查找错误原因及其修改方法:
http://bitcube.co.uk/content/puppet-errors-explained
https://docs.puppetlabs.com/guides/troubleshooting.html#agents-are-failing-with-a-hostname-was-not-match-with-the-server-certificate-error-whats-wrong
https://mramahi.wordpress.com/2014/05/25/unable-to-connect-puppet-agent-to-master/
打印log:
node default {
notice("try to run this script with -v and -d to see difference between log levels")
notice("function documentation is available here: http://docs.puppetlabs.com/references/latest/function.html")
notice("--------------------------------------------------------------------------")
debug("this is debug. visible only with -d or --debug")
info("this is info. visible only with -v or --verbose or -d or --debug")
alert("this is alert. always visible")
crit("this is crit. always visible")
emerg("this is emerg. always visible")
err("this is err. always visible")
warning("and this is warning. always visible")
notice("this is notice. always visible")
#fail will break execution
fail("this is fail. always visible. fail will break execution process")
}
2. Re-generate the puppet master’s certificate:
$ sudo find $(puppet master --configprint ssldir) -name "$(puppet master --configprint certname).pem" -delete
Edit the certname
setting in the puppet master’s/etc/puppet/puppet.conf
file
$ sudo puppet master --no-daemonize --verbose
Problem
When trying to connect a Puppet node to a Master by running “puppet agent -t” or “puppet agent -t –server masterhostname.domain“, you may get variety of error messages that indicate the node is failing to connect or authenticate to the Puppet master. This situation can occur as a result of the following:
- Re-imaging a previously configured node: When a node is re-imaged, it gets a new SSL certificate for Puppet. Unfortunately this means that the existing certificate stored on the Master’s end becomes invalid, and therefore the Master rejects the connection
- Redirecting the agent to new Master: Every Agent/Master connection gets its own SSL certificates on the agent and master. When redirecting the agent to connect to another master, the certificates need to be regenerated to the new connection.
- Setting up new node: Some of the issues can be experienced when setting up a new node,
This document lists a number of potential solutions in logical order to attempt to resolve the issue:
Resolution
There are number of resolutions, based on the root cause of the issue. The following is logical order of the most common solutions:
Solution #1: Command not run as root or using sudo
The “puppet agent -t” command needs to be run either as “root” or by using “sudo puppet agent -t”, otherwise it won’t run properly.
Solution #2: Configuration file (puppet.conf) does not contain proper entries
The file “/etc/puppet/puppet.conf” contains critical configurations needed by Puppet agent to connect to the Master, including the hostname. A standard puppet.conffor Linux file will look as follows:
[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
templatedir=$confdir/templates
server=puppet.domain
[agent]
report=
true
[master]
# These are needed when the puppetmaster is run by passenger
# and can safely be removed
if
webrick is used.
ssl_client_header = SSL_CLIENT_S_DN
ssl_client_verify_header = SSL_CLIENT_VERIFY
|
A standard puppet.conf file for Windows will look like:
[main]
server=puppet.domain
pluginsync=
true
autoflush=
true
environment=production
[agent]
report=
true
[master]
# These are needed when the puppetmaster is run by passenger
# and can safely be removed
if
webrick is used.
ssl_client_header = SSL_CLIENT_S_DN
ssl_client_verify_header = SSL_CLIENT_VERIFY
|
The hostname in “server=hostname.domain” entry under “[main]” must match the server name the Puppet Master used to generate its certificate. Some Masters include the domain in their certificates, and others don’t. Some use the hostname, and others use the alias (like in the above example).
Solution #3: Puppet Agent and Master versions do not match
It is highly recommended that Puppet agents and Masters have the same major version (like 3.x.x), and preferably same minor version (like 3.4.x). You can find the version of each by running the following command:
puppet agent --version
|
Solution #4: Puppet Agent and Master clocks are out of Sync
For security reasons, Puppet Master refuses to sign certificates of the Agent clock is out of sync. In BlackBerry’s environment, Puppet Master has NTP package installed, and configured. therefore the same need to be done to the nodes, where the NTP package must be installed, and the following lines added to it:
sudo apt-get install -y ntp
nano /etc/ntp.conf
###### Begin file edit
## Remove existing
"server xxxx"
entries
## Replace with the following:
server ntpserver.domain
server ntpserver2.domain
###### End of edit
# Run the following command to start NTP service
sudo /etc/init.d/ntpd start
# Force the initial clock sync
sudo ntpdate ntpserver.domain
|
Solution #5: Master Certificate is invalid and needs to be regenerated
This is usually the case when either re-imaging the node, so it gets a new certificate, causing the Master-stored one invalid, or when the agent is redirected to new Master. The resolution is two parts: Clean the certificates on the Master, and delete the existing certificate files on the Agent, and start all over:
On the Puppet Master server:
- Login as root, or using an account with sudo access, and switch to root (sudo su)
-
Run the following command:
puppet cert clean
'nodename.domain'
- This should clean up the existing certificate from the Master
On Ubuntu Puppet Node:
- Login as root, or using and account with sudo access, and switch to root (sudo su)
-
Run the following command to delete the old certificate files, and regenerate a new one:
## For Linux run
this
command:
find /var/lib/puppet -type f -print0 |xargs -0r rm
## For Windows run
this
command:
del /q C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs\*
## For Both Windows and Linux run the following:
puppet agent -t
Solution #6: Error “SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed..”
When running the following command on Puppet node, you get the error below, where puppetmaster.rim.net is replaced by the actual address of the Puppet Master server that the agent connects to:
# puppet agent -t
Warning: Unable to fetch my node definition, but the agent run will
continue
:
Warning: SSL_connect returned=
1
errno=
0
state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL
for
/CN=puppetmaster.rim.net]
Info: Retrieving plugin
Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using
'eval_generate'
: SSL_connect returned=
1
errno=
0
state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL
for
/CN=puppetmaster.domain]
Error: /File[/var/lib/puppet/lib]: Could not evaluate: SSL_connect returned=
1
errno=
0
state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL
for
/CN=puppetmaster.domain] Could not retrieve file metadata
for
puppet:
//puppetmaster.rim.net/plugins: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL for /CN=puppetmaster.domain]
Error: Could not retrieve catalog from remote server: SSL_connect returned=
1
errno=
0
state=SSLv3 read server certificate B: certificate verify failed: [unable to get certificate CRL
for
/CN=puppetmaster.domain]
Warning: Not using cache on failed catalog
|
On Puppet Node:
- Login as root, or using and account with sudo access, and switch to root (sudo su)
-
Run the following command to delete the old certificate files, and regenerate a new one:
find /etc/puppet/ssl -type f -print0 |xargs -0r rm
puppet agent -t
-
If the Master is configured to auto-sign certificates, then you are done. Otherwise you need to login back to Puppet Master and run the command:
puppet cert sign
'nodename.domain'
replacing ‘nodename’ with the actual server name where Puppet agent is installed.
-