Puppet

將多個 puppet master 連接到一個 puppetdb

  • July 13, 2017

我在我的一個 puppetmaster 上安裝了一個 puppetdb，它可以工作。但我無法將第二個連接到木偶大師。

命令“puppet agent -t”適用於我的第二個主人。

每個主節點處理自己的節點（它們不是 LB）。

這是我執行 puppet 代理命令時的 puppetserver.log：

2017-06-22 15:48:21,255 ERROR [qtp1178717687-64] [c.p.h.c.i.PersistentSyncHttpClient] Error executing http request
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
       at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431) ~[na:1.8.0_65]
       at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) ~[na:1.8.0_65]
       at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1214) ~[na:1.8.0_65]
       at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1186) ~[na:1.8.0_65]
       at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469) ~[na:1.8.0_65]
       at org.apache.http.nio.reactor.ssl.SSLIOSession.doWrap(SSLIOSession.java:263) ~[puppet-server-release.jar:na]
       at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:303) ~[puppet-server-release.jar:na]
       at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:507) ~[puppet-server-release.jar:na]
       at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:122) ~[puppet-server-release.jar:na]
       at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:164) ~[puppet-server-release.jar:na]
       at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:339) ~[puppet-server-release.jar:na]
       at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:317) ~[puppet-server-release.jar:na]
       at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:278) ~[puppet-server-release.jar:na]
       at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:106) ~[puppet-server-release.jar:na]
       at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:590) ~[puppet-server-release.jar:na]
       at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_65]
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
       at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_65]
       at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728) ~[na:1.8.0_65]
       at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304) ~[na:1.8.0_65]
       at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) ~[na:1.8.0_65]
       at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509) ~[na:1.8.0_65]
       at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[na:1.8.0_65]
       at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[na:1.8.0_65]
       at sun.security.ssl.Handshaker$1.run(Handshaker.java:919) ~[na:1.8.0_65]
       at sun.security.ssl.Handshaker$1.run(Handshaker.java:916) ~[na:1.8.0_65]
       at java.security.AccessController.doPrivileged(Native Method) ~[na:1.8.0_65]
       at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369) ~[na:1.8.0_65]
       at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:281) ~[puppet-server-release.jar:na]
       at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:351) ~[puppet-server-release.jar:na]
       ... 9 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
       at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) ~[na:1.8.0_65]
       at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) ~[na:1.8.0_65]
       at sun.security.validator.Validator.validate(Validator.java:260) ~[na:1.8.0_65]
       at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[na:1.8.0_65]
       at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[na:1.8.0_65]
       at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[na:1.8.0_65]
       at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496) ~[na:1.8.0_65]
       ... 17 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
       at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146) ~[na:1.8.0_65]
       at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131) ~[na:1.8.0_65]
       at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ~[na:1.8.0_65]
       at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) ~[na:1.8.0_65]
       ... 23 common frames omitted

我在 jetty.ini 有預設配置：

[jetty]
# IP address or hostname to listen for clear-text HTTP. To avoid resolution
# issues, IP addresses are recommended over hostnames.
# Default is `localhost`.
# host = <host>

# Port to listen on for clear-text HTTP.
port = 8080


# The following are SSL specific settings. They can be configured
# automatically with the tool `puppetdb ssl-setup`, which is normally
# ran during package installation.

# IP address to listen on for HTTPS connections. Hostnames can also be used
# but are not recommended to avoid DNS resolution issues. To listen on all
# interfaces, use `0.0.0.0`.
ssl-host = 0.0.0.0

# The port to listen on for HTTPS connections
ssl-port = 8081

# Private key path
ssl-key = /etc/puppetdb/ssl/private.pem

# Public certificate path
ssl-cert = /etc/puppetdb/ssl/public.pem

# Certificate authority path
ssl-ca-cert = /etc/puppetdb/ssl/ca.pem

這是我第二個主人的 puppetdb.conf ：

[main]
server_urls = https://puppetmaster01.domain.com:8081

當我第一次啟動 puppetdb ssl-setup 時，它說它從 /etc/puppetlabs/puppet/ssl 複製了 puppetmaster ssl（ca、私有和公共）。所以我嘗試從我的 master02 複製這些並將其添加到碼頭中指定的 3 個文件中，但它不起作用。

謝謝你的幫助！

**編輯：**我找到了一個文件，告訴我必須使用 CA 證書。所以我用那個命令生成了一個 CA 證書：

puppet cert generate puppetmaster01.domain.com --allow-dns-alt-names  --dns_alt_names=puppetmaster.domain.com,puppetmaster01.domain.com,puppetmaster02.domain.com

在我使用這個為 puppetdb 設置 ssl 之後：

puppetdb ssl-setup -f

第一個問題：我的主人工作，我在 ssl/certs 的節點上複製了 ssl/certs/ca.pem，他們能夠生成新的 SSL，但我的主人從未收到它。

第二個問題：我將所有 SSL 目錄從我的第一個主人復製到第二個，我用好名字重命名了 SSL 文件，但是當我啟動我的 puppet 代理 -t 時，我明白了：

Error: Could not retrieve catalog from remote server: Error 403 on SERVER: Forbidden request: puppetmaster01.domain.com(IP_MASTER_02) access to /puppet/v3/catalog/puppetmaster02.domain.com [find] authenticated  at :68
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: Error 403 on SERVER: Forbidden request: puppetmaster01.domain.com(172.27.15.24) access to /puppet/v3/report/puppetmaster02.domain.com [save] authenticated  at :78

就像它試圖獲取 master01 而不是 02 的資訊……

我找到瞭如何使用 CA，您只需將 repo puppet/ssl/ca 放在您的其他伺服器上並重新生成 SSL。

所以在你使用的第一個主人：puppet cert generate puppetmaster01.domain.com –allow-dns-alt-names –dns_alt_names=puppetmaster.domain.com,puppetmaster01.domain.com,puppetmaster02.domain.com

複製第二個主伺服器上的所有 puppet/ssl/ca 並為此重新生成 ssl：puppet cert generate puppetmaster02.domain.com

引用自：https://serverfault.com/questions/857360

相關問答

Puppet

Puppet 6：由於 clojure/java 錯誤，PuppetDB 無法啟動

  • November 8, 2018
檢視問答
Puppet

如何降級 puppetdbquery？

  • January 13, 2016
檢視問答
Puppet

重複聲明：Exec已在定義類型中聲明

  • December 17, 2014
檢視問答
Ubuntu

Puppet 沒有應用配置但返回沒有錯誤

  • September 22, 2014
檢視問答
Ubuntu

用於 docker 鏡像驗證的 Puppet manifest 配置

  • February 28, 2022
檢視問答
Ssl-Certificate

如何為（輔助）編譯 puppetserver 生成證書？

  • September 30, 2021
檢視問答