Portal:Cloud VPS/Admin/Runbooks/PuppetCertificateAboutToExpire

Cloud VPS

• Cloud Services overview
• Cloud VPS user docs

Get started

• About Cloud VPS projects
• Cloud VPS user roles and rights
• List of Cloud VPS projects

Instances and access

• Set up a Cloud VPS instance
• Access Cloud VPS instances
• Add disk space to instances (detachable volumes)
• Set up a LAMP stack
• Set up an instance using MediaWiki-Vagrant
• Server groups
• Sudo policies
• Unmanaged instances

Networking

• Security groups and firewall settings
• Floating IP addresses
• Web proxies for exposing Cloud VPS services to the internet

Horizon and Puppet

• Horizon web interface
• About Horizon
• Puppet on Cloud VPS
• Standalone puppetmaster

Managed storage

• Database instances (Trove)
• Object storage (S3 / Swift)

Get help

• Help and communication
• Recommendations for moving to production

Programmatic usage

• OpenStack APIs
• OpenTofu

Documentation for admins

• Cloud VPS infrastructure
• Administrator documentation
• Administrator runbooks

[]

The procedures in this runbook require project admin permissions to complete.

This happens when a Puppet certificate is about to expire. It might be either a normal host certificate or a CA certificate.

Error / Incident

This usually comes in the form of an alert in alertmanager.

The alert will include the CN for the certificate that's expiring.

Debugging

The alert will tell you also how much is left for the certificate to expire in the summary, for example:

 summary: Puppet CA certificate Puppet CA: clouddb-services-puppetmaster-01.clouddb-services.eqiad.wmflabs is about to expire in 27d 3h 0m 43s

Common issues

Host certificate about to expire

If a host certificate is about to expire, run the wmcs.vps.refresh_puppet_certs cookbook to renew it. (This usually means that the host is quite old, so consider replacing it with one that uses a newer OS version!)

CA certificate about to expire

Sometimes it's the Puppet CA certificate itself that's about to expire. This is happening if the certificate CN starts with Puppet CA:.

To renew that certificate, follow Help:Standalone_puppetmaster#Renewing_puppetmaster_CA_certificate.

Related information

• Puppet standalone setup and maintenance docs

Old incidents

• T354714 - [clouddb-service-puppetmaster-2] Renew puppet CA certificates