Uploaded image for project: 'PuppetDB'
  1. PuppetDB
  2. PDB-4326

PuppetDB rejects catalogs with tags added automatically by Puppet

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Normal
    • Resolution: Fixed
    • Affects Version/s: PDB 6.3.0
    • Fix Version/s: PDB 5.2.9, PDB 6.0.4, PDB 6.3.1
    • Component/s: PuppetDB
    • Environment:
      • PuppetDB 6.3.0 on Debian Stretch: 6.3.0-1stretch
      • Puppet server 6.3.0 on Debian Stretch: 6.3.0-1stretch
      • Puppet agent 6.4.0 on Debian Stretch: 6.4.0-1stretch

       

    • Template:
    • Team:
      PuppetDB
    • Method Found:
      Needs Assessment
    • Release Notes:
      Bug Fix
    • Release Notes Summary:
      PuppetDB now successfully stores catalogs with Unicode alphanumeric tags.
    • QA Risk Assessment:
      Needs Assessment

      Description

      Puppet automatically tags resources with the resource title, if it considers the title to be a valid tag name:

      https://github.com/puppetlabs/puppet/blob/6.4.0/lib/puppet/resource.rb#L325

      To determine if it is a valid tag name, it uses the following regex:

        ValidTagRegex = /\A[[:alnum:]][[:alnum:]:.-]*\Z/u

      (https://github.com/puppetlabs/puppet/blob/6.4.0/lib/puppet/util/tagging.rb#L4)

      Since PUP-7579, this regex allows unicode characters. The result is that when you have a resource with a non-ascii characters in its title, it will still add a tag with that title. This can be triggered by for example:

       notify { 'norwegian_characters_æøå': } 

      This is legal according to the documentation:

      Resource titles can contain any characters whatsoever. They are case-sensitive.

      (https://puppet.com/docs/puppet/6.4/lang_reserved.html#resources)

      The problem is that PuppetDB has not been updated to allow unicode characters in tags. Thus there is a mismatch between what the Puppet server considers to be a valid tag name and what PuppetDB considers to be a valid tag name.

      This in turn causes PuppetDB to fail to store the catalog for the node. The Puppet server does not log anything except the normal "Puppet 'replace_catalog' command for <hostname> submitted to PuppetDB with UUID <...>", however, looking at the logs in PuppetDB, we find:

      2019-04-02T14:40:14.185+02:00 ERROR [p.p.command] [81,969] [replace catalog] Fatal error on attempt 0 for vltrd077.cn.uninett.no
      clojure.lang.ExceptionInfo: throw+: {:fatal true, :cause #error {
      :cause "Resource '{:type \"Notify\", :title \"norwegian_characters_?\"}' has an invalid tag 'norwegian_characters_?'. Tags must match the pattern /
      A[a-z0-9_][a-z0-9_:\\-.]*
      Z/."

      (I have attached the full stack trace as puppetdb.log.)

      Since PuppetDB does not store the new catalog for the node, we cannot query PuppetDB for resources from that node.

        Attachments

          Activity

            jsd-sla-details-panel

              People

              • Assignee:
                austin.blatt Austin Blatt
                Reporter:
                olavmo Olav Morken
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: