Configuring puppet master and agent to sign certificates
While working with Puppet for the first time, often it could happen that due to various issues, we will not be able to complete basic configurations and hence spend lot of time debugging problem. This blog is an attempt to cut short those issues that are usually faced while configuring puppet master and agent and finally sign certificates.
Some of the usual issues faced are while running
puppet agent --test command below exception occur.
Could not
request certificate: The certificate retrieved from the master does not match
the agent's private key
Could not
request certificate: getaddrinfo: Name of service not known
Below steps can be followed for smooth configurations.
1) Make sure in both master and agent
machine you resolve the hosts by going to
/etc/hosts
file as given below:
10.2.3.4 puppet
10.2.3.5 node
Note here
any host name and agent name can be given for your reference.
2) Set variables in puppet.conf in
master and agent machine.
In master machine (linux)
/etc/puppetlabs/puppet/puppet.conf
dns_alt_names
= puppet
certname=puppetcert
environment=prod
Note here
that dns_alt_name should be matching host name given in step(1).
certname can
be any name to your certificate
environment
is optional variable.
In Agent
/etc/puppetlabs/puppet/puppet.conf
server=puppet
certname=node1
Note here
server should be matching puppet host name provided. In this example it is “puppet”
And again
certname can be any name to your certificate.
3 3) Restart both master and agent
machine as you have resolved hosts.
4) Start puppet server in master
machine with this command.
systemctl start
puppetserver
check status of puppetserver
systemctl
status puppetserver
puppetserver.service - puppetserver Service
Loaded: loaded (/lib/systemd/system/puppetserver.service; enabled;
vendor preset: enabled)
Active: active (running) since Wed 2018-11-07 18:29:03 IST; 16s ago
Process: 2710
ExecStart=/opt/puppetlabs/server/apps/puppetserver/bin/puppetserver start
(code=exited, status=0/SUCCESS)
Main
PID: 2727 (java)
Tasks: 26 (limit: 4915)
Memory: 1.2G
CPU: 1min 42.519s
CGroup: /system.slice/puppetserver.service
└─2727 /usr/bin/java -Xms3g -Xmx3g -XX:MaxPermSize=256m
-Djava.security.egd=/dev/urandom -XX:OnOutOfMemoryError=kill -9 %p -cp
/opt/puppetlabs/server/apps/p
Nov 07 18:27:16 master systemd[1]: Starting
puppetserver Service...
Nov 07 18:27:16 master puppetserver[2710]:
OpenJDK 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was
removed in 8.0
Nov 07 18:29:03 master systemd[1]: Started
puppetserver Service.
Above will
confirm that service is up and running.
5) Start agent puppet with this command
puppet resource
service puppet ensure=running enable=true
Notice: /Service[puppet]/ensure: ensure changed
'stopped' to 'running'
service { 'puppet':
ensure
=> 'running',
enable
=> 'true',
}
Above will
confirm that agent is running.
6) Now test agent by calling this
command to generate certificate at node/agent
puppet agent --test
Ignore any
error that appears
7) Now come to master machine and apply
certificate using this command
sudo
/opt/puppetlabs/bin/puppet cert list
"agentcert1" (SHA256)
76:DD:B1:02:16:D7:BA:0F:AB:46:28:D9:7D:D4:75:DF:F7:52:D3:19:65:11:C9:B1:F7:5D:75:1B:DB:2E:3A:39
"node" (SHA256)
6C:D1:8C:40:A1:52:C6:F7:CE:44:FB:35:8C:EB:12:3D:2E:C8:F9:09:6B:CE:69:C7:D8:15:DA:A5:6E:17:8E:3B
"slave.domain.name" (SHA256)
A8:F8:AC:DB:8F:65:F0:B9:A5:37:23:F0:FC:1F:27:23:AB:C4:F2:5A:FB:4E:50:6B:55:3D:37:54:C1:0E:85:F8
Above we can see that all the certificates are listed which are yet to be signed. Since we have certificate with name "node" given for agent we can sign that.
Sign certificate
using this command:
sudo /opt/puppetlabs/bin/puppet cert sign node
"agentcert1" (SHA256)
76:DD:B1:02:16:D7:BA:0F:AB:46:28:D9:7D:D4:75:DF:F7:52:D3:19:65:11:C9:B1:F7:5D:75:1B:DB:2E:3A:39
"node" (SHA256)
6C:D1:8C:40:A1:52:C6:F7:CE:44:FB:35:8C:EB:12:3D:2E:C8:F9:09:6B:CE:69:C7:D8:15:DA:A5:6E:17:8E:3B
"slave.domain.name" (SHA256)
A8:F8:AC:DB:8F:65:F0:B9:A5:37:23:F0:FC:1F:27:23:AB:C4:F2:5A:FB:4E:50:6B:55:3D:37:54:C1:0E:85:F8
8) Now certificate is signed. And again
when you run agent test command at agent it will apply the catalog:
sudo
/opt/puppetlabs/bin/puppet agent –test
Info:
Caching certificate for node
Info:
Caching certificate for node
Info: Using
configured environment 'production'
Info:
Retrieving pluginfacts
Info:
Retrieving plugin
Info:
Caching catalog for node
Info:
Applying configuration version '1541597092'
Notice:
/Stage[main]/Main/File[/tmp/it_works.txt]/ensure: defined content as
'{md5}c8efc631283aebe758b494818c5842a1'
Notice:
Applied catalog in 0.10 seconds
If you have any questions about this do write in comment below.
Thank you.