Details
-
Type:
Bug
-
Status: Closed
-
Priority:
Normal
-
Resolution: Fixed
-
Affects Version/s: PDB 6.3.0
-
Component/s: PuppetDB
-
Labels:
-
Environment:
- PuppetDB 6.3.0 on Debian Stretch: 6.3.0-1stretch
- Puppet server 6.3.0 on Debian Stretch: 6.3.0-1stretch
- Puppet agent 6.4.0 on Debian Stretch: 6.4.0-1stretch
-
Template:customfield_10700 302664
-
Team:PuppetDB
-
Method Found:Needs Assessment
-
Release Notes:Bug Fix
-
Release Notes Summary:PuppetDB now successfully stores catalogs with Unicode alphanumeric tags.
-
QA Risk Assessment:Needs Assessment
Description
Puppet automatically tags resources with the resource title, if it considers the title to be a valid tag name:
https://github.com/puppetlabs/puppet/blob/6.4.0/lib/puppet/resource.rb#L325
To determine if it is a valid tag name, it uses the following regex:
ValidTagRegex = /\A[[:alnum:]][[:alnum:]:.-]*\Z/u
(https://github.com/puppetlabs/puppet/blob/6.4.0/lib/puppet/util/tagging.rb#L4)
Since PUP-7579, this regex allows unicode characters. The result is that when you have a resource with a non-ascii characters in its title, it will still add a tag with that title. This can be triggered by for example:
notify { 'norwegian_characters_æøå': }
This is legal according to the documentation:
Resource titles can contain any characters whatsoever. They are case-sensitive.
(https://puppet.com/docs/puppet/6.4/lang_reserved.html#resources)
The problem is that PuppetDB has not been updated to allow unicode characters in tags. Thus there is a mismatch between what the Puppet server considers to be a valid tag name and what PuppetDB considers to be a valid tag name.
This in turn causes PuppetDB to fail to store the catalog for the node. The Puppet server does not log anything except the normal "Puppet 'replace_catalog' command for <hostname> submitted to PuppetDB with UUID <...>", however, looking at the logs in PuppetDB, we find:
2019-04-02T14:40:14.185+02:00 ERROR [p.p.command] [81,969] [replace catalog] Fatal error on attempt 0 for vltrd077.cn.uninett.no
clojure.lang.ExceptionInfo: throw+: {:fatal true, :cause #error {
:cause "Resource '{:type \"Notify\", :title \"norwegian_characters_?\"}' has an invalid tag 'norwegian_characters_?'. Tags must match the pattern /
A[a-z0-9_][a-z0-9_:\\-.]*
Z/."
(I have attached the full stack trace as puppetdb.log.)
Since PuppetDB does not store the new catalog for the node, we cannot query PuppetDB for resources from that node.