Versuch, eine Infrastruktur auf Grundlage der aktuellsten, zu Testzwecken verfügbaren Puppets/Agents aufzubauen.
Ich habe also versucht, Puppet Agent auf einem Knoten auszuführen und erhalte derzeit die folgenden Fehlermeldungen: Puppet Master läuft derzeit auf einer Neuinstallation von Foreman 1.24 (EC2-Instanz) und scheint den Agenten problemlos auszuführen. Bei den Agenten sieht die Sache anders aus.
Ich kann die Zertifikate von den Knoten (Agenten) auf dem Master erreichen und signieren, aber danach passiert nichts außer den Fehlermeldungen.
root@puppetagent02:~# puppet agent -t
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Info: Retrieving pluginfacts
Error: /File[/var/cache/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Error: /File[/var/cache/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Info: Retrieving plugin
Error: /File[/var/cache/puppet/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Error: /File[/var/cache/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: puppetmaster.domain.com]
root@puppetagent02:~#
Antwort1
Ich habe das Problem also durch ein einfaches Downgrade auf „Stretch“ gelöst, das über das neueste Paket des Puppet-Agenten verfügt und nun ohne Probleme funktioniert.