Trust the estate CA when fetching ENC facts #529

Merged

benvin merged 1 commits from benvin/enc-facts-ca-bundle into develop 2026-09-20 23:32:19 +10:00

Conversation 0 Commits 1 Files Changed 1

+22 -1

unkin-agent commented 2026-09-20 23:25:44 +10:00

Member

Copy Link

Copy Source

Facter runs under Puppet's vendored Ruby, which reads its own bundled CA file and never the system trust store. The ENC fact now fetches over HTTPS, so every node fails certificate verification and falls back to its cached value.

• set ca_file on the request to the vaultca anchor bundle
• keep VERIFY_PEER on, and fall through to the existing cache path when the anchor is absent

Facter runs under Puppet's vendored Ruby, which reads its own bundled CA file and never the system trust store. The ENC fact now fetches over HTTPS, so every node fails certificate verification and falls back to its cached value. - set ca_file on the request to the vaultca anchor bundle - keep VERIFY_PEER on, and fall through to the existing cache path when the anchor is absent

unkin-agent added 1 commit 2026-09-20 23:25:44 +10:00

Trust the estate CA when fetching ENC data from encapi ... 7f66dfd593

Facter runs under Puppet's vendored ruby, whose OpenSSL trusts only
/opt/puppetlabs/puppet/ssl/cert.pem, not the system trust store, so every
node failed encapi TLS with 'unable to get local issuer certificate'.
Point Net::HTTP at the CA anchor profiles::pki::vaultca installs and keep
VERIFY_PEER on.

benvin merged commit 734fcb8cf4 into develop 2026-09-20 23:32:19 +10:00

benvin deleted branch benvin/enc-facts-ca-bundle 2026-09-20 23:32:19 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#529