[Puppet Users] puppetlabs/java_ks modules and puppet:// uri paths

Discussion:

Juan Sierra Pons

2014-05-20 13:30:01 UTC

Hi,

I am recently using the puppetlabs/java_ks module. The documentation
claims that the module supports puppet:// uri path for certificates:

from https://forge.puppetlabs.com/puppetlabs/java_ks:
"
certificate

An already-signed certificate to place in the keystore. Accepts local
file paths or puppet:// uri paths.
"

I am using the following code:

java_ks {"$hostname-$certificate":
ensure => latest,
certificate => "puppet:///extra_files/certificates/mycert.org.crt",
target => hiera('java::keystore::path'),
password => hiera('java::certificate::password'),
trustcacerts => true,
}

But when I run the command, the following error appears:

Info: Applying configuration version 'd4944df'
Notice: /Stage[main]/Puppet::Agent::Config/Ini_setting[environment]/value:
value changed 'working_hashes' to 'keystore'
Error: Execution of 'keytool -importcert -noprompt -alias
myserver-mycert.org.crt.org.crt -file
/etc/puppet/files/certificates/mycert.org.crt -keystore /home/devops/
.keystore -trustcacerts' returned 1: Enter keystore password:
Re-enter new password: keytool error: java.io.FileNotFoundException:
/etc/puppet/files/certifi
cates/mycert.org.crt (No such file or directory)

It is referencing the path on the puppet client instead of using the
puppet:/// uri to download the certificate:
keytool -importcert -noprompt -alias myserver-mycert.org.crt.org.crt
-file /etc/puppet/files/certificates/mycert.org.crt -keystore
/home/devops/

Any Idea what I am doing wrong?

Best regards

--------------------------------------------------------------------------------------
Juan Sierra Pons ***@elsotanillo.net
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE
--------------------------------------------------------------------------------------

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+***@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/CABS%3Dy9smEYZNWrH82J2n3JEyEa-UFkrKtneVT2v_Yzg%3D4FEohw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Morgan Haskel

2014-05-20 20:55:28 UTC

Permalink

Juan,

Are you exporting extra_files as a mountpoint in fileserver.conf? If not
and extra_files is in a module then the path should be
puppet:///modules/<modulename>/extra_files/certificates/mycert.org.crt

The documentation at
http://docs.puppetlabs.com/guides/file_serving.htmlmight help.

Morgan

Post by Juan Sierra Pons
Hi,
I am recently using the puppetlabs/java_ks module. The documentation
"
certificate
An already-signed certificate to place in the keystore. Accepts local
file paths or puppet:// uri paths.
"
ensure => latest,
certificate => "puppet:///extra_files/certificates/mycert.org.crt",
target => hiera('java::keystore::path'),
password => hiera('java::certificate::password'),
trustcacerts => true,
}
Info: Applying configuration version 'd4944df'
value changed 'working_hashes' to 'keystore'
Error: Execution of 'keytool -importcert -noprompt -alias
myserver-mycert.org.crt.org.crt -file
/etc/puppet/files/certificates/mycert.org.crt -keystore /home/devops/
/etc/puppet/files/certifi
cates/mycert.org.crt (No such file or directory)
It is referencing the path on the puppet client instead of using the
keytool -importcert -noprompt -alias myserver-mycert.org.crt.org.crt
-file /etc/puppet/files/certificates/mycert.org.crt -keystore
/home/devops/
Any Idea what I am doing wrong?
Best regards
--------------------------------------------------------------------------------------
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE
--------------------------------------------------------------------------------------
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CABS%3Dy9smEYZNWrH82J2n3JEyEa-UFkrKtneVT2v_Yzg%3D4FEohw%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
Morgan Haskel
***@puppetlabs.com
Module Engineer

*Join us at PuppetConf 2014, September 23-24 in San Francisco -
http://puppetconf.com <http://puppetconf.com>*

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+***@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/CA%2BFnDv06c8__o%2BwF7pFM8bpSMFdQpRA%3D%3DKFn5H_V3sfSpaf5Eg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Juan Sierra Pons

2014-05-21 06:50:31 UTC

Permalink

Hi Morgan,

Yes, I have configured [extra_files] and it is working ok with other
module. The isue here is that instead of downloading the file
mycert.org.crt and using it while running the local command it
references it as if the certificate were already on the client and
using the [extra_files] actual path (on the puppetmaster)

This is the command (as seen on debug)
keytool -importcert -noprompt -alias myserver-mycert.org.crt.org.crt
-file /etc/puppet/files/certificates/mycert.org.crt -keystore
/home/devops/

/etc/puppet/files/certificates/mycert.org.crt is the actual path but
on the puppetmaster.

