主页 / server / 问题

问题[puppetmaster](server)

Martin Hope
Jorge Mauricio
Asked: 2022-02-28 14:28:23 +0800 CST
  • 1

我对 devops/ci/cd 很陌生，所以请耐心等待。

目前，我正在为 docker 图像验证设置一个 puppet manifest 配置。让我尝试布局它：

我有一个具有以下配置的 puppet master 服务器：

  • Puppetmaster 版本：5.5.10-4ubuntu3
  • 两台服务器都是linux 20.04
  • 全部托管在 AWS 上

/etc/puppet/code/environments/production/manifests/site.pp

node default {
    include 'docker'
    docker::image { 'jorgemauriciodev/ubuntu-dockerfile-dev-v1': }
}

每次在 .pp 中尝试新的验证命令时，我都会使用以下命令重新启动 puppet master 服务器：sudo systemctl restart puppet-master

我在我的两台服务器（代理和主服务器）上都安装了一个名为 garethr-docker 的模块。

在从/代理服务器上，我有这个镜像 docker 镜像存在并正在运行：jorgemauriciodev/ubuntu-dockerfile-dev-v1 第一步，我只想检查我的从属服务器中是否存在该镜像。稍后，我将确定它正在运行或使用 Dockerfile 构建。

在从/代理服务器上，我运行：sudo puppet agent –test

我收到以下错误消息：

错误：无法从远程服务器检索目录：服务器上的错误 500：服务器错误：评估错误：评估函数调用时出错，找不到类 ::docker 用于 ip-123-123-123-123.us-east- 2.compute.internal（文件：/etc/puppet/code/environments/production/manifests/site.pp，行：2，列：5）在节点 ip-123-123-123-123.us-east-2 .compute.internal 警告：未在失败的目录上使用缓存错误：无法检索目录；跳过跑步

有人知道我对 puppet 清单文件有什么问题吗？

编辑1：

我做了一些建议的更改。现在，我的文件有一个不同的名称并更改了内容：/etc/puppet/code/environments/production/manifests/init.pp

include 'docker'
class { 'docker':
  version => 'latest',
}
docker::image { 'jorgemauriciodev/ubuntu-dockerfile-dev-v1': }

仍然返回相同的错误消息。

这是完整的消息：

/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:315: warning: deprecated Object#=~ is called on Puppet::Transaction::Report; it always returns nil
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:315: warning: deprecated Object#=~ is called on Puppet::Transaction::Report; it always returns nil
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:315: warning: deprecated Object#=~ is called on Puppet::Transaction::Report; it always returns nil
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/indirector/request.rb:272: warning: URI.unescape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
Info: Retrieving plugin
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:315: warning: deprecated Object#=~ is called on Puppet::Transaction::Report; it always returns nil
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/indirector/request.rb:272: warning: URI.unescape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
Info: Retrieving locales
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:315: warning: deprecated Object#=~ is called on Puppet::Transaction::Report; it always returns nil
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/indirector/request.rb:272: warning: URI.unescape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Function Call, Could not find class ::docker for ip-172-31-21-116.us-east-2.compute.internal (file: /etc/puppet/code/environments/production/manifests/init.pp, line: 1, column: 1) on node ip-172-31-21-116.us-east-2.compute.internal
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
/usr/lib/ruby/vendor_ruby/puppet/file_system/uniquefile.rb:126: warning: $SAFE will become a normal global variable in Ruby 3.0
/usr/lib/ruby/vendor_ruby/puppet/util.rb:461: warning: URI.escape is obsolete
/usr/lib/ruby/vendor_ruby/puppet/file_system/uniquefile.rb:126: warning: $SAFE will become a normal global variable in Ruby 3.0

编辑2：

我使用以下命令在主服务器和从/代理服务器上安装了更多模块：

sudo puppet module install puppetlabs-docker --version 4.1.2

它仍然向我返回一条错误消息，但现在似乎它是一个不同的消息。所以，现在可能是一个语法问题。

这是消息的重要部分。

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: Class[Docker] is already declared; cannot redeclare (file: /etc/puppet/code/environments/production/manifests/init.pp, line: 3) (file: /etc/puppet/code/environments/production/manifests/init.pp, line: 3, column: 1) on node ip-123-123-123-123.us-east-2.compute.internal
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

除了这条消息，它仍然向我返回那些警告，但列表要大得多。但是，我认为目前这不是问题。

ubuntu puppet devops puppetmaster puppet-agent
Martin Hope
Tombart
Asked: 2021-10-01 00:48:22 +0800 CST
  • 0

