Tag Info

Hot answers tagged

15

So... this is a bit embarrassing, but... Environments. Right there in my /etc/puppet.conf file is this: [master] manifest=$confdir/manifests/site.pp modulepath=$confdir/environments/$environment/modules:$confdir/modules After throwing strace at it to figure out where it was hunting for files, I noticed something. It was looking for custommod under ...


11

What you're looking to do is called a template. It's a core feature of Puppet, and very useful. You write a file in eRB format that can use Ruby code and Facter variables to build a file. Here's an example: file { '/etc/my_config_file': ensure => present, owner => 'root', group => 'root', mode => 0700, content => ...


8

I just had to solve this problem... There are a few approaches... Use cron. If you have an OS that supports cron.d entries, distribute a puppet.cron file via Puppet. The accompanying manifest would have something that ensures that the Puppet daemon is off. If you have a lot of servers, use a bash function to randomize the cron pull time to reduce the load ...


8

Starting with puppet 3.0, the puppetca and other similar commands have been obsoleted. You may want to use puppet cert list instead.


8

Find out the FQDN of your puppetmaster by issuing: # openssl x509 -noout -subject -in /var/lib/puppet/ssl/ca/ca_crt.pem subject= /CN=Puppet CA: host.domain.com Compare with the output (if any) of: # puppet cert list --all Add an entry to your /etc/hosts file pointing the IP listening in the puppetmaster port (8140): 192.168.124.2 host.domain.com host ...


8

Yes you can delete them and I recommend it as well. The docs for Puppet dashboard aren't very opinionated on the ongoing maintenance of the dashboard, but it does need maintenance. I recommend a cron that delete reports in the database after a few days, a second one to remove any orphaned records, and a third to delete processed reports. Mine looks like ...


6

You have a duplicate group name, so all bets are off. puppet will be calling getgrnam(3), which in the case of duplicate group names will return one or the other: there's no way to tell what you'll get. Duplicate group names are a bad thing in all sorts of ways, the most obvious being that you don't know for sure how the permissions on your files will be ...


6

You can name your classes as you want, but you need to use the right name for resources. In this case, the resource you want to use is user. There is a very simple way to know how a resource should look: $ puppet resource user dawud user { 'dawud': ensure => 'present', comment => 'David Sastre Medina,,,', gid => '1001', groups => ...


6

Nope. Don't do this. If you're looking to scale puppet by having multiple masters, you're going the wrong way about it. I'm well aware that puppetlabs have produced a document that you linked saying how they recommend doing MM puppet, but it's actually far easier to go masterless. So the best way to scale puppet is to go masterless, where you have a ...


6

I've seen this issue on RedHat/CentOS. The puppet agent on the client machine would run out of file descriptors due to some ruby/puppet bug not closing them. After hitting the 1024 fd limit, it would not be able to run facter anymore, so the facts would be missing. If subsequent puppet runs from the same process don't fail, it probably is a different ...


6

I have a site.pp that looks like this: import "nodes/*.pp" and have a nodes/ directory in manifests/ So that I have a set of nodes in "workstations.pp" "webservers.pp" and so on..


6

http://docs.puppetlabs.com/references/2.6.11/type.html#file specifies you can do file{'/etc/my.cnf': source => [ "puppet:///mysql/etc/my.$hostname.cnf" , "puppet:///mysql/etc/my.cnf" ] }


5

Go decentralized. Instead of signing certificates, make ssh keys. Don't give the keys to non-admins You can use Git as your transport instead of subversion, and then you can branch for different machines/roles, and then version your changes, as well as allowing for... but you must know the DVCS spiel at this point. It's faster, and less finicky to set ...


5

You are using single quotes for 'shell/bash/$service_env.erb' which means that no variables will be interpolated. You must use double quotes.


5

Yes, just setup the cronjob that runs puppet to only run during certain hours. Running puppet as a daemon is a really terrible idea. We use the IP address of the server as the key into a hashing function to splay our cronjobs across the entire time period of our Puppet runs, to avoid a thundering herd problem.


5

Puppet uses a declarative language, not an instructive one. You are telling Puppet how you want the system to look, and then trusting that Puppet will do the right thing to put the system's state into compliance with your manifest(s). in your "apache" class, if you're using the standard method to install apache: package { "apache": ensure => ...


5

You need to use double quotes ("") instead of single quotes ('). Much like the shell, perl, and other languages, single quotes in Puppet indicate a literal string and inhibit variable interpolation and the interpretation of backslash-escapes. file { '/etc/sysconfig/vncserver': content => "VNCSERVERS=\"6:root\"\nVNCSERVERARGS[6]=\"-geometry ...


5

Re-create the entire client certificate setup. This has always fixed any cert issues we have experienced in the past. The following instruction assumes your agent's hostname is agenthost.hostname.com On the client, delete all stored certs, including the CA: find /var/lib/puppet/ssl -name '*.pem' -exec rm {} \; On the master, delete any pending CSRs or ...


4

Your client's expecting the master to have the hostname puppet, per its server configuration in puppet.conf - that's the default, so if you don't have a server configured then it's using puppet. The master's SSL certificate must be valid for that name, or the client will refuse to connect. Normally, the master generates a certificate that's valid for its ...


4

You can use a custom fact to distinguish between them, and resolve a template using that fact: class foo ( $role, ){ file { '/etc/security/access.conf': owner => 'root', group => 'root', mode => '644', content => template("$role.ldap/access-2.conf"), } } Using current facter version, it is easy to ...


4

Ressources cannot be nested. They can only have dependencies on each other.


4

The master doesn't send the file to the node; the node checks in with the master on the run interval. And yeah, no need to restart the master service to serve the new updates.


4

You'll need a forward and reverse DNS entry for the client. You could also add an /etc/hosts entry for the client on the puppetmaster.


4

I've seen this before when something has gone weird with the cert signing process. The easiest way to fix this is to regen the client certs. revoke the cert: puppetca revode client.example.com Run puppetca clean on the client stop puppet on the client remove everything in the /var/lib/puppet/ssl directory start puppet on the client do an initial run I ...


4

I just hit a similar issue on CentOS 6.3. The problem was dat/etime out of sync. I fixed that and all worked just fine.


4

Use the yum-versionlock plugin to lock the package version to what you want: yum install yum-versionlock To continue: If you have already installed puppet Now edit /etc/yum/pluginconf.d/versionlock.list and specify the version you want: puppet 2.7.19 puppet-server 2.7.19 Finally install it. Depending on your current situation, use only one of: yum ...


4

Yes, this has been done. See: Puppet: Only allow changes during certain hours? As far as the Git approach, you've probably seen this link.


4

You could add puppet to a cron job as normal (which allows you the option to only run it during working hours or more or less frequently than every half hour) but wrap it in a short script that checks whether the revision number of your source control has been incremented. If so, it fires off the puppet client, if not then there's no need for puppet (and ...


4

Define your nodes outside of manifests. I'd recommend extlookup's successor, Hiera, but really any external node classifier would suffice to move your node data out of manifests. This is the recommended way to handle node definitions these days - from the docs: Most users in most situations should use include-like declarations and set parameter values ...


4

This is the expected behaviour now according to Bug #16637. When running on the command line (as a non-root user) you will need to pass the --confdir parameter to override the default location of ~/.puppet/puppet.conf e.g.: puppet master --confdir /etc/puppet --no-daemonize --logdest console --verbose --debug If you have updated to Puppet 3 and had ...



Only top voted, non community-wiki answers of a minimum length are eligible