Puppet 资料整理

查找错误原因及其修改方法：

http://bitcube.co.uk/content/puppet-errors-explained

https://docs.puppetlabs.com/guides/troubleshooting.html#agents-are-failing-with-a-hostname-was-not-match-with-the-server-certificate-error-whats-wrong

https://mramahi.wordpress.com/2014/05/25/unable-to-connect-puppet-agent-to-master/

打印log：

node default {  notice("try to run this script with -v and -d to see difference between log levels")  notice("function documentation is available here: http://docs.puppetlabs.com/references/latest/function.html")  notice("--------------------------------------------------------------------------")  debug("this is debug. visible only with -d or --debug")  info("this is info. visible only with -v or --verbose or -d or --debug")  alert("this is alert. always visible")  crit("this is crit. always visible")  emerg("this is emerg. always visible")  err("this is err. always visible")  warning("and this is warning. always visible")  notice("this is notice. always visible")  #fail will break execution  fail("this is fail. always visible. fail will break execution process")}




错误1.hostname was not match with the server certificate”

Error: Could not request certificate: Server hostname 'bbq-24.ttt.ttt.com' did not match server certificate; expected bbq-24:

1. $sudo puppet master --configprint certname

2. Re-generate the puppet master’s certificate:

$ sudo find $(puppet master --configprint ssldir) -name "$(puppet master --configprint certname).pem" -delete

Edit the certname setting in the puppet master’s/etc/puppet/puppet.conf file 

$ sudo puppet master --no-daemonize --verbose

Problem

When trying to connect a Puppet node to a Master by running “puppet agent -t” or “puppet agent -t –server masterhostname.domain“, you may get variety of error messages that indicate the node is failing to connect or authenticate to the Puppet master. This situation can occur as a result of the following:

• Re-imaging a previously configured node: When a node is re-imaged, it gets a new SSL certificate for Puppet. Unfortunately this means that the existing certificate stored on the Master’s end becomes invalid, and therefore the Master rejects the connection
• Redirecting the agent to new Master: Every Agent/Master connection gets its own SSL certificates on the agent and master. When redirecting the agent to connect to another master, the certificates need to be regenerated to the new connection.
• Setting up new node: Some of the issues can be experienced when setting up a new node,

This document lists a number of potential solutions in logical order to attempt to resolve the issue:

Resolution

There are number of resolutions, based on the root cause of the issue. The following is logical order of the most common solutions:

Solution #1: Command not run as root or using sudo

The “puppet agent -t” command needs to be run either as “root” or by using “sudo puppet agent -t”, otherwise it won’t run properly.

Solution #2: Configuration file (puppet.conf) does not contain proper entries

The file “/etc/puppet/puppet.conf” contains critical configurations needed by Puppet agent to connect to the Master, including the hostname. A standard puppet.conffor Linux file will look as follows:

[main]

logdir=/var/log/puppet

vardir=/var/lib/puppet

ssldir=/var/lib/puppet/ssl

rundir=/var/run/puppet

factpath=$vardir/lib/facter

templatedir=$confdir/templates

server=puppet.domain

[agent]

report=true

[master]

# These are needed when the puppetmaster is run by passenger

# and can safely be removed if webrick is used.

ssl_client_header = SSL_CLIENT_S_DN

ssl_client_verify_header = SSL_CLIENT_VERIFY

A standard puppet.conf file for Windows will look like:

[main]

server=puppet.domain

pluginsync=true

autoflush=true

environment=production

 

[agent]

report=true

 

[master]

# These are needed when the puppetmaster is run by passenger

# and can safely be removed if webrick is used.

ssl_client_header = SSL_CLIENT_S_DN

ssl_client_verify_header = SSL_CLIENT_VERIFY

The hostname in “server=hostname.domain” entry under “[main]” must match the server name the Puppet Master used to generate its certificate. Some Masters include the domain in their certificates, and others don’t. Some use the hostname, and others use the alias (like in the above example).

Solution #3: Puppet Agent and Master versions do not match

It is highly recommended that Puppet agents and Masters have the same major version (like 3.x.x), and preferably same minor version (like 3.4.x). You can find the version of each by running the following command:

puppet agent --version

Solution #4: Puppet Agent and Master clocks are out of Sync

For security reasons, Puppet Master refuses to sign certificates of the Agent clock is out of sync. In BlackBerry’s environment, Puppet Master has NTP package installed, and configured. therefore the same need to be done to the nodes, where the NTP package must be installed, and the following lines added to it:

sudo apt-get install -y ntp

nano /etc/ntp.conf

###### Begin file edit

## Remove existing "server xxxx" entries

## Replace with the following:

server ntpserver.domain

server ntpserver2.domain

###### End of edit

# Run the following command to start NTP service

sudo /etc/init.d/ntpd start

# Force the initial clock sync

sudo ntpdate ntpserver.domain

Solution #5: Master Certificate is invalid and needs to be regenerated

This is usually the case when either re-imaging the node, so it gets a new certificate, causing the Master-stored one invalid, or when the agent is redirected to new Master. The resolution is two parts: Clean the certificates on the Master, and delete the existing certificate files on the Agent, and start all over:

On the Puppet Master server:

• Login as root, or using an account with sudo access, and switch to root (sudo su)

• Run the following command:

  puppet cert clean 'nodename.domain'
• This should clean up the existing certificate from the Master

On Ubuntu Puppet Node:

• Login as root, or using and account with sudo access, and switch to root (sudo su)

• Run the following command to delete the old certificate files, and regenerate a new one:

  ## For Linux run this command:

  find /var/lib/puppet -type f -print0 |xargs -0r rm

   

  ## For Windows run this command:

  del /q C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs\*

   

  ## For Both Windows and Linux run the following:

  puppet agent -t

Solution #6: Error “SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed..”

When running the following command on Puppet node, you get the error below, where puppetmaster.rim.net is replaced by the actual address of the Puppet Master server that the agent connects to:

# puppet agent -t

Warning: Unable to fetch my node definition, but the agent run will continue:

Warning: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.rim.net]

Info: Retrieving plugin

Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]

Error: /File[/var/lib/puppet/lib]: Could not evaluate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain] Could not retrieve file metadata for puppet://puppetmaster.rim.net/plugins: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]

Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]

Warning: Not using cache on failed catalog

On Puppet Node:

• Login as root, or using and account with sudo access, and switch to root (sudo su)

• Run the following command to delete the old certificate files, and regenerate a new one:

  find /etc/puppet/ssl -type f -print0 |xargs -0r rm

  puppet agent -t

• If the Master is configured to auto-sign certificates, then you are done. Otherwise you need to login back to Puppet Master and run the command:

  puppet cert sign 'nodename.domain'

  replacing ‘nodename’ with the actual server name where Puppet agent is installed.

•