From 251f8b86e347e23ab4df630ced361bd65924879a Mon Sep 17 00:00:00 2001 From: Iristyle Date: Wed, 24 Apr 2019 15:55:29 -0700 Subject: [PATCH] (maint) Add puppetserver alias puppet.local - Remove the domain introspection / setting of AZURE_DOMAIN env var as this does not work as originally thought. Instead, hardcode the DNS suffix `.local` to each service in the compose stack, and make sure that `dns_search` for `.local` will use the Docker DNS resolver when dealing with these hosts. Note that these compose file settings only affect the configuration of the DNS resolver, *not* resolv.conf. This is different from the docker run behavior, which *does* modify resolv.conf. Also note, config file locations vary depending on whether or not systemd is running in the container. It's not "safe" to refer to services in the cluster by only their short service names like `puppet`, `puppetdb` or `postgres` as they can conflict with hosts on the external network with these names. When docker compose creates the user defined network, it copies the DNS settings from the host to the `resolv.conf` in each of the containers. When network resolutions happen, any default search suffix will be applied to short names when the dns option for ndots is not set to 0. So for instance, given a `resolv.conf` that contains: search delivery.puppetlabs.net A DNS request for `puppet` becomes `puppet.delivery.puppetlabs.net` which will fail to resolve in the Docker DNS resolver, then be sent to the next DNS server in the `nameserver` list. While it is possible to try and service requests for an external domain like `delivery.puppetlabs.net`, it's better to instead choose a domain suffix to use inside the cluster. There are some good details on how various network types configure: https://github.com/docker/for-linux/issues/488#issuecomment-438830363 - Note that the .local domain is typically not recommended for production given the only IANA reserved domains are .example, .test, .invalid or .localhost. However, given the DNS resolver is set to own the resolution of .local, this is a compromise. In production its recommended to use a subdomain of a domain that you own, but that's not yet configurable in this compose file. - Another workaround for this problem would be to set the ndots option in resolv.conf to 0 per the documentation at http://man7.org/linux/man-pages/man5/resolv.conf.5.html However that can't be done for two reasons: - docker-compose schema doesn't actually support setting DNS options https://github.com/docker/cli/issues/1557 - k8s sets ndots to 5 by default, so we don't want to be at odds - A further, but implausible workaround would be to modify the host DNS settings to remove any search suffixes. - The original FQDN change being reverted in this commit was introduced in 2549f1970b23d890baa3cfe1fc8eb5b3e6de67d8 " Lastly, the Windows specific docker-compose.windows.yml sets up a custom alias in the "default" network so that an extra DNS name for puppetserver can be set based on the FQDN that Facter determines. Without this additional DNS reservation, the `puppetserver ca` command will be unable to connect to the REST endpoint. A better long-term solution is making sure puppetserver is setup to point to `puppet` as the host instead of an FQDN. " With the PUPPETSERVER_HOSTNAME value set on the puppetserver container, both certname and server are set to puppet.local, preventing a need to synchronize a domain name. - Note that at this time there is also a discrepancy in how Facter 3 behaves vs Facter 2. The Facter 2 gem is being used by the `puppetserver ca` gem based application, and may return a different value for Facter.value('domain') than calling `facter domain` at the command line. Such is the case inside the puppet network, where Facter 2 returns `ops.puppetlabs.net` while Facter 3 returns the value `delivery.puppetlabs.net` This discrepancy makes it so that the `puppetserver ca` application cannot find the client side cert on disk and fails outright. Facter 2 should not be included in the puppetserver packages, so work is ongoing to extricate it. For now, setting the `puppet.conf` values explicitly to the desired DNS name works around this problem as well. --- azure-pipelines.yml | 4 ---- docker-compose.yml | 29 ++++++++++++++++++++++------- gem/lib/pupperware/spec_helper.rb | 12 +++++------- spec/dockerfile_spec.rb | 4 +++- 4 files changed, 30 insertions(+), 19 deletions(-) diff --git a/azure-pipelines.yml b/azure-pipelines.yml index 9bae94ec..8a2971a5 100644 --- a/azure-pipelines.yml +++ b/azure-pipelines.yml @@ -65,12 +65,8 @@ steps: name: test_prepare - powershell: | - $domain = Get-WmiObject -Class Win32_NetworkAdapterConfiguration | - Select -ExpandProperty DNSDomain | - Select -First 1 Write-Host 'Writing compose config to disk' $content = @" - AZURE_DOMAIN=$domain VOLUME_ROOT=$ENV:TempVolumeRoot "@ $Utf8NoBomEncoding = New-Object System.Text.UTF8Encoding $False diff --git a/docker-compose.yml b/docker-compose.yml index 392f1597..ec0f38b0 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,26 +2,30 @@ version: '3' services: puppet: - hostname: puppet + hostname: puppet.local image: puppet/puppetserver ports: - 8140:8140 environment: + # necessary to set certname and server in puppet.conf, required by + # puppetserver ca cli application + - PUPPETSERVER_HOSTNAME=puppet.local # DNS_ALT_NAMES must be set before starting the stack the first time, # and must list all the names under which the puppetserver can be - # reached. 'puppet' must be one of them, otherwise puppetdb won't be + # reached. 'puppet.local' must be one of them, otherwise puppetdb won't be # able to get a cert. Add other names as a comma-separated list - - DNS_ALT_NAMES=puppet,${DNS_ALT_NAMES:-} + - DNS_ALT_NAMES=puppet,puppet.local,${DNS_ALT_NAMES:-} - PUPPERWARE_ANALYTICS_ENABLED=${PUPPERWARE_ANALYTICS_ENABLED:-true} - - PUPPETDB_SERVER_URLS=https://puppetdb:8081 + - PUPPETDB_SERVER_URLS=https://puppetdb.local:8081 volumes: - ${VOLUME_ROOT:-.}/volumes/code:/etc/puppetlabs/code/ - ${VOLUME_ROOT:-.}/volumes/puppet:/etc/puppetlabs/puppet/ - ${VOLUME_ROOT:-.}/volumes/serverdata:/opt/puppetlabs/server/data/puppetserver/ + dns_search: '.local' networks: default: aliases: - - puppet.${AZURE_DOMAIN:-} + - puppet.local postgres: image: postgres:9.6 @@ -34,14 +38,20 @@ services: volumes: - ${VOLUME_ROOT:-.}/volumes/puppetdb-postgres/data:/var/lib/postgresql/data - ./postgres-custom:/docker-entrypoint-initdb.d + dns_search: '.local' + networks: + default: + aliases: + - postgres.local puppetdb: - hostname: puppetdb + hostname: puppetdb.local image: puppet/puppetdb environment: - PUPPERWARE_ANALYTICS_ENABLED=${PUPPERWARE_ANALYTICS_ENABLED:-true} # This name is an FQDN so the short name puppet doesn't collide outside compose network - - PUPPETSERVER_HOSTNAME=puppet.${AZURE_DOMAIN:-} + - PUPPETSERVER_HOSTNAME=puppet.local + - PUPPETDB_DATABASE_CONNECTION="//postgres.local:5432/puppetdb" - PUPPETDB_PASSWORD=puppetdb - PUPPETDB_USER=puppetdb ports: @@ -52,3 +62,8 @@ services: - puppet volumes: - ${VOLUME_ROOT:-.}/volumes/puppetdb/ssl:/etc/puppetlabs/puppet/ssl/ + dns_search: '.local' + networks: + default: + aliases: + - puppetdb.local diff --git a/gem/lib/pupperware/spec_helper.rb b/gem/lib/pupperware/spec_helper.rb index 6f1387c2..b00baab1 100644 --- a/gem/lib/pupperware/spec_helper.rb +++ b/gem/lib/pupperware/spec_helper.rb @@ -225,11 +225,10 @@ def wait_on_puppetserver_status(seconds = 180) end end + # agent_name is the fully qualified name of the node def clean_certificate(agent_name) - result = run_command('docker-compose --no-ansi exec -T puppet facter domain') - domain = result[:stdout].chomp - STDOUT.puts "cleaning cert for #{agent_name}.#{domain}" - result = run_command("docker-compose --no-ansi exec -T puppet puppetserver ca clean --certname #{agent_name}.#{domain}") + STDOUT.puts "cleaning cert for #{agent_name}" + result = run_command("docker-compose --no-ansi exec -T puppet puppetserver ca clean --certname #{agent_name}") return result[:status].exitstatus end @@ -245,11 +244,10 @@ def run_agent(agent_name, network, server = get_container_hostname(get_service_c return result[:status].exitstatus end + # agent_name is the fully qualified name of the node def check_report(agent_name) pdb_uri = URI::join(get_service_base_uri('puppetdb', 8080), '/pdb/query/v4') - result = run_command("docker-compose --no-ansi exec -T puppet facter domain") - domain = result[:stdout].chomp - body = "{ \"query\": \"nodes { certname = \\\"#{agent_name}.#{domain}\\\" } \" }" + body = "{ \"query\": \"nodes { certname = \\\"#{agent_name}\\\" } \" }" return retry_block_up_to_timeout(120) do Net::HTTP.start(pdb_uri.hostname, pdb_uri.port) do |http| diff --git a/spec/dockerfile_spec.rb b/spec/dockerfile_spec.rb index b9c91999..edfdc664 100644 --- a/spec/dockerfile_spec.rb +++ b/spec/dockerfile_spec.rb @@ -14,7 +14,9 @@ ] before(:all) do - @test_agent = "puppet_test#{Random.rand(1000)}" + # append .local to make sure Docker DNS resolver is used + # rather than appending a search domain due to resolv.conf + @test_agent = "puppet_test#{Random.rand(1000)}.local" @timestamps = [] status = run_command('docker-compose --no-ansi version')[:status] if status.exitstatus != 0