|
Currently, in order to load balance PuppetDB in PE, you need to configure your multiple PuppetDBs to use a single shared certificate.
The puppet_enterprise::profile::puppetdb class including with PE allows you to specify this alternate common cert to use instead of the PuppetDB node's agent cert.
However, if you later use puppetdb ssl-setup, which is very commonly used in troubleshooting scenarios, this will always be overwritten, due to the way the command determines what cert to use:
mycertname=`puppet master --confdir=$agent_confdir --vardir=$agent_vardir --configprint certname`
|
|
orig_public_file=`puppet master --confdir=$agent_confdir --vardir=$agent_vardir --configprint hostcert`
|
orig_private_file=`puppet master --confdir=$agent_confdir --vardir=$agent_vardir --configprint hostprivkey`
|
orig_ca_file=`puppet master --confdir=$agent_confdir --vardir=$agent_vardir --configprint localcacert`
|
That's definitely going to make troubleshooting PuppetDB issues cumbersome for LEI customers.
One potential remediation could be to include a command line flag for specifying an arbitrary certname, something like: puppetdb ssl-setup --certname foobaz
|
