Skip to content

Commit b49d084

Browse files
committed
Prevents spurious clientcert warnings in serverless mode
When there are no clientcerts, Puppet will warn when it creates an `SSLContext` for HTTPS operations. This situation occurs when you run entirely serverless and never generate clientcerts. It's spurious in that case, so we don't actually need to warn about it. This behaviour was added in 3f7f830 so that the new HTTP client could download files via HTTPS from the puppetserver (for example, the way that pe_repo) works. To prevent this being a failure when running `puppet apply` in serverless mode, it explicitly marks the clientcerts as optional in https://github.com/OpenVoxProject/puppet/blob/06bc441333c640678c9adb26412c6cb923af7f6b/lib/puppet/ssl/ssl_provider.rb#L98 and https://github.com/OpenVoxProject/puppet/blob/06bc441333c640678c9adb26412c6cb923af7f6b/lib/puppet/ssl/ssl_provider.rb#L103 This goes one step further and sets the output to `INFO` rather than `WARN` when running `puppet apply`. This does have one small edge case. If, 1. You intend to run a standard server/agent setup, and 2. Before ever running `puppet agent -t` you run `puppet apply` for provisioning purposes, and 3. Part of that Puppet run attempts to download a file from the puppetserver Then you will get a certificate validation error and the HTTPS request will fail silently with only an `INFO` message as a hint explaining why. To fix it, you obviously just generate and sign the clientcerts. I think this is an acceptable tradeoff, but would like other opinions. This will need specs before merging. Fixes #21
1 parent 06bc441 commit b49d084

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

lib/puppet/ssl/ssl_provider.rb

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,12 +97,14 @@ def create_system_context(cacerts:, path: Puppet[:ssl_trust_store], include_clie
9797
cert_provider = Puppet::X509::CertProvider.new
9898
private_key = cert_provider.load_private_key(Puppet[:certname], required: false)
9999
unless private_key
100-
Puppet.warning("Private key for '#{Puppet[:certname]}' does not exist")
100+
msg = "Private key for '#{Puppet[:certname]}' does not exist"
101+
Puppet.run_mode.name == :user ? Puppet.info(msg) : Puppet.warning(msg)
101102
end
102103

103104
client_cert = cert_provider.load_client_cert(Puppet[:certname], required: false)
104105
unless client_cert
105-
Puppet.warning("Client certificate for '#{Puppet[:certname]}' does not exist")
106+
msg "Client certificate for '#{Puppet[:certname]}' does not exist"
107+
Puppet.run_mode.name == :user ? Puppet.info(msg) : Puppet.warning(msg)
106108
end
107109

108110
if private_key && client_cert

0 commit comments

Comments
 (0)