ipa facts generate warning

[teluq-pbrideau]

I get the warning Facter: Execution of '/bin/klist -s' returned 1,

vagrant@host:~$ sudo -i
root@host:~# puppet agent -t
Info: Using environment 'dev'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Warning: Facter: Execution of '/bin/klist -s' returned 1: 
Notice: Requesting catalog from host.vagrant.example.com:8140 (10.0.0.10)
Notice: Catalog compiled by host.vagrant.example.com[...]

Would it be safe for me to add a kinit -k in my /root/.bash_profile to fix this? Nevermind, the facts does not get populated when run via a service… How to make this fact work?

root@host:~# puppet facts ipa
Warning: Facter: Execution of '/bin/klist -s' returned 1: 
{
  "ipa": ""
}
root@host:~# kinit -k
root@host:~# puppet facts ipa
{
  "ipa": {
    "basedn": "dc=vagrant,dc=example,dc=com",
    "connected": true,
    "domain": "vagrant.example.com",
    "realm": "VAGRANT.EXAMPLE.COM",
    "server": "host.vagrant.example.com",
    "tls_ca_cert": "/etc/ipa/ca.crt"
  }
}

[nick-markowski]

The issue is that klist -s is evaluated with :failonfail defaulting to true, which ceases execution of the fact.

We should update the fact to:
klist_retval = Puppet::Util::Execution.execute("#{klist} -s", options = {:failonfail => false} )

[teluq-pbrideau]

Thanks @nick-markowski, at least it won’t throw an error.

But even then, the facts will only be defined when it is run from a terminal with a kerberos token pre-configured.
For example, this fact will never be defined when run from systemd. Therefore, it cannot be use at all in a manifest.

Is this really the use-case for this fact? Could there be a way for me to use this fact in a manifest if puppet run via systemd?
edit: I’m dumb, didn’t read the code first

[nick-markowski]

@teluq-pbrideau I'm not sure I totally understand the issue. This fact is supplemental; the use-case for the fact is to scrape a pre existing ipa connection for connection information, for use in services such as sssd, ssh, or custom manifests. With the fix I described in place, the fact should attempt to generate a kerberos ticket if the cache is empty or expired. Running facter -p ipa or starting puppet from systemd should result in the ipa fact getting populated.

[teluq-pbrideau]

@nick-markowski Oh, sorry, you are 100% right. I assumed stuff and didn’t read the code. Thanks for the fix