puppet

Puppet error: read server certificate: certificate verify

puppet

If you see an error in puppet, the chances are that you have some kind of configuration setting
Warning: Unable to fetch my node definition, but the agent run will continue:

Warning: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: puppet]
Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: puppet]
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: puppet]

The chances are that you have some conflicts when using an old puppet master, the SSL Certificates might be configured wrong.

find /var/lib/puppet -type f -print0 |xargs -0r rm

Puppet flags “Invalid group” when adding users

puppet

If you see a message that tells you “Could not evaluate: invalid group” in Puppet, or any kind of error that says “Invalid group” when running a puppet test it’s possible that you might have some old configuration from another puppet master for adding users.

If that’s the case, you would only need to delete a user then run puppet again and hopefully it’ll use your new puppet settings and re-add the user.

puppet failures due to “dnsdomainname: Unknown host”

linux, puppet, selinux

When I was trying to start puppet, I had the following message:
[root@m03 puppet]# service puppet start
Starting puppet: dnsdomainname: Unknown host
dnsdomainname: Unknown host

Even though puppet started successfully. I checked my /etc/hosts file as puppet looks up DNS from there, everything looked fine. I also disabled selinux as that had been recommended on another blog. That might work for you, but didn’t do much for me.

Trying to sign my certificate was proving to be the same issue as well, rendering my puppet setup completely useless:
/usr/sbin/puppetd –waitforcert 30
dnsdomainname: Unknown host
dnsdomainname: Unknown host

I decided to check on the puppet master to see if my signature request had successfully hit the master:
puppet cert list –all | grep -i m03
…but no joy there.

When the dnsdomainname error comes up, the obvious answer is that the DNS is not resolving and it turns out that my puppet install is using an extra DNS entry to connect to the master. I compared an entry on another machine in /etc/resolv.conf, added that to the new machine; ran:
/usr/sbin/puppetd –waitforcert 30

…then the catalog ran successfully.