graduway / psick Goto Github PK

On our web server, following error:

C:\Windows\system32>puppet agent -t
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Serve
r Error: Evaluation Error: Error while evaluating a Function Call, Could not fin
d class ::iis for win-rpbf6jnggr7.sandbox.graduway.com (file: /etc/puppetlabs/co
de/environments/production/modules/psick/manifests/iis.pp, line: 35, column: 3)
on node win-rpbf6jnggr7.sandbox.graduway.com
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

C:\Windows\system32>

@shapi78 Do you know what this is, have you seen it before? If not, perhaps we should involve @alvagante . Our PSICK is pretty out of date, but I would have expected this to work...

When using multiple environment its quite confusing which user belong to which environment

I've currently done it manually, please add it to Puppet.

• Xunit
• Monitoring
• Rocket.Chat

Using userdata / terraform as discussed.

https://github.com/voxpupuli/hiera-eyaml for the docs.

puppet cannot create config file on jenkins-dev

I have moved the Jenkins pipelines to pull the code from git, rather than storing the code in the job(s).

The Jenkins master needs to use the new ssh key system to access the git repos. I stopped Puppet on it, so you can use ~jenkins/.ssh/config as an example of what it should look like. Also note both frontend and web keys need to be there, correctly named. (I copied them manually on the server.)

After installing nodejs choco install -y nodejs-lts, the frontend build still fails because the slave process has the old %PATH%. What's a reasonable solution? I thought about rebooting the slave after chocolatey finishes?

Or is this a problem only because Puppet isn't finishing its run at the moment?

Jenkins ec2 cloud agent configuration is lost while restoring ec2-configuration from scm plugin

Talk to @nsof about how many to keep, whether to do it by number of builds, time, or both. We can always rebuild from old commits if there's a meaningful need.

• Jenkins slave should be identical to the Windows web server

• msbuild and msdeploy plugin should be installed on the Jenkins master

I guess this could be an upstream bug, but not sure so opening here. Seen on a fresh Jenkins master, on the second run of puppet apply --test.

Error: Could not set 'present' on ensure: No such file or directory @ dir_s_mkdir - /var/lib/jenkins/.ssh/config20171201-4385-1o185ut.lock at /etc/puppetlabs/code/environments/production/modules/psick/manifests/openssh/config.pp:68
Error: Could not set 'present' on ensure: No such file or directory @ dir_s_mkdir - /var/lib/jenkins/.ssh/config20171201-4385-1o185ut.lock at /etc/puppetlabs/code/environments/production/modules/psick/manifests/openssh/config.pp:68
Wrapped exception:
No such file or directory @ dir_s_mkdir - /var/lib/jenkins/.ssh/config20171201-4385-1o185ut.lock
Error: /Stage[main]/Psick::Jenkins/Psick::Openssh::Config[jenkins]/File[/var/lib/jenkins/.ssh/config]/ensure: change from 'absent' to 'present' failed: Could not set 'present' on ensure: No such file or directory @ dir_s_mkdir - /var/lib/jenkins/.ssh/config20171201-4385-1o185ut.lock at /etc/puppetlabs/code/environments/production/modules/psick/manifests/openssh/config.pp:68

This then causes:
(/Stage[main]/Psick::Jenkins::Tp/Tp::Install[jenkins]/Service[jenkins]) Dependency File[/var/lib/jenkins/.ssh/config] has failures: true
(/Stage[main]/Psick::Jenkins::Tp/Tp::Install[jenkins]/Service[jenkins]) Skipping because of failed dependencies
(/Stage[main]/Psick::Jenkins::Scm_sync/Exec[trigger_jenkins_scm_sync]) Dependency File[/var/lib/jenkins/.ssh/config] has failures: true
(/Stage[main]/Psick::Jenkins::Scm_sync/Exec[trigger_jenkins_scm_sync]) Skipping because of failed dependencies
(/Stage[main]/Psick::Jenkins::Scm_sync/Exec[jenkins_reload]) Dependency File[/var/lib/jenkins/.ssh/config] has failures: true
(/Stage[main]/Psick::Jenkins::Scm_sync/Exec[jenkins_reload]) Skipping because of failed dependencies

Running puppet apply --test again didn't help.

Currently, it doesn't.

@shapi78 I shared a document with you. Starting inspiration topic: How to encrypt ssh keys in hiera...

I did it manually, but what needs to be done is setting the Default Web Site physical path to %SystemDrive%\inetpub\wwwroot\dist (basically adding \dist to the end).

EDIT: Don't do this yet, it breaks other things in there. Perhaps DWS should be left at the normal path, I'll write down my findings and come back with a fresh brain.

@shapi78 Where is the code that configures IIS, is it still on a branch somewhere?

Fix git on Windows without using knownhost file workaround

1. Create hiera eyaml keys per environment
2. Save eyaml keys in dedicated bucket per environment
3. Fix TF code for puppet to use it

Add db-bootstrap SSH keys to Jenkins

remove the following lines from every ssh-config files:
StrictHostKeyChecking false
UserKnownHostsFile /dev/null

Use 2FA or username / password.

Currently, I can't get into the VPN server. All Linux servers should use the same master SSH key. (Perhaps this should not be mine, but a new one should be generated.)

Won't be necessary in long run, was just added in the short-term.

puppet.conf should point to the puppet server in the client environment

Consult with @alvagante , we need to handle the hieradata moving outside.

This would make life really easy e.g. in a Jenkins pipeline. Let's say the pattern is something like $EC2_TAG_Env for a tag named Env. @alvagante @shapi78 What do you think is the best way to make this happen?

Jenkins plugin configuration (mainly ec2-plugin) did not restore while installing Jenkins with puppet

Every environment has its own IP CIDR, VPN routing should reflect it

Replace client 1/2/3 with reasonable client names

There's a module for it.

Generate Jenkins ssh-key pairs configuration for ci-control and web-deploy

OpenVPN Server should be configured per environment

In preparation for move to terraform. * Note this is only for graduway.com domain. *

• Add Route 53 zone data to terraform with relevant aws_* directives.
• Use dns-compare after importing zone to Route 53, before we change the main nameservers.
• Change the main nameservers at an agreed time.

As discussed.

I didn't tell Pipeline what to do and it seems to work, so chances are we don't need Win-Git config.

At first, we make the build slave the same as a fully-fledged web server. Chances are it can be much lighter.

Have the commands ready. Waiting for correction of outDir.

It should just route traffic destined for the destination IP address. This link may help.

Reproduce:

• Connect to VPN.
• Go to https://www.whoismyisp.org/ in a browser.

@alvagante @shapi78 Who should fix this?

Puppet master certificate should include its FQDN per environment

Also deliver credentials to team. This can be by USB stick for starters. Also document VPN installation process (most developers use Windows).

Jenkins startup wizard still running after using PSICK module, we need to disable it after first run

Expected Behavior

On common.yaml:
psick::pre::linux_classes:

Please disable:
hostname: '::psick::hostname'
hosts: '::psick::hosts::resource'
dns: '::psick::dns::resolver'

Actual Behavior

While new agent starts these modules affect the connections to to the puppet master
we can leave route53 to handle dns resolving and cloud-init to set hostname and handle host file

Both run it and Jenkins scan.

• msbuild/msdeploy plugin

• Git plugin

I just checked on the Jenkins master, it's not installed. All machines should be synchronizing time.

And change name from Jenkins-Slave to jenkins-slave.

Currently they are generated afresh for every new Puppet server. It might make sense to explore persisting them, so users don't get annoyed when environments come up and down.

Plugin pipeline-utility-steps-plugin is missing on Jenkins
Pipeline failed to run