开源 Puppet Master 设置问题导致无法获取 /CN=puppet 的本地颁发者证书

Question

我不得不放弃使用 PE 来设置我的人偶大师:( 我被扔进了冷酷无情的开源人偶世界。我一直在尝试在 RHEL7 系统上设置一个开源 puppet master。我打算这样做几次，所以写了一个非常简单的 shell 脚本。这是脚本：

#!/bin/sh

pc_rpm_name='puppetlabs-release-pc1'
pc_yum_repo_url="https://yum.puppetlabs.com/${pc_rpm_name}-el-7.noarch.rpm"

# set up puppet collection yum repo
rpm -Uvh $pc_yum_repo_url
yum -y install puppetserver
systemctl start puppetserver
/opt/puppetlabs/bin/puppet module install puppetlabs-puppetdb --version 5.1.2

我有一个木偶大师木偶class我写的很简单：

class my_puppetmaster {
    class { 'puppetdb': listen_address => %{::fqdn} }" 
    include puppetdb::master::config
}

我想为我的节点使用 hiera class化，所以我这样做了：

# pwd
/etc/puppetlabs/code/environments/production/manifests
# cat site.pp 
hiera_include('classes')

我也创建了这个文件：

# pwd
/etc/puppetlabs/code/environments/production/hieradata/nodes
# cat puppet_master.yaml 
classes:
  - my_puppetmaster

这是我的 hiera.yaml 文件：

# pwd
/etc/puppetlabs/puppet
# head hiera.yaml
---
:backends:
  - yaml
:hierarchy:
  - "nodes/%{::trusted.certname}"
  - "nodes/%{::role}"
...

我还没有时间设置自定义事实。我想我可以通过重新启动系统来测试一下，让所有的东西都好好摇晃一下，然后运行ning puppet agent -t 看看会发生什么。当我在 puppet master 上运行 puppet agent -t 时，我得到这个输出：

Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
Info: Retrieving pluginfacts
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
Info: Retrieving plugin
Error: /File[/opt/puppetlabs/puppet/cache/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]

我想我在设置脚本中遗漏了一些东西。那么……我错过了什么？

谢谢红色

Answer 1

我忘记更新我的 puppet.conf。我有 "server = puppet" 我需要将其更改为 "server = fqdn of my puppet master"

开源 Puppet Master 设置问题导致无法获取 /CN=puppet 的本地颁发者证书

Opensource Puppet Master Setup Issue causing unable to get local issuer certificate for /CN=puppet

puppet