“failed to start SSH session: Unable to exchange encryption keys” error message in FIPS-enabled Puppet Enterprise 2019.8.10, 2021.5, and 2021.6

Code Manager and r10k can’t get code from your code repository, and you get an error message due to libssh attempting to use algorithms that are not allowed on FIPS-enabled PE 2019.8.10, 2021.5, and 2021.6

Error messages and logs

When attempting to deploy code on FIPS-enabled PE 2019.8.10, 2021.5, and 2021.6, you get the error message:

2022-07-01T23:44:17.164Z INFO [qtp355444149-234] [p.c.app] Queuing deploy for all 2022-07-01T23:44:17.267Z INFO [deploy-pool-1] [p.c.core] Attempting to deploy :environment 'all'... 2022-07-01T23:44:17.898Z ERROR [deploy-pool-1] [p.c.core] Errors while deploying environment 'all' (exit code: 1): /opt/puppetlabs/puppet/lib/ruby/gems/2.7.0/gems/rugged-0.27.7/lib/rugged/repository.rb:258: warning: Using the last argument as keyword parameters is deprecated ERROR -> Unable to determine current branches for Git source 'puppet' (/etc/puppetlabs/code-staging/environments) Original exception: failed to start SSH session:

Version and installation information

PE version: 2019.8.10, 2021.5, 2021.6

Solution

To get code from Code Manager and r10k, switch the Git provider to R10K::Git::ShellGit in PE 2019.8.10, 2021.5, and 2021.6.

To enable the shellgit provider for Code Manager, follow these steps.

1. Add puppet_enterprise::profile::master::r10k_git_provider: shellgit class to Hiera. You can also add the class in the console if this is where you configure your Code Manager settings.
2. Run puppet agent –t
3. Confirm git-provider is showing as shellgit in /etc/puppetlabs/puppetserver/conf.d/code-manager.conf

Learn more about configuring Git settings in our documentation.

If the steps do not solve your issue, consider upgrading to the latest version of PE. In the latest version, the disallowed algorithms are disabled in libssh, allowing Code Manager and r10k to get code.