Puppet users - Nov 2013 - Is it possible to puppet agent applies the config even when puppet master is unreachable?

I have several windows machines that are manage using puppet. Some of the 
machines connect to master through a openvpn tunnel, so when the openvpn 
client''s service is stopped (sometimes by a rogue user), the puppet
agent
does not apply the config.
Is it possible make puppet agent use the cached configuration and apply the 
latest config it was able to fetch from the master? (which in my case 
includes ensuring the openvpn service is running).
Thank you.

Regards,
Armindo

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/191056e4-e77b-4502-bb2d-ad72a9f8a129%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

From here http://docs.puppetlabs.com/learning/manifests.html :

puppet apply /path/to/your/manifest/init.pp


Or like so:

puppet apply --modulepath=/path/to/your/manifest -e "include my_class"



On Sun, Nov 24, 2013 at 5:46 PM, Armindo Silva <deathon2legs@gmail.com>
wrote:
> I have several windows machines that are manage using puppet. Some of the
> machines connect to master through a openvpn tunnel, so when the openvpn
> client''s service is stopped (sometimes by a rogue user), the
puppet agent
> does not apply the config.
> Is it possible make puppet agent use the cached configuration and apply the
> latest config it was able to fetch from the master? (which in my case
> includes ensuring the openvpn service is running).
> Thank you.
>
> Regards,
> Armindo
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to puppet-users+unsubscribe@googlegroups.com.
> To view this discussion on the web visit
>
https://groups.google.com/d/msgid/puppet-users/191056e4-e77b-4502-bb2d-ad72a9f8a129%40googlegroups.com.
> For more options, visit https://groups.google.com/groups/opt_out.
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/CAMo7R_fhJbASKy05f-WT7eMmtPYQxbhcmcde8cswpmgOmQiuGA%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

You want this:
http://docs.puppetlabs.com/references/latest/configuration.html#usecacheonfailure

On Nov 24, 2013, at 7:46 AM, Armindo Silva <deathon2legs@gmail.com>
wrote:
> I have several windows machines that are manage using puppet. Some of the
machines connect to master through a openvpn tunnel, so when the openvpn
client''s service is stopped (sometimes by a rogue user), the puppet
agent does not apply the config.
> Is it possible make puppet agent use the cached configuration and apply the
latest config it was able to fetch from the master? (which in my case includes
ensuring the openvpn service is running).
> Thank you.
> 
> Regards,
> Armindo
> 
> -- 
> You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
email to puppet-users+unsubscribe@googlegroups.com.
> To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/191056e4-e77b-4502-bb2d-ad72a9f8a129%40googlegroups.com.
> For more options, visit https://groups.google.com/groups/opt_out.
-- 
Jo Rhett
Net Consonance : net philanthropy to improve open source and internet projects.

Author of Instant Puppet 3 Starter:
http://www.netconsonance.com/instant-puppet-3-starter-book/



-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/6DD60014-4046-423B-B058-F60ACB9A3CA2%40netconsonance.com.
For more options, visit https://groups.google.com/groups/opt_out.

On 11/24/2013 11:17 PM, Jo Rhett wrote:
> You want
> this:
http://docs.puppetlabs.com/references/latest/configuration.html#usecacheonfailure
+1

Also, note that --test explicitly disables this option, but it should
default to enabled when *not* using --test, i.e. just --onetime
--no-daemonize.
> On Nov 24, 2013, at 7:46 AM, Armindo Silva <deathon2legs@gmail.com
> <mailto:deathon2legs@gmail.com>> wrote:
>> I have several windows machines that are manage using puppet. Some of
>> the machines connect to master through a openvpn tunnel, so when the
>> openvpn client''s service is stopped (sometimes by a rogue
user), the
>> puppet agent does not apply the config.
>> Is it possible make puppet agent use the cached configuration and
>> apply the latest config it was able to fetch from the master? (which
>> in my case includes ensuring the openvpn service is running).
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/5295C2C5.5040100%40alumni.tu-berlin.de.
For more options, visit https://groups.google.com/groups/opt_out.

----- Original Message -----
> From: "Felix Frank" <felix.frank@alumni.tu-berlin.de>
> To: puppet-users@googlegroups.com
> Sent: Wednesday, November 27, 2013 10:00:37 AM
> Subject: Re: [Puppet Users] Is it possible to puppet agent applies the
config even when puppet master is unreachable?
> 
> On 11/24/2013 11:17 PM, Jo Rhett wrote:
> > You want
> > this:
> >
http://docs.puppetlabs.com/references/latest/configuration.html#usecacheonfailure
> 
> +1
this will most likely not have the desired effect as the cache does not include
files
so those will fail.

worse the cache can open you to really nasty edge cases where you have a catalog
compiled
for one set of manifests+files but if its reused later you might be getting
files from
a newer code base which will really spoil your day.

The static catalog compiler thing will help with some of this - though still not
for
a offline master - but it has many bugs and questionable implementation
mechanics :(

You really want to think very very carefully before using the cache in
production.
I''d say this option should be off by default

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/3539321.208.1385546629664.JavaMail.zimbra%40devco.net.
For more options, visit https://groups.google.com/groups/opt_out.

Hi, first thank you for all your answers :)

I also dislike using cache on production, but if a node can not reach the 
master it should still be able to enforce the configuration it already 
received from the master.
I tried several options on puppet.conf from the node




*usecacheonfailure=trueuse_cached_catalog=trueignorecache=false*
But I always get this error when running the puppet agent:



*Error: Failed to apply catalog: A connection attempt failed because the 
connected party did notproperly respond after a period of time, or 
established connection failed because connected host has failed to respond. 
- connect(2)*


Any ideas?

Thank you.

Armindo

On Wednesday, November 27, 2013 10:03:49 AM UTC, R.I. Pienaar
wrote:
>
>
>
> ----- Original Message ----- 
> > From: "Felix Frank" <felix...@alumni.tu-berlin.de
<javascript:>>
> > To: puppet...@googlegroups.com <javascript:> 
> > Sent: Wednesday, November 27, 2013 10:00:37 AM 
> > Subject: Re: [Puppet Users] Is it possible to puppet agent applies the
> config even when puppet master is unreachable? 
> > 
> > On 11/24/2013 11:17 PM, Jo Rhett wrote: 
> > > You want 
> > > this: 
> > > 
>
http://docs.puppetlabs.com/references/latest/configuration.html#usecacheonfailure
> > 
> > +1 
>
> this will most likely not have the desired effect as the cache does not 
> include files 
> so those will fail. 
>
> worse the cache can open you to really nasty edge cases where you have a 
> catalog compiled 
> for one set of manifests+files but if its reused later you might be 
> getting files from 
> a newer code base which will really spoil your day. 
>
> The static catalog compiler thing will help with some of this - though 
> still not for 
> a offline master - but it has many bugs and questionable implementation 
> mechanics :( 
>
> You really want to think very very carefully before using the cache in 
> production. 
> I''d say this option should be off by default 
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/c007e54f-9848-4382-908a-e9d229bb44d8%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.