Closed linuxmail closed 1 year ago
hi,
I tried to add debug .. and added to ./lib/puppet_x/consul/acl_base.rb
module PuppetX::Consul::ACLBase
class BaseClient
def initialize(hostname, port, protocol, api_token = nil)
@global_uri = URI("#{protocol}://#{hostname}:#{port}/v1/acl")
@http_client = Net::HTTP.new(@global_uri.host, @global_uri.port)
@http_client.use_ssl = true if @global_uri.instance_of? URI::HTTPS
@api_token = api_token
puts @global_uri
end
...
to see, what is called .. and the printed URL is correct .. than I tried to use the Ruby from Puppet ..
require "net/https"
require "uri"
uri = URI.parse("https://linode-ffm-hashi-server-01.sandbox.example.com:8501/v1/acl")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
puts response.body
and the output:
Traceback (most recent call last):
6: from /root/test.ry:11:in `<main>'
5: from /opt/puppetlabs/puppet/lib/ruby/2.5.0/net/http.rb:1458:in `request'
4: from /opt/puppetlabs/puppet/lib/ruby/2.5.0/net/http.rb:909:in `start'
3: from /opt/puppetlabs/puppet/lib/ruby/2.5.0/net/http.rb:920:in `do_start'
2: from /opt/puppetlabs/puppet/lib/ruby/2.5.0/net/http.rb:985:in `connect'
1: from /opt/puppetlabs/puppet/lib/ruby/2.5.0/net/protocol.rb:44:in `ssl_socket_connect'
/opt/puppetlabs/puppet/lib/ruby/2.5.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate) (OpenSSL::SSL::SSLError)
which is exactly the same .. I get with Puppet :-)
Consul config has:
"ca_file": "/etc/ssl/acme/fullchain.pem",
"cert_file": "/etc/ssl/acme/fullchain.pem",
"key_file": "/etc/ssl/acme/privkey.pem"
after playing a lot .. and searching .. I've found the root cause: Puppet 6 on Debian brings
/opt/puppetlabs/puppet/bin/ruby -v
ruby 2.5.9p229 (2021-04-05 revision 67939) [x86_64-linux]
So, I've upgraded to Puppet7
root@linode-ffm-hashi-server-01:[/etc/apt/sources.list.d]: /opt/puppetlabs/puppet/bin/ruby -v
ruby 2.7.7p221 (2022-11-24 revision 168ec2b1e5) [x86_64-linux]
and ...
root@linode-ffm-hashi-server-01:[/etc/apt/sources.list.d]: /opt/puppetlabs/puppet/bin/ruby /root/test.ry
Invalid URL path: not a recognized HTTP API endpoint
Success !
Now, also Puppet runs fine and does not drop anymore issues.
Upgrading from Puppet6 to Puppet7 fixed the issue with LetsEncrypt certificates.
Affected Puppet, Ruby, OS and module versions/distributions
How to reproduce (e.g Puppet code you use)
What are you seeing
extra
I have no idea .. what is missing ..
It works on other places .. but the only diff is .. that I have here two network interfaces with different IPs. (public / private) ... I have no idea anymore .. where to search.
any suggestions ?
cu denny