Puppet Notes

Pre-Flight

The puppet server is puppet.example.com (CentOS 5.8 x64)
The puppet client is client.example.com (CentOS 6.2 x64)
Trying puppet 2.6+
The default ports are 8140 on server and 8139 on client; we
won’t be changing this.
See Tweaking Puppet (and
other notes) when
you’re finished here.

On Server

yum install puppet-server

Now edit /etc/sysconfig/puppetmaster and uncomment these two lines:

PUPPETMASTER_MANIFEST=/etc/puppet/manifests/site.pp
PUPPETMASTER_LOG=syslog

The site-wide manifest is /etc/puppet/manifests/site.pp. Let’s add this:

# Define a few test classes
class testclass1 {
  file { "/tmp/test1":
    ensure => present,
    mode   => 644,
    owner  => root,
    group  => root
  }
}
class testclass2 {
  file { "/tmp/test2":
    ensure => present,
    mode   => 700,
    owner  => nobody,
    group  => nobody
  }
}

# Every node has this file
node default {
  include testclass1
}

# This particular node is a little different
node 'client.example.com' inherits default {
  include testclass2
}

Start the puppetmaster:

service puppetmaster start

Configuring the Client

yum install puppet

Now edit /etc/sysconfig/puppet and uncomment these:

PUPPET_SERVER=puppet.example.com
PUPPET_LOG=/var/log/puppet/puppet.log

Test your configuration by:

Running /etc/init.d/puppet once --verbose

Then tailing /var/log/puppet/puppet.log

Thu Apr 12 13:52:12 -0500 2012 Puppet (notice): Reopening log files
Thu Apr 12 13:52:12 -0500 2012 Puppet (info): Creating a new SSL key for client.example.com
Thu Apr 12 13:52:12 -0500 2012 Puppet (info): Caching certificate for ca
Thu Apr 12 13:52:13 -0500 2012 Puppet (info): Creating a new SSL certificate request for client.example.com
Thu Apr 12 13:52:13 -0500 2012 Puppet (info): Certificate Request fingerprint (md5): A8:FE:8B:19:A8:9F:23:4C:19:27:65:7F:98:4D:E2:E6

You now need to sign the SSL request on the server. See the list of SSL certificates:

[root@sauron manifests]# puppetca --list -a
  client.example.com (A8:FE:8B:19:A8:9F:23:4C:19:27:65:7F:98:4D:E2:E6)
+ puppet.example.com (7A:78:B2:B8:78:F3:26:53:23:1C:6B:5D:E0:40:C6:06) (alt names: [DNS:puppet](DNS:puppet), [DNS:puppet.example.com](DNS:puppet.example.com))

A “+” sign indicates a signed certificate. Sign the request:

[root@sauron manifests]# puppetca --sign client.example.com
notice: Signed certificate request for client.example.com
notice: Removing file Puppet::SSL::CertificateRequest client.example.com at '/var/lib/puppet/ssl/ca/requests/client.example.com.pem'

All should be well, so start the puppet service and make sure it starts at boot (you could’ve done this with puppet!):

service puppet start
chkconfig --level 345 puppet on

Setting up file services

I edit /etc/puppet/fileserver.conf to add this:

[files]
 path /var/lib/puppet/files
 allow 128.255.22.0/24

Note the [files] stub above. Created a sample file:

cd /var/lib/puppet/files
mkdir -p etc/nikhil.conf
echo "Testing" > etc/nikhil.conf

Now in the manifest, add this:

file { "/etc/nikhil.conf":
    ensure => present,
    owner => nobody,
    group => root,
    mode => 770
    source => "puppet:///files/etc/nikhil.conf"
}

You can kick the puppet to see the file created with the contents on the server.

Note carefully that

You’d have to specify the puppetmaster with two slashes (e.g.
puppet:*//*master.tld/files/nikhil.conf)
You could omit the master using three slashes (e.g.
puppet:*///*files/etc/nikhil.conf)

Issues

Versioning

The puppet client version should be equal to or lower than the server version. This one fact will save you a lot of trouble.

Could not request certificate: Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key

# ON CLIENT: Remove all keys
rm -rfv /var/lib/puppet/ssl/*

# ON CLIENT: Make sure that the user puppet can write to /var/lib/puppet/ssl/

# ON SERVER: Revoke all certificates signed for client
puppetca --revoke client.example.com
puppetca --clean client.example.com

Then try again. Should work.

Could not retrieve catalog from remote server: getaddrinfo: Name or service not known

Add an alias for puppet to /etc/hosts (DNS is better)
Add a server = puppetmaster.domain.tld to
/etc/puppet/puppet.conf under the [main] section.

Connection refused (2) when kicking puppet

Add a listen = true to the client’s /etc/puppet/puppet.conf file. See the Puppet Configuration Reference for other directives.

Could not retrieve catalog from remote server: Error 400 on SERVER: No support for http method POST

This happens if the client runs a later version than the server. For example, 2.6 on the server and 2.7 on the client.

Could not retrieve catalog from remote server: certificate verify failed

Make sure that the time on both server and client are in sync. Restart the NTP service.

puppet host “is already running”

Issue with 2.6.18.274 kernels. Update to some 2.6.18.300+ kernel and reboot.

Tweaks et al

Autosign Certificate requests

Add this to the bottom of /etc/puppet/puppet.conf on the puppetmaster:

[master]
  autosign = true

You can also, apparently, create /etc/puppet/autosign.conf and append the domain or CIDR for which the master will autosign.

*.example.com
10.212.8.0/24

‘Kicking’ a Puppet

Clients, by default, listen on port 8139. Set up /etc/puppet/auth.conf to have these lines:

path /run
auth any
method save
allow puppet.server.com

# Must be above these lines!
path /
auth any

Restart the puppet daemon. Now kick it from the server:

puppet kick --host client.domain.tld

An exit status of 0 is good. You can kick all clients, but will need a LDAP.

Debugging the Client

service puppet stop
puppet agent --listen --debug --no-daemonize --verbose

Check your manifest syntax

puppet --parseonly manifest.pp