Tag Info

Hot answers tagged

22

So... this is a bit embarrassing, but... Environments. Right there in my /etc/puppet.conf file is this: [master] manifest=$confdir/manifests/site.pp modulepath=$confdir/environments/$environment/modules:$confdir/modules After throwing strace at it to figure out where it was hunting for files, I noticed something. It was looking for custommod under ...


11

What you're looking to do is called a template. It's a core feature of Puppet, and very useful. You write a file in eRB format that can use Ruby code and Facter variables to build a file. Here's an example: file { '/etc/my_config_file': ensure => present, owner => 'root', group => 'root', mode => 0700, content => ...


9

Starting with puppet 3.0, the puppetca and other similar commands have been obsoleted. You may want to use puppet cert list instead. Quoting the actual entry: The legacy standalone executables, which were replaced by subcommands in Puppet 2.6, have been removed. Additionally, running puppet without a subcommand no longer defaults to puppet apply. ...


9

Concise answer The issue CRL is not yet valid for indicates that the time between the Puppet-agent and the Puppetmaster is out of sync. Remove the certificate from the Puppet-agent and Puppetmaster as well and run Puppet on the agent. Comprehensive answer CRL is not yet valid for resides in the following snippet. The following test code snippet ...


9

You're not specifying any resource dependencies so Puppet will apply the changes in a seemingly random order. If the java class should be installed before your cq::instance definitions, then you should add an explicit dependency like so: cq::instance { myauthor: installation_type => author, require => Class['java'] } Or even: ...


8

Find out the FQDN of your puppetmaster by issuing: # openssl x509 -noout -subject -in /var/lib/puppet/ssl/ca/ca_crt.pem subject= /CN=Puppet CA: host.domain.com Compare with the output (if any) of: # puppet cert list --all Add an entry to your /etc/hosts file pointing the IP listening in the puppetmaster port (8140): 192.168.124.2 host.domain.com host ...


8

I just had to solve this problem... There are a few approaches... Use cron. If you have an OS that supports cron.d entries, distribute a puppet.cron file via Puppet. The accompanying manifest would have something that ensures that the Puppet daemon is off. If you have a lot of servers, use a bash function to randomize the cron pull time to reduce the load ...


7

Re-create the entire client certificate setup. This has always fixed any cert issues we have experienced in the past. The following instruction assumes your agent's hostname is agenthost.hostname.com On the client, delete all stored certs, including the CA: find /var/lib/puppet/ssl -name '*.pem' -exec rm {} \; On the master, delete any pending CSRs or ...


6

You can name your classes as you want, but you need to use the right name for resources. In this case, the resource you want to use is user. There is a very simple way to know how a resource should look: $ puppet resource user dawud user { 'dawud': ensure => 'present', comment => 'David Sastre Medina,,,', gid => '1001', groups => ...


6

You have a duplicate group name, so all bets are off. puppet will be calling getgrnam(3), which in the case of duplicate group names will return one or the other: there's no way to tell what you'll get. Duplicate group names are a bad thing in all sorts of ways, the most obvious being that you don't know for sure how the permissions on your files will be ...


6

The most direct approach is running the agent with the --evaltrace flag like puppet agent --test --evaltrace This will give you a good idea of which resources are the most expensive. For your large files, you may want to experiment with different checksum alternatives.


6

The master doesn't send the file to the node; the node checks in with the master on the run interval. And yeah, no need to restart the master service to serve the new updates.


6

I just hit a similar issue on CentOS 6.3. The problem was dat/etime out of sync. I fixed that and all worked just fine.


6

http://docs.puppetlabs.com/references/2.6.11/type.html#file specifies you can do file{'/etc/my.cnf': source => [ "puppet:///mysql/etc/my.$hostname.cnf" , "puppet:///mysql/etc/my.cnf" ] }


6

Nope. Don't do this. If you're looking to scale puppet by having multiple masters, you're going the wrong way about it. I'm well aware that puppetlabs have produced a document that you linked saying how they recommend doing MM puppet, but it's actually far easier to go masterless. So the best way to scale puppet is to go masterless, where you have a ...


6

Go decentralized. Instead of signing certificates, make ssh keys. Don't give the keys to non-admins You can use Git as your transport instead of subversion, and then you can branch for different machines/roles, and then version your changes, as well as allowing for... but you must know the DVCS spiel at this point. It's faster, and less finicky to set ...


6

I have a site.pp that looks like this: import "nodes/*.pp" and have a nodes/ directory in manifests/ So that I have a set of nodes in "workstations.pp" "webservers.pp" and so on..


6

I've seen this issue on RedHat/CentOS. The puppet agent on the client machine would run out of file descriptors due to some ruby/puppet bug not closing them. After hitting the 1024 fd limit, it would not be able to run facter anymore, so the facts would be missing. If subsequent puppet runs from the same process don't fail, it probably is a different ...


5

I would use a template. Set your file resource to use content instead of source: content => template("mymodule/temp-conf-file.erb"), Then have the template substitute the hostname. The template would be located in the templates subdirectory of your module: # This file is managed by puppet ... random config stuff ... hostname = <%= hostname %> ...


5

You are using single quotes for 'shell/bash/$service_env.erb' which means that no variables will be interpolated. You must use double quotes.


5

You'll need a forward and reverse DNS entry for the client. You could also add an /etc/hosts entry for the client on the puppetmaster.


5

Yes, just setup the cronjob that runs puppet to only run during certain hours. Running puppet as a daemon is a really terrible idea. We use the IP address of the server as the key into a hashing function to splay our cronjobs across the entire time period of our Puppet runs, to avoid a thundering herd problem.


5

Puppet uses a declarative language, not an instructive one. You are telling Puppet how you want the system to look, and then trusting that Puppet will do the right thing to put the system's state into compliance with your manifest(s). in your "apache" class, if you're using the standard method to install apache: package { "apache": ensure => ...


5

CentOS 5 has a nifty way to rollback your system. On update, it can rebuild packages with the configs that are present at that time. Configure RPM to repackage packages that will be altered by adding the following line to /etc/rpm/macros: %_repackage_all_erasures 1 Create the file if not present. Next, configure yum to handle this ...


5

There were empty ca request files on the puppet master server that needed to be removed. here: /var/lib/puppet/ssl/ca/requests


5

You need to use double quotes ("") instead of single quotes ('). Much like the shell, perl, and other languages, single quotes in Puppet indicate a literal string and inhibit variable interpolation and the interpretation of backslash-escapes. file { '/etc/sysconfig/vncserver': content => "VNCSERVERS=\"6:root\"\nVNCSERVERARGS[6]=\"-geometry ...


4

You can use a custom fact to distinguish between them, and resolve a template using that fact: class foo ( $role, ){ file { '/etc/security/access.conf': owner => 'root', group => 'root', mode => '644', content => template("$role.ldap/access-2.conf"), } } Using current facter version, it is easy to ...


4

Does you client know how to find the server? root@client# ping puppet What certname will the client use when connecting to the server? root@client# puppet config print certname Remove the ssl details on the client root@client# rm -rf /var/lib/puppet/ssl Remove all traces of the client on the server root@puppet# puppet node clean $client_certname ...


4

Your client's expecting the master to have the hostname puppet, per its server configuration in puppet.conf - that's the default, so if you don't have a server configured then it's using puppet. The master's SSL certificate must be valid for that name, or the client will refuse to connect. Normally, the master generates a certificate that's valid for its ...


4

Ressources cannot be nested. They can only have dependencies on each other.



Only top voted, non community-wiki answers of a minimum length are eligible