https://www.puppet.com/community logo
Join Slack
Powered by
This message was deleted.
# puppet
s
This message was deleted.
j
assuming puppet opensource, the following file:
Copy code
/etc/puppetlabs/puppetserver/conf.d/auth.conf
contains the rules
although to be honest 5.5 might still use the old authentication method
l
interesting - what method is that?
looking at logs beofre the ca expired, get / puts look fine
so not sure what piece is missing
j
do you have a auth.conf?
l
i do
Copy code
# Allow nodes to access all file_metadata.  Note that access for the
            # 'delete' method is forbidden by Puppet regardless of the
            # configuration of this rule.
            match-request: {
                path: "/puppet/v3/file_metadata"
                type: path
                method: [get, post]
            }
            allow: "*"
j
the haproxy LB is doing a puppet run when you get that error?
l
we cant get it to do a puppet run
everything is timing out
that seems to be our issue
maybe we should manually copy certs to it?
j
only puppet nodes are allowed to fetch from the file_metadata route
l
actually - i think we did manually copy to them
j
so if something is independently (not as part of a puppet run) calling the puppet api, you may need to change the rules to allow it
l
we are also running foreman
j
sorry, i know nothing about foreman
l
no worries
appreciate the help
j
Copy code
allow-unauthenticated: true
isnt present, so the
Copy code
(authenticated: false)
makes me think that the node isnt authenticating and therefore failing to access the api endpoint
and given that a CA expired, makes me suspect that there is an issue with client certs
l
we are deleting the ssl dir and re running puppet...but the runs are itming out
j
as in cannot connect to puppet?
and you have verified basic connectivity (assuming linux)
Copy code
nc -vz <puppet url> <puppet port>
l
yes - that works
j
did you restart the puppetserver service post ca re creation?
l
did that also
j
hmm
anything in the puppetserver logs that might enlighten the situtation?
l
i think biggest tipoff is that initial log snippet
j
hmm
l
forbidden request
j
requesting a new node certificate is unauthenticated route
so the nodes should be able to generate new certs, and then retrived the signed certificate
l
thats what i thought
typically always nuke the ssl dir on agent, cert clean, and regen
j
on the agent running the regen, just hangs? and then timesout?
l
yeah everything is incredibly slow now i think due to stampeding herds
im running again
will take a while
j
try with --debug, even though it probaably wont help
✅ 1
l
this actually turned out to be because we had not restarted the puppet agent service (doh)
stopping service deleting agent ssl certs and restarting solved the issue
j
glad you figured it out. Didn't think of the agent service, because I do not run the agent that way
✅ 1
l
thanks a million for your help
j
you are welcome
Open in Slack
PreviousNext
Powered by