我正在尝试使用循环 DNS 来扩展 puppetserver，以获得冗余。次要puppetserver（版本7.4.0）配置为使用来自主要的 CA 权限puppetserver：

/etc/puppetlabs/puppet/puppet.conf：

[main]
ca_name = Puppet CA: puppet-ca-master.company.com
ca_server = puppet-ca-master.company.com
[agent]
server = puppet-ca-master.company.com
runinterval=1800

在辅助服务器上，我禁用了 CA 服务，因为在以下位置可能只有一个证书颁发机构/etc/puppetlabs/puppetserver/services.d/ca.cfg：

# To enable the CA service, leave the following line uncommented
# puppetlabs.services.ca.certificate-authority-service/certificate-authority-service
# To disable the CA service, comment out the above line and uncomment the line below
puppetlabs.services.ca.certificate-authority-disabled-service/certificate-authority-disabled-service
puppetlabs.trapperkeeper.services.watcher.filesystem-watch-service/filesystem-watch-service

我已经从辅助服务器中删除了证书，以便从 CA 主服务器获取证书签名证书：

rm -rf /etc/puppetlabs/puppet/ssl && mkdir -p /etc/puppetlabs/puppet/ssl/certs
chmod 0700 /etc/puppetlabs/puppet/ssl
chown -R puppet /etc/puppetlabs/puppet/ssl

但是，puppetserver由于缺少证书，服务拒绝启动：

2021-09-30T09:06:18.220+02:00 ERROR [async-dispatch-2] [p.t.internal] Error during service start!!!
java.lang.IllegalArgumentException: Unable to open 'ssl-cert' file: /etc/puppetlabs/puppet/ssl/certs/secondary-puppetserver.company.com.pem

当我尝试puppet agent -t在辅助 puppetserver 上运行时，它无法签署证书：

Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (secondary-puppetserver.company.com)

此外，会生成私钥，但不会生成公钥：

ll /etc/puppetlabs/puppet/ssl/public_keys/
total 0
puppet ssl-certificate puppetmaster
Martin Hope
Steve Shipway
Asked: 2020-08-27 20:51:24 +0800 CST
  • 0

Zabbix 允许通过 JMX 监控指标。

Puppet 服务器通过 jolokia on 提供 JMX 指标https://puppetserver:8140/metrics/v2，使用自己的 CA 作为证书。

我在 Zabbix 中配置了我的 Puppetserver 主机，其 DNS 名称和端口 8140 上的 JMX 接口。

我已经为此主机配置了一个 Zabbix 监控项，类型为JMX Agent，带有 Keyjmx["puppetserver:name=puppetlabs.{HOST.DNS}.jruby.num-free-jrubies",Value]

但是，查询永远不会找到任何数据，并且主机的代理指示符仍然是灰色的。

主机之间肯定有连通性，我可以从 Zabbix 主机连接到端口。Puppetserver 上没有自定义 auth 配置，所以对这个属性有匿名读取访问权限，我已经通过主机上的单独脚本验证了这一点。

问题是因为证书 CA，还是因为它使用了 https，或者是由于特定的端点，还是因为其他一些原因？

如何配置 Zabbix 以通过 JMX 监控 Puppetserver 指标，还是不可能？

jmx zabbix puppetmaster
Martin Hope
macosta
Asked: 2020-01-29 06:04:23 +0800 CST
  • 0

尝试基于可用于测试目的的最新 puppet/agents 构建基础架构。

因此，我一直在尝试在节点上运行 puppet 代理，但我目前遇到以下错误，puppet master 目前正在全新安装的 Foreman 1.24（EC2 实例）上运行，并且似乎可以正常运行代理，没有任何问题，关于特工的不同故事。

我能够从主机上的节点（代理）访问并签署证书，但除了收到错误之外别无他法。

root@puppetagent02:~# puppet agent -t
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Info: Retrieving pluginfacts
Error: /File[/var/cache/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Error: /File[/var/cache/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Info: Retrieving plugin
Error: /File[/var/cache/puppet/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Error: /File[/var/cache/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
root@puppetagent02:~#
puppet puppetmaster puppet-agent puppet-foreman
Martin Hope
Kiran
Asked: 2016-09-15 15:47:14 +0800 CST
  • 3

我在 Centos 7.2 上使用带有 Puppet Master 的 WSUS 模块。我的 Puppet 代理服务器正在运行 Windows Server 2012。

我想使用带有变量的清单。但是，当 Puppet Agent 服务器运行 puppet 代理时，它会显示“错误 400，语法错误”。我已经尝试重写清单和我能想到的每一个变化。我不断收到一些错误。

这是清单的一个示例：

class excellent {
    class { 'wsus_client':
       $cool = 'Saturday'
    server_url => 'http://acme.com',
    auto_update_option  => 'Scheduled'
    scheduled_install_day => $cool,
    scheduled_install_hour => 1,
}
}

我尝试在大括号 {} 中分配变量。我尝试使用 $LOAD_PATH、--custom-dir 和 FACTERLIB。但我不知道如何使用这三个中的任何一个。

我想在一个地方更改变量并在其父类的范围内使用它。我应该怎么办？

environment-variables puppet wsus centos7 puppetmaster
Martin Hope
Zama Ques
Asked: 2016-07-01 02:23:57 +0800 CST
  • 1

我的 Puppet 服务器环境设置如下

[master]
vardir = /opt/puppetlabs/server/data/puppetserver
logdir = /data/log/puppetlabs/puppetserver
rundir = /var/run/puppetlabs/puppetserver
pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
codedir = /data/puppetlabs/code

#  puppet master --configprint manifest
/data/puppetlabs/code/environments/production/manifests

在代理上如下

server = jw-host
environment = production

但是 --configprint 在代理节点上显示不同的位置

# puppet master --configprint manifest
/etc/puppetlabs/code/environments/production/manifests

它没有更改为 /data，因为我的清单没有得到应用。

版本如下

 # puppetserver  --version
  puppetserver version: 2.4.0
 # puppet  --version
  4.5.2

这里有什么问题？

puppet puppetmaster puppet-agent
Martin Hope
Zama Ques
Asked: 2016-06-23 01:44:47 +0800 CST
  • 1

我们使用共享的 Puppet Server 来管理 QA 和 DEV 环境。Puppet Server 使用的默认配置是生产环境

# puppet master --configprint all | grep production

environment = production
manifest = /data/puppetlabs/code/environments/production/manifests
modulepath = /data/puppetlabs/code/environments/production/modules:/data/puppetlabs/code/modules:/opt/puppetlabs/puppet/modules

我想启用另外两个环境 DEV 和 QA。为此，我将复制上述目录并分别重命名为 Puppet Server 上的环境qa。development启用哪些配置项以启用puppet.confPuppet Server 中的新环境。如果我像上面的示例那样创建多个条目，它将起作用。请建议。

puppet puppetmaster
Martin Hope
Zama Ques
Asked: 2016-06-22 02:34:19 +0800 CST
  • 1

我使用四个节点进行了 Puppet/MCollective 设置。

  # mco ping
  Node-010.test.com                   time=107.58 ms
  Node-003.test.com                   time=110.68 ms
  Node-009.test.com                   time=114.42 ms
  Node-002.test.com                   time=116.49 ms

#mco puppet runonce 工作正常，但没有应用清单。

  # mco puppet runonce
  * [ ============================================================> ] 4 / 4
  Finished processing 4 / 4 hosts in 151.61 ms

我的清单配置如下：

   # puppet master --configprint manifest
   /etc/puppetlabs/code/environments/production/manifests

我的 Site.pp 如下

  # cat /etc/puppetlabs/code/environments/production/manifests/site.pp
node default {
}
node 'Node-002.test.com'{
file {"/tmp/helloworld.txt":
      ensure => file,
      owner  => 'root',
      group  => 'root',
      mode   => '0644',
      content =>" Hi ",
   }
  }

Site.pp 没有得到应用。

从日志文件看，它似乎正在从缓存中读取并申请不存在规则的节点。

  ` # tail -f /var/log/puppetlabs/puppetserver/puppetserver.log
2016-06-21 20:21:06,355 INFO  [qtp1367105977-65] [puppet-server] Puppet    Compiled catalog for Node-009.test.com in environment qa in 0.04 seconds
2016-06-21 20:21:08,223 INFO  [qtp1367105977-65] [puppet-server] Puppet Caching node for Node-002.test.com
2016-06-21 20:21:08,618 INFO  [qtp1367105977-69] [puppet-server] Puppet Caching node for Node-002.test.com

我是否遇到了一些错误或缺少一些配置项？

puppet puppetmaster mcollective