Puppet 资料整理

xlid

　　查找错误原因及其修改方法：
　　http://bitcube.co.uk/content/puppet-errors-explained


　　https://docs.puppetlabs.com/guides/troubleshooting.html#agents-are-failing-with-a-hostname-was-not-match-with-the-server-certificate-error-whats-wrong


　　https://mramahi.wordpress.com/2014/05/25/unable-to-connect-puppet-agent-to-master/


　　


　　打印log：
　　

node default {
notice("try to run this script with -v and -d to see difference between log levels")
notice("function documentation is available here: http://docs.puppetlabs.com/references/latest/function.html")
notice("--------------------------------------------------------------------------")
debug("this is debug. visible only with -d or --debug")
info("this is info. visible only with -v or --verbose or -d or --debug")
alert("this is alert. always visible")
crit("this is crit. always visible")
emerg("this is emerg. always visible")
err("this is err. always visible")
warning("and this is warning. always visible")
notice("this is notice. always visible")
#fail will break execution
fail("this is fail. always visible. fail will break execution process")
}




错误1.hostname
was not match with the server certificate”
Error: Could not request certificate: Server hostname 'bbq-24.ttt.ttt.com' did not match server certificate;
expected bbq-24:


1.
$sudo puppet master --configprint certname　　2. Re-generate the puppet master’s certificate:
　　$
sudo find $(puppet master --configprint ssldir) -name "$(puppet master --configprint certname).pem" -delete


　　Edit
the certname setting
in the puppet master’s/etc/puppet/puppet.conf file


　　$
sudo puppet master --no-daemonize --verbose


　　
　　


Problem
　　
When trying to connect a Puppet node to a Master by running “puppet agent -t” or “puppet agent -t –server masterhostname.domain“, you may get variety of error messages that
indicate the node is failing to connect or authenticate to the Puppet master. This situation can occur as a result of the following:

• Re-imaging a previously configured node: When a node is re-imaged, it gets a new SSL certificate for Puppet. Unfortunately this means that the existing certificate stored on the Master’s end becomes invalid, and therefore the Master rejects the connection
  
• Redirecting the agent to new Master: Every Agent/Master connection gets its own SSL certificates on the agent and master. When redirecting the agent to connect to another master, the certificates need to be regenerated to the new connection.
  
• Setting up new node: Some of the issues can be experienced when setting up a new node,
  

This document lists a number of potential solutions in logical order to attempt to resolve the issue:


Resolution

There are number of resolutions, based on the root cause of the issue. The following is logical order of the most common solutions:


Solution #1: Command not run as root or using sudo

The “puppet agent -t” command needs to be run either as “root” or by using “sudo puppet agent -t”, otherwise it won’t run properly.


Solution #2: Configuration file (puppet.conf) does not contain proper entries

The file “/etc/puppet/puppet.conf” contains critical configurations needed by Puppet agent to connect to the Master, including the hostname.
A standard puppet.conffor Linux file will look as follows:



[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
templatedir=$confdir/templates
server=puppet.domain
[agent]
report=true
[master]
# These are needed when the puppetmaster is run by passenger
# and can safely be removed if webrick
is used.
ssl_client_header = SSL_CLIENT_S_DN
ssl_client_verify_header = SSL_CLIENT_VERIFY


A standard puppet.conf file for Windows will look like:



[main]
server=puppet.domain
pluginsync=true
autoflush=true
environment=production

[agent]
report=true

[master]
# These are needed when the puppetmaster is run by passenger
# and can safely be removed if webrick
is used.
ssl_client_header = SSL_CLIENT_S_DN
ssl_client_verify_header = SSL_CLIENT_VERIFY


The hostname in “server=hostname.domain” entry under “[main]” must match the server name the Puppet Master used to generate its certificate. Some Masters include the domain
in their certificates, and others don’t. Some use the hostname, and others use the alias (like in the above example).


Solution #3: Puppet Agent and Master versions do not match

It is highly recommended that Puppet agents and Masters have the same major version (like 3.x.x), and preferably same minor version (like 3.4.x). You can find the version of each
by running the following command:



puppet agent --version



Solution #4: Puppet Agent and Master clocks are out of Sync

For security reasons, Puppet Master refuses to sign certificates of the Agent clock is out of sync. In BlackBerry’s environment, Puppet Master has NTP package installed, and configured.
therefore the same need to be done to the nodes, where the NTP package must be installed, and the following lines added to it:



sudo apt-get install -y ntp
nano /etc/ntp.conf
###### Begin file edit
## Remove existing "server xxxx" entries
## Replace with the following:
server ntpserver.domain
server ntpserver2.domain
###### End of edit
# Run the following command to start NTP service
sudo /etc/init.d/ntpd start
# Force the initial clock sync
sudo ntpdate ntpserver.domain





Solution #5: Master Certificate is invalid and needs to be regenerated

This is usually the case when either re-imaging the node, so it gets a new certificate, causing the Master-stored one invalid, or when the agent is redirected to new Master. The resolution
is two parts: Clean the certificates on the Master, and delete the existing certificate files on the Agent, and start all over:
On the Puppet Master server:

• Login as root, or using an account with sudo access, and switch to root (sudo su)
  
• 　　Run the following command:
  
  
  
  puppet cert clean 'nodename.domain'
  
• This should clean up the existing certificate from the Master
  

On Ubuntu Puppet Node:

• Login as root, or using and account with sudo access, and switch to root (sudo su)
  
• 　　Run the following command to delete the old certificate files, and regenerate a new one:
  
  
  
  ## For Linux run this command:
  find /var/lib/puppet -type f -print0 |xargs -0r rm
  
  ## For Windows run this command:
  del /q C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs\*
  
  ## For Both Windows and Linux run the following:
  puppet agent -t
  

Solution #6: Error “SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed..”

When running the following command on Puppet node, you get the error below, where puppetmaster.rim.net is replaced by the actual address of
the Puppet Master server that the agent connects to:



# puppet agent -t
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_connect returned=1 errno=0 state=SSLv3
read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.rim.net]
Info: Retrieving plugin
Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate':
SSL_connect returned=1 errno=0 state=SSLv3
read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]
Error: /File[/var/lib/puppet/lib]: Could not evaluate: SSL_connect returned=1 errno=0 state=SSLv3
read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]
Could not retrieve file metadata for puppet://puppetmaster.rim.net/plugins:
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]
Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3
read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]
Warning: Not using cache on failed catalog



On Puppet Node:

• Login as root, or using and account with sudo access, and switch to root (sudo su)
  
• 　　Run the following command to delete the old certificate files, and regenerate a new one:
  
  
  
  find /etc/puppet/ssl -type f -print0 |xargs -0r rm
  puppet agent -t
  

• 　　If the Master is configured to auto-sign certificates, then you are done. Otherwise you need to login back to Puppet Master and run the command:
  
  
  
  puppet cert sign 'nodename.domain'　　replacing ‘nodename’ with the actual server name where Puppet agent is installed.
  
• 
  

乐呵呵

有puppet学习视频吗？