From 61afbe349291552e50468a9b0eab63cbc12efb69 Mon Sep 17 00:00:00 2001 From: Oleksandr Kuzminskyi Date: Fri, 3 Jul 2026 19:14:38 -0700 Subject: [PATCH] Fix ca-certificates duplicate declaration on elastic nodes profile::infrahouse_repo (included from profile::base, i.e. every node) ensure_packages'd ca-certificates. On elastic_master/elastic_data, profile::elastic::tls also declared Package['ca-certificates'] *natively*, so the catalog failed with a duplicate declaration (seen on sandbox elastic_master ip-10-0-2-191). Development never surfaced it because only the jumphost role was exercised there. ca-certificates is a fleet-wide TLS dependency, so let base own it: - Keep it in profile::infrahouse_repo's ensure_packages (single owner). - Drop the native package block from profile::elastic::tls; its file resources keep `require => Package['ca-certificates']`, which now resolves to the base-level declaration (stage-ordered before the elastic files). Behavior-preserving: both declared `ensure => present`. Applied to dev and sandbox; global picks it up with the Phase 3 promotion. Co-Authored-By: Claude Opus 4.8 (1M context) --- .claude/plans/infrahouse-keyring-convergence.md | 10 ++++++++-- debian/changelog | 6 ++++++ .../modules/profile/manifests/elastic/tls.pp | 7 +++---- .../sandbox/modules/profile/manifests/elastic/tls.pp | 7 +++---- 4 files changed, 20 insertions(+), 10 deletions(-) diff --git a/.claude/plans/infrahouse-keyring-convergence.md b/.claude/plans/infrahouse-keyring-convergence.md index 5779071..77c5bf1 100644 --- a/.claude/plans/infrahouse-keyring-convergence.md +++ b/.claude/plans/infrahouse-keyring-convergence.md @@ -100,9 +100,15 @@ Test node: `jumphost-sincere-crawdad.rmdbkn.ci-cd.infrahouse.com` ### Phase 2: Sandbox - [x] Promote: copy the change into `environments/sandbox/modules/profile` (byte-identical to dev: - `infrahouse_repo.pp` + `files/converge-infrahouse-keyring.sh` + `base.pp` include). PR pending. -- [ ] Cut a release (merge → CD) + `infrahouse_repo.pp` + `files/converge-infrahouse-keyring.sh` + `base.pp` include). +- [x] Cut a release — PR [#279](https://github.com/infrahouse/puppet-code/pull/279) **merged** → CD. - [ ] Watch sandbox nodes across roles: keyring converges, `apt-get update` clean, no drift + - **Regression found on `elastic_master` (sandbox `ip-10-0-2-191`):** `profile::infrahouse_repo` + is in `base` (every node) and `ensure_packages`'d `ca-certificates`, which collided with + `profile::elastic::tls`'s **native** `package { 'ca-certificates' }` → duplicate declaration, + catalog failed. Fix: `base`/`infrahouse_repo` now **owns** `ca-certificates` (it's a fleet-wide + TLS need); removed the native block from `elastic::tls`, which just `require`s it. Dev never hit + it (only jumphost was tested). Applied to dev + sandbox; global gets it with the Phase-3 promo. ### Phase 3: Production (global modules) - [ ] Promote: move the change into global `modules/profile` (production has no env-local override) diff --git a/debian/changelog b/debian/changelog index 8e1980a..8e5cbda 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +puppet-code (0.1.0-1build313) noble; urgency=medium + + * commit event. see changes history in git log + + -- root Sat, 04 Jul 2026 02:14:39 +0000 + puppet-code (0.1.0-1build312) noble; urgency=medium * commit event. see changes history in git log diff --git a/environments/development/modules/profile/manifests/elastic/tls.pp b/environments/development/modules/profile/manifests/elastic/tls.pp index c775674..1907b65 100644 --- a/environments/development/modules/profile/manifests/elastic/tls.pp +++ b/environments/development/modules/profile/manifests/elastic/tls.pp @@ -93,10 +93,9 @@ mode => '0600', require => Exec[generate_node_pem], } -# Let's encrypt root certificates - package {'ca-certificates': - ensure => present, - } + # Let's encrypt root certificates. The ca-certificates package (which provides + # the Mozilla/ISRG roots linked below) is installed fleet-wide by profile::base + # -> profile::infrahouse_repo; the file resources below just require it. file { '/etc/elasticsearch/tls/ISRG_Root_X1.crt': ensure => present, owner => 'elasticsearch', diff --git a/environments/sandbox/modules/profile/manifests/elastic/tls.pp b/environments/sandbox/modules/profile/manifests/elastic/tls.pp index c775674..1907b65 100644 --- a/environments/sandbox/modules/profile/manifests/elastic/tls.pp +++ b/environments/sandbox/modules/profile/manifests/elastic/tls.pp @@ -93,10 +93,9 @@ mode => '0600', require => Exec[generate_node_pem], } -# Let's encrypt root certificates - package {'ca-certificates': - ensure => present, - } + # Let's encrypt root certificates. The ca-certificates package (which provides + # the Mozilla/ISRG roots linked below) is installed fleet-wide by profile::base + # -> profile::infrahouse_repo; the file resources below just require it. file { '/etc/elasticsearch/tls/ISRG_Root_X1.crt': ensure => present, owner => 'elasticsearch',