it can be more selective about what names it will autosign for).

One possible improvement here could be a replacement/config for validatecloudvpsfqdn.py that validates that the host FQDN is associated with the same Cloud VPS project as the puppetserver. The current script use the OpenStack APIs to verify that the FQDN is associated with any Cloud VPS project, but not a specific project. I think that pinning the validated project is functionally what @dancy said as "allowing the puppetserver to be informed about newly created VMs".

Change #1306745 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):

[operations/puppet@production] profile::puppet::agent: write pinned CA cert with a trailing newline

https://gerrit.wikimedia.org/r/1306745

Change #1307202 had a related patch set uploaded (by Ahmon Dancy; author: Ahmon Dancy):

[operations/puppet@production] profile::base::certificates: drop unused puppet_ca_content CA-swap support

https://gerrit.wikimedia.org/r/1307202

Change #1306745 merged by RLazarus:

[operations/puppet@production] profile::puppet::agent: write pinned CA cert with a trailing newline

https://gerrit.wikimedia.org/r/1306745