Hi!
I’ve the task to automatize the Installation from an Icinga2-Satellite via Puppet. My colleague gave me a completely installed VM with an Icinga2-Master-Setup with the following /etc/icinga2/zones.conf
/*
* Generated by Icinga 2 node setup commands
* on 2019-05-13 08:35:52 +0200
*/
object Endpoint "icinga2master.vorlage.local" {
}
object Zone "master" {
endpoints = [ "icinga2master.vorlage.local" ]
}
object Zone "global-templates" {
global = true
}
object Zone "director-global" {
global = true
}
object Zone "basic-checks" {
global = true
}
I’ve now the following tasks to automatize via Puppet:
On this icinga2 master, the Satellites (we call it Workers) that are installed via Puppet should automatically integrate themselves without any involvement.
It should be possible to set the respective SatelliteZone (WorkerZone) and the SatelliteName (WorkerName) using the Hiera config
Via Hiera you should be able to control per node SatelliteZone (WorkerZone) and SatelliteName (WorkerName) and whether a web interface (icingaweb2) is installed or not."
I should use for this tasks the following Puppet-Modules:
https://github.com/Icinga/puppet-icinga2
https://github.com/Icinga/puppet-icingaweb2
For the first one of the three tasks (“On this icinga2 master, the Satellites (we call it Workers) that are installed via Puppet should automatically integrate themselves without any involvement.”) I’ve adapted
this example and added ‘pki’ and ‘fingerprint’ from the installed VM with an Icinga2-Master-Setup from my colleague.
Then my /etc/puppetlabs/code/environments/puppettest/manifests/icinga2/satellite.pp had this content:
$master_cert = 'icinga2master.vorlage.local'
$master_ip = '192.168.117.30'
# get it on CA host 'openssl x509 -noout -fingerprint -sha1 -inform pem -in /var/lib/icinga2/certs/master.localdomain.crt'
$fingerprint = '<very_safe_fingerprint>'
class { '::icinga2':
manage_repo => true,
manage_package => true,
confd => false,
features => ['checker','mainlog','notification','statusdata','compatlog','command'],
constants => {
'NodeName' => $facts['fqdn'],
}
}
class { '::icinga2::feature::api':
pki => 'icinga2',
ca_host => $master_ip,
ticket_salt => '<very_safe_ticket_salt>',
ensure => 'present',
accept_config => true,
accept_commands => true,
endpoints => {
'NodeName' => {},
"${master_cert}" => {
'host' => $master_ip,
}
},
zones => {
'ZoneName' => {
'endpoints' => [ 'NodeName' ],
'parent' => 'master',
},
'master' => {
'endpoints' => [ $master_cert ],
},
},
fingerprint => $fingerprint,
}
icinga2::object::zone { 'global-templates':
global => true,
}
But now I wanna move this content into Hiera. Therefore I’ve changed the content of my /etc/puppetlabs/code/environments/puppettest/manifests/icinga2/satellite.pp to this:
# Declaration
class profile::icinga2::satellite {
endpoints => $endpoints
zones => $zones
class { '::icinga2':
manage_repo => $manage_repo
manage_package => $manage_package
confd => $confd
features => $features
constants => $constants
}
class { '::icinga2::features::api':
pki => $pki
ca_host => $ca_host
ticket_salt => $ticket_salt
ensure => $ensure
accept_config => $accept_config
accept_commands => $accept_commands
endpoints => $endpoints
zones => $zones
fingerprint => $fingerprint
}
}
I’ve created for my Icinga2-Satellite-Test-Host an own YAML under '/etc/puppetlabs/code/environments/puppettest/hieradata/nodes/worker-template.local.yam with the following content:
---
classes:
- 'profile::icinga2::satellite'
profile::icinga2::satellite::endpoints:
"%{::fqdn}": {}
icinga2master.vorlage.local:
'host': '192.168.117.30'
profile::icinga2::satellite::zones:
master:
endpoints: ['icinga2master.vorlage.local']
NOC:
endpoints: "%{::fqdn}"
parent: master
profile::icinga2::manage_repo: true
profile::icinga2::confd: false
profile::icinga2::features:
- 'api'
- 'checker'
- 'mainlog'
profile::icinga2::constants:
NodeName: "%{::fqdn}"
ZoneName: 'NOC'
profile::icinga2::feature::api::pki:
'icinga2'
profile::icinga2::feature::api::ca_host:
'icinga2master.vorlage.local'
profile::icinga2::feature::api::ticket_salt:
'<very_safe_ticket_salt>'
profile::icinga2::feature::api::ensure:
'present'
profile::icinga2::feature::api::accept_config:
'true'
profile::icinga2::feature::api::accept_commands:
'true'
profile::icinga2::feature::api::endpoints:
"%{::fqdn}": {}
'icinga2master.vorlage.local':
host: 192.168.117.20
profile::icinga2::feature::api::zones:
master:
endpoints:
- 'icinga2master.vorlage.local'
satellite:
endpoints:
- "%{::fqdn}"
parent: 'master'
profile::icinga2::feature::fingerprint:
'<very_safe_fingerprint>'
profile::object::zone::global: true
I’ve the problem when I do an ‘puppet agent -t --debug’ on my future Icinga2-Satellite I get the following error:
Debug: Caching connection for https://pm-neu.local:8140
Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Could not parse for environment puppettest: Syntax error at '=>' (file: /etc/puppetlabs/code/environments/puppettest/manifests/icinga2/satellite.pp, line: 4, column: 15) on node worker-template.local
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Debug: Dynamically-bound server lookup failed, falling back to report_server setting: pm-neu.local
Does anyone can help me with my last 2 Tasks and have this combination (Icinga2-Satellite binding at an Icinga2-Master and Setup via Puppet before) also working?
Thanks for your help and best regards,
Matthias