Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Puppet requires certificates between the client (puppet) being managed and the server (puppetmaster). You can run manually on the client and then go onto the server to sign the certificate, but how do you automate this process for clusters / cloud machines?

share|improve this question

migrated from stackoverflow.com Apr 30 '10 at 8:18

This question came from our site for professional and enthusiast programmers.

1  
One corner case problem is when you re-use a hostname. Autosigning won't solve that. I am having this same issue. –  Joel K Apr 11 '11 at 22:48
add comment

4 Answers 4

up vote 22 down vote accepted

On the server (puppetmaster) run:

puppetca --generate <NAME>

Then copy the following from the server onto the client:

/var/lib/puppet/ssl/certs/<NAME>.pem
/var/lib/puppet/ssl/certs/ca.pem
/var/lib/puppet/ssl/private_keys/<NAME>.pem

If you wish to sign <NAME> as something other than the hostname use:

puppetd --fqdn=<NAME>

And add to /etc/puppet/puppet.conf if running the daemon

[puppetd]
certname=<NAME>
share|improve this answer
    
That's really useful, thanks. I'd been puzzling over that myself. –  Jon Topper Oct 6 '08 at 16:01
add comment

Simple answer: automatically sign new requests. This of course is dangerous because you're blindly trusting any system that connects to your puppetmaster, which is the purpose for requiring manual signing.

[puppetmasterd]
autosign = true

You can specify false and a file to use to determine which keys to sign, too.

See the configuration reference on the Puppet wiki.

Another option is to use a tool like Capistrano, where you specify the puppetmaster node and create the client instance nodes, and in the task:

  • Create the instance node, say with EC2's API with Ruby.
  • Run puppetd on the instance, connecting to the server.
  • Run puppetca --sign for the instance's request (since we know the instance name as it was given in the creation bit above).
  • Run puppetd again on the instance, this time successfully connecting as the certificate is signed.
share|improve this answer
    
Note: If you are using Puppet 2.6 or above, the [puppetmasterd] section heading should now be [master]. See docs.puppetlabs.com/guides/tools.html for more information. –  MrLore Feb 13 '13 at 9:44
add comment

If you have a host database, you can use the autosign feature. In your puppet.conf file, in the [puppetmasterd], add:

autosign = /path/to/autosign.conf

Then use a crontab to generate this file. The autosign file is just a list of hosts to autosign when they first connect to the puppetmaster. I use LDAP to configure my puppet hosts, so my cron looks like:

* * * * * root /usr/bin/ldapsearch -x '(objectClass=puppetClient)' cn | /bin/grep ^cn | /bin/sed 's!^cn: !!' > /etc/puppet/autosign.conf

I'm sure people who use iClassify would be able to write a query to do the same.

Of course, you need to have some trust in the network. I use this on EC2. My puppetmaster server is in a group that only allows connections from other trusted groups. I wouldn't recommend doing this if your puppetmaster is open to the internet.

share|improve this answer
add comment

On the server (puppetmaster) run:

puppetca --generate <NAME>

Then copy the following from the server onto the client:

/var/lib/puppet/ssl/certs/<NAME>.pem
/var/lib/puppet/ssl/certs/ca.pem
/var/lib/puppet/ssl/private_keys/<NAME>.pem

If you wish to has as something other than the hostname use:

puppetd --fqdn=<NAME>

And add to /etc/puppet/puppet.conf if running the daemon

[puppetd]
certname=<NAME>
share|improve this answer
    
This just seems more complicated to me. You install puppet on the client, it generates a certificate and sends it to the master for signing. When you sign it on the master, the client will start working the next time it runs. This involves less steps. If you really want to save even this step, you can run a cron job that does something like: for host in $(puppetca --list); do puppetca --sign $host; done –  David Pashley Jun 4 '09 at 7:02
    
This is fine if you have one or two machines, but when you are starting and stopping machines in the cloud you don't want to have to do this manually, I can start a base machine, run a script which goes in and sets everything up via puppet without having to login to the puppet master. –  Ranguard Jun 5 '09 at 12:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.