当我使用 puppet kick 时，puppet 客户端服务器连接被拒绝

Question

我有一个很奇怪的问题。我在多台服务器上设置了 puppet 客户端，但其中一台出现问题。当我调用时:

root@www ~ # puppet agent --server puppetmaster.domain.ltd --test 
notice: Ignoring --listen on onetime run
info: Caching catalog for puppetclient.domain.ltd
info: Applying configuration version '1326444431'
notice: Finished catalog run in 3.15 seconds

一切正常。系统会应用新的更改。

当我尝试从服务器拉取更改到客户端时:

root@www ~ # puppet kick puppetclient.domain.ltd

我在客户端的系统日志中遇到错误:

Jan 15 14:01:23 www puppet-agent[20903]: triggered run
Jan 15 14:01:24 www puppet-agent[20903]: Could not retrieve catalog from remote server: Connection refused - connect(2)
Jan 15 14:01:24 www puppet-agent[20903]: Using cached catalog
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Cronapt/File[/etc/cron.daily/cronapt]) Could not evaluate: Connection refused - connect(2) Could not retrieve file metadata for puppet:///cronapt/cronapt: Connection refused - connect(2) at /etc/puppet/modules/cronapt/manifests/init.pp:7
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Nagios/File[/usr/lib/nagios/plugins/]) Failed to generate additional resources using 'eval_generate: Connection refused - connect(2)
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Nagios/File[/usr/lib/nagios/plugins/]) Could not evaluate: Connection refused - connect(2) Could not retrieve file metadata for puppet:///nagios/usr/lib/nagios/plugins: Connection refused - connect(2) at /etc/puppet/modules/nagios/manifests/init.pp:27
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Nagios/File[/etc/nagios/nrpe.cfg]) Could not evaluate: Connection refused - connect(2) Could not retrieve file metadata for puppet:///nagios/etc/nagios/nrpe.cfg: Connection refused - connect(2) at /etc/puppet/modules/nagios/manifests/init.pp:18
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Nagios/Exec[/etc/init.d/nagios-nrpe-server reload]) Dependency File[/etc/nagios/nrpe.cfg] has failures: true
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Nagios/Exec[/etc/init.d/nagios-nrpe-server reload]) Skipping because of failed dependencies
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Apache2/File[/etc/apache2/conf.d/deny.conf]) Could not evaluate: Connection refused - connect(2) Could not retrieve file metadata for puppet:///apache2/etc/apache2/conf.d/deny.conf: Connection refused - connect(2) at /etc/puppet/modules/apache2/manifests/init.pp:7
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Apache2/Service[apache2]) Dependency File[/etc/apache2/conf.d/deny.conf] has failures: true
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Apache2/Service[apache2]) Skipping because of failed dependencies
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Nagios/File[/etc/nagios/cfg.d/]) Failed to generate additional resources using 'eval_generate: Connection refused - connect(2)
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Nagios/File[/etc/nagios/cfg.d/]) Could not evaluate: Connection refused - connect(2) Could not retrieve file metadata for puppet:///nagios/etc/nagios/cfg.d: Connection refused - connect(2) at /etc/puppet/modules/nagios/manifests/init.pp:37
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Apache2/File[/etc/apache2/.htpasswd]) Could not evaluate: Connection refused - connect(2) Could not retrieve file metadata for puppet:///apache2/etc/apache2/.htpasswd: Connection refused - connect(2) at /etc/puppet/modules/apache2/manifests/init.pp:31
Jan 15 14:01:24 www puppet-agent[20903]: (/Stage[main]/Apache2/File[/usr/share/phpmyadmin/.htaccess]) Could not evaluate: Connection refused - connect(2) Could not retrieve file metadata for puppet:///apache2/usr/share/phpmyadmin/.htaccess: Connection refused - connect(2) at /etc/puppet/modules/apache2/manifests/init.pp:23
Jan 15 14:01:24 www puppet-agent[20903]: Finished catalog run in 0.33 seconds
Jan 15 14:01:24 www puppet-agent[20903]: Could not send report: Connection refused - connect(2)

这里是 puppetclient.domain.ltd 的配置文件

puppet.conf

[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
templatedir=$confdir/templates
prerun_command=/etc/puppet/etckeeper-commit-pre
postrun_command=/etc/puppet/etckeeper-commit-post
listen = true

runinterval=1800
splay=true
summarize = true

auth.conf:

path /
method find, search, save
auth yes
allow puppetmaster.domain.ltd

namespaceauth.conf

[fileserver]
allow *
[puppetmaster]
allow *
[puppetrunner]
allow *
[puppetbucket]
allow *
[puppetreports]
allow *
[resource]
allow *

puppet 大师2.7.9版

Puppet 客户端 2.7.6 版

Answer 1

由于您在运行 puppet agent 时指定了 --server，因此您应该将其作为 server = puppetmaster.domain 放入客户端的 puppet.conf 文件中[main] 部分下的 .ltd。否则客户端在被踢时会尝试连接默认主机“puppet”。