web-dev-qa-db-ja.com

Mcollectiveは完全なSSL検証済みモードエラーの設定に失敗しました

『Learning Puppet 4』のマニュアルによると、jorhett/puppet-mcollectiveモジュールを使用してMCollectiveをセットアップしようとしています。 「mcoping」、「mcoinventorynode_name」などを実行した後に次のエラーが発生します。

警告2016/08/11 07：21：19：activemq.rb：346：in `rescue in ssl_parameters '完全なSSL検証済みモードの設定に失敗し、未検証にフォールバックしました：RuntimeError：cert、key and ca must to検証済みSSLモード用に提供されます

これが私の設定です：Hiera hostname/puppetserver.yaml

# hostname/puppetserver.yaml
classes:
- mcollective::middleware
- mcollective::client
# Middleware configuration
mcollective::client_password: 'VpOS62qqpH3NEVEtP8rQsS2tpq6xwgOJEXsABjYDvoI='
mcollective::middleware::keystore_password: 'k7Dj+On3xGmQPX7CuCxgXaOFwHZFdKICeQQFpWlzg6E='
mcollective::middleware::truststore_password: 'k7Dj+On3xGmQPX7CuCxgXaOFwHZFdKICeQQFpWlzg6E='

Hiera common.yaml

---
puppet::status: 'running'
puppet::enabled: true

# every node installs the server
classes:
  - mcollective::server
# The Puppet Server will Host the middleware
mcollective::hosts:
  - 'puppet.example.com'
mcollective::collectives:
  - 'mcollective'
mcollective::connector: 'activemq'
mcollective::connector_ssl: true
mcollective::connector_ssl_type: 'anonymous'
# Access passwords
mcollective::server_password: 'h3Vh7JGGkyWxuehCvScXRwZmIZYRHtDDDxuS1W68XAQ='
mcollective::psk_key: 'y2Z2BzcsRFXCBidywQafyJoELH5bIkmZzXGssLLMVsw='
mcollective::facts::cronjob::run_every: 10
mcollective::server::package_ensure: 'latest'
mcollective::plugin::agents:
  puppet:
    version: 'latest'
mcollective::client::unix_group: vagrant
mcollective::client::package_ensure: 'latest'
mcollective::plugin::clients:
  puppet:
    version: 'latest'

Mcollective server.cfg

# /etc/mcollective/server.cfg
libdir = /usr/libexec/mcollective
libdir = /opt/puppetlabs/mcollective/plugins
classesfile = /opt/puppetlabs/puppet/cache/state/classes.txt
daemonize = 1
direct_addressing = 1
main_collective = mcollective
collectives = mcollective                                                       

# ActiveMQ connector settings:
connector = activemq
plugin.activemq.heartbeat_interval = 30
plugin.activemq.pool.size = 1
plugin.activemq.pool.1.Host = puppet.example.com
plugin.activemq.pool.1.port = 61614
plugin.activemq.pool.1.user = server
plugin.activemq.pool.1.password = h3Vh7JGGkyWxuehCvScXRwZmIZYRHtDDDxuS1W68XAQ=
plugin.activemq.pool.1.ssl = true
plugin.activemq.pool.1.ssl.fallback = true

# Send these messages to keep the Stomp connection alive.
# This solves NAT and firewall timeout problems.
registerinterval = 600

# Security provider
securityprovider = psk
plugin.psk = y2Z2BzcsRFXCBidywQafyJoELH5bIkmZzXGssLLMVsw=

# Facts
factsource = yaml
plugin.yaml = /etc/puppetlabs/mcollective/facts.yaml

# Puppet resource control
plugin.puppet.resource_allow_managed_resources = true
plugin.puppet.resource_type_whitelist = none

# Logging
logger_type = syslog
loglevel = info
logfacility = user

Mcollective client.cfg

# Connector
libdir = /usr/libexec/mcollective
libdir = /opt/puppetlabs/mcollective/plugins
direct_addressing = 1
main_collective = mcollective
collectives = mcollective                                                                                                                                       

connector = activemq
plugin.activemq.heartbeat_interval = 30
plugin.activemq.pool.size = 1
plugin.activemq.pool.1.Host = puppet.example.com
plugin.activemq.pool.1.port = 61614
plugin.activemq.pool.1.user = client
plugin.activemq.pool.1.password = VpOS62qqpH3NEVEtP8rQsS2tpq6xwgOJEXsABjYDvoI=
plugin.activemq.pool.1.ssl = true
plugin.activemq.pool.1.ssl.fallback = true

# Security provider
securityprovider = psk
plugin.psk = y2Z2BzcsRFXCBidywQafyJoELH5bIkmZzXGssLLMVsw=
plugin.psk.callertype = uid

# Discovery
default_discovery_method = mc
direct_addressing_threshold = 10
default_discovery_options =

# Miscellaneous settings
color = 1
rpclimitmethod = first

# Performance settings
direct_addressing_threshold = 10
ttl = 60

# Logging
logger_type = console
loglevel = warn
puppetcentos7activemqmcollective
1
Dziki_Jam

私もまったく同じ問題を抱えていましたが、mcollective/puppetサーバーの/etc/puppetlabs/mcollective/server.cfgと/etc/puppetlabs/mcollective/client.cfgの両方に以下（以下に表示）を追加すると問題が解決することがわかりました。効果を発揮させるには、必ずmcollectiveサービスを再起動してください。

これをclient.cfg/server.cfgファイルに追加しました。

plugin.activemq.pool.1.ssl.key = /etc/puppetlabs/puppet/ssl/private_keys/puppet.esxi.com.pem
plugin.activemq.pool.1.ssl.ca = /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem
plugin.activemq.pool.1.ssl.cert = /etc/puppetlabs/puppet/ssl/certs/puppet.esxi.com.pem

エントリを追加する前に：

[root@puppet ~]# mco ping
warn 2016/11/30 09:02:29: activemq.rb:374:in `rescue in ssl_parameters' Failed to set full SSL verified mode, falling back to u                                                                                                              nverified: RuntimeError: cert, key and ca has to be supplied for verified SSL mode
media.center                             time=13.37 ms
dns1                                     time=53.16 ms
puppet.esxi.com                          time=53.84 ms
keeppass                                 time=54.47 ms
splunk                                   time=55.11 ms
lychee                                   time=55.78 ms
nfs-share                                time=56.41 ms
dns2                                     time=57.09 ms
ansible                                  time=57.68 ms

その後：

[root@puppet ~]# mco ping
media.center                             time=13.44 ms
keeppass                                 time=53.12 ms
nfs-share                                time=54.44 ms
puppet.esxi.com                          time=55.37 ms
dns2                                     time=56.15 ms
ansible                                  time=56.94 ms
dns1                                     time=57.76 ms
splunk                                   time=58.57 ms
lychee                                   time=59.38 ms
1
Andrew