BTW: there is an open bug about this:
https://tickets.puppetlabs.com/browse/MODULES-559

Thanks for your time

Best regards
--------------------------------------------------------------------------------------
Juan Sierra Pons ***@elsotanillo.net
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE
--------------------------------------------------------------------------------------

Post by Morgan Haskel
Juan,
Are you exporting extra_files as a mountpoint in fileserver.conf? If not
and extra_files is in a module then the path should be
puppet:///modules/<modulename>/extra_files/certificates/mycert.org.crt
The documentation at http://docs.puppetlabs.com/guides/file_serving.html
might help.
Morgan

Post by Juan Sierra Pons
Hi,
I am recently using the puppetlabs/java_ks module. The documentation
"
certificate
An already-signed certificate to place in the keystore. Accepts local
file paths or puppet:// uri paths.
"
ensure => latest,
certificate => "puppet:///extra_files/certificates/mycert.org.crt",
target => hiera('java::keystore::path'),
password => hiera('java::certificate::password'),
trustcacerts => true,
}
Info: Applying configuration version 'd4944df'
value changed 'working_hashes' to 'keystore'
Error: Execution of 'keytool -importcert -noprompt -alias
myserver-mycert.org.crt.org.crt -file
/etc/puppet/files/certificates/mycert.org.crt -keystore /home/devops/
/etc/puppet/files/certifi
cates/mycert.org.crt (No such file or directory)
It is referencing the path on the puppet client instead of using the
keytool -importcert -noprompt -alias myserver-mycert.org.crt.org.crt
-file /etc/puppet/files/certificates/mycert.org.crt -keystore
/home/devops/
Any Idea what I am doing wrong?
Best regards
--------------------------------------------------------------------------------------
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE
--------------------------------------------------------------------------------------
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CABS%3Dy9smEYZNWrH82J2n3JEyEa-UFkrKtneVT2v_Yzg%3D4FEohw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
Morgan Haskel
Module Engineer
Join us at PuppetConf 2014, September 23-24 in San Francisco -
http://puppetconf.com
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CA%2BFnDv06c8__o%2BwF7pFM8bpSMFdQpRA%3D%3DKFn5H_V3sfSpaf5Eg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+***@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/CABS%3Dy9scS4kfoun-31Xy4kofiOsYQBK8UWsqqKUUhtgPYMdOpw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Morgan Haskel

2014-05-22 18:26:55 UTC

Permalink

Juan,

We're looking into this ticket.

Morgan

Post by Juan Sierra Pons
Hi Morgan,
Yes, I have configured [extra_files] and it is working ok with other
module. The isue here is that instead of downloading the file
mycert.org.crt and using it while running the local command it
references it as if the certificate were already on the client and
using the [extra_files] actual path (on the puppetmaster)
This is the command (as seen on debug)
keytool -importcert -noprompt -alias myserver-mycert.org.crt.org.crt
-file /etc/puppet/files/certificates/mycert.org.crt -keystore
/home/devops/
/etc/puppet/files/certificates/mycert.org.crt is the actual path but
on the puppetmaster.
https://tickets.puppetlabs.com/browse/MODULES-559
Thanks for your time
Best regards
--------------------------------------------------------------------------------------
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE
--------------------------------------------------------------------------------------

"puppet:///extra_files/certificates/mycert.org.crt",

Post by Morgan Haskel

Post by Juan Sierra Pons
target => hiera('java::keystore::path'),
password => hiera('java::certificate::password'),
trustcacerts => true,
}
Info: Applying configuration version 'd4944df'
value changed 'working_hashes' to 'keystore'
Error: Execution of 'keytool -importcert -noprompt -alias
myserver-mycert.org.crt.org.crt -file
/etc/puppet/files/certificates/mycert.org.crt -keystore /home/devops/
/etc/puppet/files/certifi
cates/mycert.org.crt (No such file or directory)
It is referencing the path on the puppet client instead of using the
keytool -importcert -noprompt -alias myserver-mycert.org.crt.org.crt
-file /etc/puppet/files/certificates/mycert.org.crt -keystore
/home/devops/
Any Idea what I am doing wrong?
Best regards

--------------------------------------------------------------------------------------

Post by Morgan Haskel

Post by Juan Sierra Pons
Linux User Registered: #257202
Web: http://www.elsotanillo.net Git: http://www.github.com/juasiepo
GPG key = 0xA110F4FE
Key Fingerprint = DF53 7415 0936 244E 9B00 6E66 E934 3406 A110 F4FE

--------------------------------------------------------------------------------------

Post by Morgan Haskel

Post by Juan Sierra Pons
--
You received this message because you are subscribed to the Google

Groups

Post by Morgan Haskel

Post by Juan Sierra Pons
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send

Post by Morgan Haskel

Post by Juan Sierra Pons
To view this discussion on the web visit

https://groups.google.com/d/msgid/puppet-users/CABS%3Dy9smEYZNWrH82J2n3JEyEa-UFkrKtneVT2v_Yzg%3D4FEohw%40mail.gmail.com
.

Post by Morgan Haskel

Post by Juan Sierra Pons
For more options, visit https://groups.google.com/d/optout.

https://groups.google.com/d/msgid/puppet-users/CA%2BFnDv06c8__o%2BwF7pFM8bpSMFdQpRA%3D%3DKFn5H_V3sfSpaf5Eg%40mail.gmail.com
.

Post by Morgan Haskel
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CABS%3Dy9scS4kfoun-31Xy4kofiOsYQBK8UWsqqKUUhtgPYMdOpw%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
Morgan Haskel
***@puppetlabs.com
Module Engineer

*Join us at PuppetConf 2014, September 23-24 in San Francisco -
http://puppetconf.com <http://puppetconf.com>*

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+***@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/CA%2BFnDv34E_y6yvvS7iEdHcRonarpAwM9BKcUa-o0%3DbZcpDZ45Q%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.