无法重新加载Puppet配置 - >无法连接到Puppet服务器
我正在使用两个Vagrant虚拟机来测试Puppet的一些事情,但是当我去请求证书时,我得到一个神秘的错误消息,找到任何有关的信息。无法重新加载Puppet配置 - >无法连接到Puppet服务器
我应该注意,与良好的Linux服务器管理相对应,我使用/var/
和/opt/
来存储敏感的证书信息,但使用其他标准的Puppet设置。
# Client node details
IP: 192.168.250.10
Hostname: client.example.com
Puppet version: 4.3.2
OS: CentOS Linux release 7.0.1406 (on Vagrant)
# Puppet server details
IP: 192.168.250.6
Hostname: puppet-server.example.com
Puppet version: 4.3.2
OS: CentOS Linux release 7.0.1406 (on Vagrant)
# client's and server's /etc/hosts files are identical
192.168.250.5 puppetmaster.example.com
192.168.250.6 puppet.example.com puppet-server.example.com
192.168.250.7 dashserver.example.com dashboard.example.com
192.168.250.10 client.example.com
192.168.250.20 webserver.example.com
# /etc/puppetlabs/puppet/puppet.conf on both client and server
[main]
logdest = syslog
[user]
bucketdir = $clientbucketdir
vardir = /var/opt/puppetlabs/server
ssldir = $vardir/ssl
[agent]
server = puppet.example.com
[master]
certname = puppet.example.com
vardir = /var/opt/puppetlabs/puppetserver
ssldir = $vardir/ssl
logdir = /var/log/puppetlabs/puppetserver
rundir = /var/run/puppetlabs/puppetserver
pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
trusted_server_facts = true
reports = store
cacert = /var/opt/puppetlabs/puppetserver/ssl/certs/ca.pem
cacrl = /var/opt/puppetlabs/puppetserver/ssl/crl.pem
hostcert = /var/opt/puppetlabs/puppetserver/ssl/certs/{puppet, client}.example.com.pem # respectively, obviously
hostprivkey = /var/opt/puppetlabs/puppetserver/ssl/private_keys/{puppet, client}.example.com.pem # respectively, obviously
最后,错误我得到:
所有的$ sudo puppet resource service puppet ensure=stopped enable=false
Notice: /Service[puppet]/ensure: ensure changed 'running' to 'stopped'
service { 'puppet':
ensure => 'stopped',
enable => 'false',
}
$ sudo puppet resource service puppet ensure=running enable=true
Notice: /Service[puppet]/ensure: ensure changed 'stopped' to 'running'
service { 'puppet':
ensure => 'running',
enable => 'true',
}
$ puppet agent --test --server=puppet.example.com
Error: Could not request certificate: Permission denied @ dir_initialize - /etc/puppetlabs/puppet/ssl/private_keys
Exiting; failed to retrieve certificate and waitforcert is disabled
首先,与此设置木偶不应该使用/etc/puppetlabs/puppet/ssl/private_keys
。它不正确使用我的配置文件:
$ puppet config print ssldir
/etc/puppetlabs/puppet/ssl
接下来,我经历了和再生服务器和客户端节点as prescribed in the Puppet docs上的按键,但是我还是得到了同样的错误,并在客户端和服务器仍然认为我的$ssldir
是/etc/puppetlabs/puppet/ssl
它应该是/var/opt/puppetlabs/puppetserver/ssl
。
有什么想法?
您需要在代理部分以及主服务器中指定ssl和vardir配置。
the user section is only applicable to the puppet apply commands etc
只要'[main]'部分也应该这样做。这是假设他正在同一台机器上与主人和代理人一起测试。这个问题并不清楚。如果它们不是,则需要在puppet代理运行之前在代理机器上配置。 – Artefacto
它在两个不同的流浪VM机器上,一个用于木偶代理,另一个用于Puppet Server。哪些节点需要vardir和ssldir(以及哪些节)? – lollercoaster
代理程序在vardir部分需要它们,并且服务器在主节中需要它们。或者你可以将它添加到两者的主要部分 – Robo
“puppet config print ssldir”的输出是什么? – Robo