|
When adding a new node which has a FQDN set in /etc/hostname, the generated CSR on puppet agent doesn't include the FQDN, as long as no DNS search domain is set. This makes things weird, as a second CSR will be generated when network is set up properly and the DNS domain suddenly appears:
This might be due to facter not showing the FQDN correctly, but I'm unsure whether puppet agents derives the csr name from facter or not.
{{root@puppettest:~# cat /etc/hostname
puppettest.mydomain.com
root@puppettest:~# facter hostname
puppettest
root@puppettest:~# facter fqdn
puppettest
root@puppettest:~# puppet agent --server puppet.mydomain.com --waitforcert 10 -t --verbose
Info: Creating a new SSL key for puppettest
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for puppettest
Info: Certificate Request fingerprint (SHA256): F5:09:15:AD:A1:2A:F2:85:9E:A1:65:C9:23:9F:A4:16:50:36:89:8A:06:6F:FC:45:4F:6D:00:E9:1D:BA:25:C0
Info: Caching certificate for ca
Notice: Did not receive certificate}}
As soon as I add "domain mydomain.com" to /etc/resolv.conf, facter fqdn shows "puppettest.mydomain.com", and the puppet agent generates a new certificate on the next run.
I think it should be more consistent to take the FQDN from $(hostname), if one is set there, instead of only $(hostname -s), and adding one from /etc/resolv.conf if set. This applies both to facter fqdn and the agents method of deriving the certificate name.
|
