今天agent在拉取配置清单的时候报错, 错误如下
[root@server214 ~]#puppet agent -t --server server212.localdomain Info: Creating a new SSL key for server214.localdomain Info: Caching certificate for server214.localdomain Error: Could not request certificate: The certificate retrieved from the master does not match the agent's private key. Certificate fingerprint: B1:A2:9F:C2:F7:31:14:B9:10:44:CF:7F:A4:A3:DF:6F:7D:84:85:51:CE:EB:D0:E0:07:90:D0:1A:52:57:4A:05 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate. On the master: puppet cert clean server214.localdomain On the agent: 1a. On most platforms: find /var/lib/puppet/ssl -name server214.localdomain.pem -delete 1b. On Windows: del "/var/lib/puppet/ssl/server214.localdomain.pem" /f 2. puppet agent -t Exiting; failed to retrieve certificate and waitforcert is disabled
根据提示在master端清除该 agent的证书信息
然后在agent端 查找自己颁发的证书,并删除。
再试试:
[root@server214 ~]#find /var/lib/puppet/ssl -name server214.localdomain.pem -delete [root@server214 ~]#puppet agent -t --server server212.localdomain Info: Creating a new SSL key for server214.localdomain Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for server214.localdomain Info: Certificate Request fingerprint (SHA256): 1B:B5:6F:F2:C3:D2:BF:22:EA:73:A7:54:3F:D6:41:25:07:B0:36:75:72:11:AC:41:91:A0:C3:19:D9:7C:7B:77 Info: Caching certificate for server214.localdomain Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: server212.localdomain] Exiting; failed to retrieve certificate and waitforcert is disabled
结果 还在报错,Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: server212.localdomain]
查了一下,问题应该是出在agent端,于是在agent端删除整个ssl目录
# rm -rf /var/lib/puppet/ssl/
然后,再去master端确认下 无问题agent端的证书信息
# puppet cert clean server214.localdomain
然后再重新向 master申请证书签发
[root@server214 ~]#puppet agent -t --server server212.localdomain Info: Creating a new SSL key for server214.localdomain Info: Caching certificate for ca Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for server214.localdomain Info: Certificate Request fingerprint (SHA256): EC:E9:96:05:3F:17:71:69:4A:13:46:4B:71:BD:4D:FD:90:9C:BF:20:0B:E4:0E:95:06:C8:BF:7A:59:DC:77:F4 Info: Caching certificate for ca Exiting; no certificate found and waitforcert is disabled
到master端 签证书,然后在agent执行正常的配置清单获取
[root@server214 ~]#puppet agent -t --server server212.localdomain Info: Caching certificate for server214.localdomain Info: Caching certificate_revocation_list for ca Info: Caching certificate for server214.localdomain Info: Caching catalog for server214.localdomain Info: Applying configuration version '1453901147' Notice: /Stage[first]/Initialization::Kernel_sysctl_config/File[transfer_sysctl.conf]/content: --- /etc/sysctl.conf 2014-10-16 22:53:31.000000000 +0800
正常了。
我这台agent端做过实验,里面已经整的乱七八糟了,索性就把所有ssl/目录下的文件删除就ok。
记录下。
又遇到错误
[root@server178 ~]# puppet agent --test --server puppet_master Info: Caching catalog for server178 Info: Applying configuration version '1453903372' Error: /Stage[first]/Initialization::Kernel_sysctl_config/File[transfer_sysctl.conf]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/kernel_sysctl.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf with {:links=>"manage", :source_permissions=>"use"} Notice: /Stage[first]/Initialization::Kernel_selinux_disabled/Exec[permissive_selinux]/returns: executed successfully Notice: /Stage[first]/Initialization::Kernel_sysctl_config/Exec[accept_sysctl.conf]: Dependency File[transfer_sysctl.conf] has failures: true Warning: /Stage[first]/Initialization::Kernel_sysctl_config/Exec[accept_sysctl.conf]: Skipping because of failed dependencies Error: /Stage[first]/Initialization::Kernel_selinux_disabled/File[transfer_selinux_config]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/selinux_config_file: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/selinux_config_file with {:links=>"manage", :source_permissions=>"use"} Notice: /Stage[first]/Initialization::Kernel_selinux_disabled/Notify[selinux_config Done]: Dependency File[transfer_selinux_config] has failures: true Warning: /Stage[first]/Initialization::Kernel_selinux_disabled/Notify[selinux_config Done]: Skipping because of failed dependencies Error: /Stage[first]/Initialization::Kernel_file_descriptor/File[90-nproc.conf]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/90-nproc.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/90-nproc.conf with {:links=>"manage", :source_permissions=>"use"}
重点:Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf
提示为授权的资源获取,那么就和 fileserver.conf 中的配置有关系了。检查里面关于特定目录的allow选项(或者临时的 * 放开全部)。
解决了。
转载于:https://blog.51cto.com/professor/1739384