Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't import certs if archive greater than approx 1MiB #229

Open
anthonysomerset opened this issue May 3, 2024 · 1 comment
Open

Can't import certs if archive greater than approx 1MiB #229

anthonysomerset opened this issue May 3, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@anthonysomerset
Copy link
Contributor

Describe the Bug

If you are importing a larger longer running CA setup (in my case approx 750 agent certs) then the tar archive could become too large to import with a kubernetes error about entity too large - and this is well documented here: https://kubernetes.io/docs/concepts/configuration/configmap/#:~:text=Note%3A%20A%20ConfigMap%20is%20not,separate%20database%20or%20file%20service.

It is likely that a better solution is needed such as providing a URL to download into the containers during preinstall or some other guidance similar to #225

Expected Behavior

CA/Certs import should not fail for larger imports

Steps to Reproduce

Steps to reproduce the behavior:

  1. Have a puppetserver-certs.gz file that is larger than 1mb
  2. install from helm chart with at least the following values set:
puppetserver:
  preGeneratedCertsJob:
    enabled: true

Helm install will fail with an entity too large error

Additional Context

For me because this is basically a onetime error and because of similar issues to #225 i have worked around this manually by

  1. Reducing the size of the tar archive by excluding the contents of /etc/puppetlabs/puppetserver/ca/signed/ folder and deploying the chart with that archive
  2. Spinning up an SSH pod with access to the ca and certs PVC's and then rsyncing the signed files into that folder or download/extract manually from a HTTPS

I think personally that changing the chart to provide a URL for the certs for each of puppetserver (and puppetdb) and the script updating to download that archive and extracts is the simplest solution.

Obviously securing that URL remains outside the scope of this chart and I would always recommend that either there be some form of authentication which could be supplied by secret values or the https endpoint only be accessible to trusted IP's such as your Kubernetes cluster.

@Xtigyro
Copy link
Contributor

Xtigyro commented May 7, 2024

@anthonysomerset Feel free to send our way a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants