Question

我在一些测试服务器上设置Puppet：bruno是木偶大师，oppenheimer是代理。当我在bruno上启动服务器时，我得到了这个输出：

bruno$ sudo puppet cert list
"oppenheimer.home" (SHA256) D4:**:**:**:0B:2A

bruno$ sudo puppet master --verbose --no-daemonize
Notice: Starting Puppet master version 3.4.3

然后我开始在oppenheimer上启动代理：

oppenheimer$ sudo puppet agent --test --server=bruno
Exiting; no certificate found and waitforcert is disabled

当我再次查看bruno时：

Info: access[^/catalog/([^/]+)$]: allowing 'method' find
Info: access[^/catalog/([^/]+)$]: allowing $1 access
Info: access[^/node/([^/]+)$]: allowing 'method' find
Info: access[^/node/([^/]+)$]: allowing $1 access
Info: access[/certificate_revocation_list/ca]: allowing 'method' find
Info: access[/certificate_revocation_list/ca]: allowing * access
Info: access[^/report/([^/]+)$]: allowing 'method' save
Info: access[^/report/([^/]+)$]: allowing $1 access
Info: access[/file]: allowing * access
Info: access[/certificate/ca]: adding authentication any
Info: access[/certificate/ca]: allowing 'method' find
Info: access[/certificate/ca]: allowing * access
Info: access[/certificate/]: adding authentication any
Info: access[/certificate/]: allowing 'method' find
Info: access[/certificate/]: allowing * access
Info: access[/certificate_request]: adding authentication any
Info: access[/certificate_request]: allowing 'method' find
Info: access[/certificate_request]: allowing 'method' save
Info: access[/certificate_request]: allowing * access
Info: access[/]: adding authentication any
Info: Inserting default '/status' (auth true) ACL
Info: Not Found: Could not find certificate oppenheimer.home
Info: Not Found: Could not find certificate oppenheimer.home
Info: Not Found: Could not find certificate oppenheimer.home
Info: Not Found: Could not find certificate oppenheimer.home
Info: Not Found: Could not find certificate oppenheimer.home

请注意，在启动服务器之前，服务器bruno确实会显示代理oppenheimer的证书。那么为什么它找不到证书？

这是我在服务器上的配置：

bruno$ cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       bruno
10.0.0.7        bruno
10.0.0.10       oppenheimer

bruno$ cat /etc/puppet/puppet.conf 
[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
templatedir=$confdir/templates
prerun_command=/etc/puppet/etckeeper-commit-pre
postrun_command=/etc/puppet/etckeeper-commit-post

certificate_revocation=false
server=bruno

[master]
# These are needed when the puppetmaster is run by passenger
# and can safely be removed if webrick is used.
ssl_client_header = SSL_CLIENT_S_DN 
ssl_client_verify_header = SSL_CLIENT_VERIFY

这是代理上的配置：

oppenheimer$ cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       oppenheimer
10.0.0.7        bruno
10.0.0.10       oppenheimer

oppenheimer$ cat /etc/puppet/puppet.conf 
[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
templatedir=$confdir/templates
prerun_command=/etc/puppet/etckeeper-commit-pre
postrun_command=/etc/puppet/etckeeper-commit-post

certificate_revocation=false
server=bruno

[master]
# These are needed when the puppetmaster is run by passenger
# and can safely be removed if webrick is used.
ssl_client_header = SSL_CLIENT_S_DN 
ssl_client_verify_header = SSL_CLIENT_VERIFY

[agent]
server=bruno

这两台机器都在运行带有最新更新的Ubuntu Linux 14.04。

Answer 1

您必须签署证书。如果证书已经签名，则它不会显示在puppet cert list的输出中。

 # puppet cert sign oppenheimer.home

然后puppet agent应该成功运行。

希望这有帮助。

Puppet在列表中显示cert，但无法“找到”它

1 个答案: