puppetlabs/puppet · error · Puppet::Error

An action must be specified.

Error message

An action must be specified.

What it means

Puppet::Application::Ssl#main raises Puppet::Error when 'puppet ssl' is invoked with no action: the command is subcommand-driven (submit_request, download_cert, generate_request, verify, clean — dispatched in the case statement immediately after this check).

Solutions

1. Run the intended action — for first-time setup: puppet ssl bootstrap; otherwise submit_request, download_cert, generate_request, verify, or clean
2. Check puppet ssl --help for the action list
3. Audit wrapper scripts so the action word is not an empty/unset shell variable

Example fix

# before
puppet ssl

# after
puppet ssl bootstrap

action = ENV['SSL_ACTION'] or abort 'set SSL_ACTION (bootstrap|submit_request|download_cert|generate_request|verify|clean)'
system('puppet', 'ssl', action)

When it happens

Trigger: Running plain 'puppet ssl'; a wrapper dropping the action word during quoting/expansion, e.g. an empty shell variable where the action should be.

Common situations: Users expecting 'puppet ssl' alone to do everything (the usual intent is 'puppet ssl bootstrap'); scripts building the command dynamically with an empty action variable.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Need exactly two arguments: filebucket diff
• The puppet agent command does not take parameters
• a short option name can't be a number or a dash
• Error parsing arguments
• ' ' has no action. See `puppet help `.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/6193c3c3338a9937. Report an issue: GitHub.

Appendix: source

Thrown at lib/puppet/application/ssl.rb:112

  option('--debug', '-d')

  def initialize(command_line = Puppet::Util::CommandLine.new)
    super(command_line)

    @cert_provider = Puppet::X509::CertProvider.new
    @ssl_provider = Puppet::SSL::SSLProvider.new
    @machine = Puppet::SSL::StateMachine.new
    @session = Puppet.runtime[:http].create_session
  end

  def setup_logs
    set_log_level(options)
    Puppet::Util::Log.newdestination(:console)
  end

  def main
    if command_line.args.empty?
      raise Puppet::Error, _("An action must be specified.")
    end

    if options[:target]
      # Override the following, as per lib/puppet/application/device.rb
      Puppet[:certname] = options[:target]
      Puppet[:confdir]  = File.join(Puppet[:devicedir], Puppet[:certname])
      Puppet[:vardir]   = File.join(Puppet[:devicedir], Puppet[:certname])
      Puppet.settings.use(:main, :agent, :device)
    else
      Puppet.settings.use(:main, :agent)
    end

    Puppet::SSL::Oids.register_puppet_oids
    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])

    certname = Puppet[:certname]
    action = command_line.args.first
    case action

View on GitHub (pinned to e227c27540)