How can I migrate our existing puppet clients to point to a new puppetmaster server? I'd rather not manually go to each client box and generate a new certificate.
When trying the obvious -- rsync all the files from /etc/puppet and /var/lib/puppet to the new server -- we got the certificate error
/etc/init.d/puppetmaster start * Starting puppet master Could not run: Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key
I was able to work around that by copying the
/var/lib/ssl/private_key files from
new_hostname, which is basically what's suggested in
migrating puppet clients to a new puppet master (old puppet master server gone, only using backup)
Unfortunately, my clients still know there's something amiss, and give me the following error:
sudo puppetd --test --server newservername.example.net --noop info: Retrieving plugin err: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': hostname was not match with the server certificate err: /File[/var/lib/puppet/lib]: Could not evaluate: hostname was not match with the server certificate Could not retrieve file metadata for puppet://newservername.example.net/plugins: hostname was not match with the server certificate err: Could not retrieve catalog from remote server: hostname was not match with the server certificate warning: Not using cache on failed catalog err: Could not retrieve catalog; skipping run
So I'm guessing the client certificates still know the hostname they're associated with, and aren't happy about a switch.
Is there a way to use puppet (pointing to the legacy puppetmaster) to deploy new certificates, or somehow automate the signing process?
Two solutions were presented: 1) turn on
autosign on the master, thus skipping certification entirely, or 2) set the old CNAME to point to the new master, since certificates are bound to the master's hostname. I chose #2 because autosign felt like it was just turning off security (albeit for a limited time).