Master - Satellite - Agent

[Murkel]

[quote=“Roland Sommer, post:2, topic:12223, full:true, username:rsx”]
Your post is hard to read at least for me since it is not formatted as described here. But I can identify an error since object Endpoint “satellite.localdomain” is defined twice at your satellite’s zones.conf.

Thanks for the hint, in fact it was there twice, but commented out once.
I removed the duplicate entry from my configuration.

@Murkel

When I integrated the agent via the NodeWizard, I got a ticket from the master.

@Roland Sommer

No, that’s wrong. I’d suspect you mean a signing request.

  icinga2 pki ticket --cn icinga2-agent1.localdomain

I think we mean the same thing here.
The documentation always refers to a ticket

@Murkel

I thought that was all good too, but I found that I had to sign the CA key on both the satellite and the “master” - is that correct?

@Roland Sommer

No, node wizard sent a signing request via satellite to master. This request needs to be signed at the master only.

So I only have to sign the certificates on the master? Don’t I need to sign it on the satellite?
Can I skip it with the wizard, the agent?

@Murkel

Unfortunately I have to reassign the user after each kickstart - is that correct, I thought it would be saved permanently.

@Roland Sommer

Normally, this information needs to be entered just one time.

I don’t know why, but I still have to embed it after every kickstart

@Murkel

Do I have to have one, the same API user including password, on the master, satellite and agent - for example user Sat_Agent with PW:123?

@Roland Sommer

I have no idea what your question is about. In general, only one api user user is required at the master for the communication between icingaweb and icinga.

Does the API user on the master, satellite and agent have to have the same name and the same password?

@Murkel

Shouldn’t I also see the agent as an end point, in the Director?

@Roland Sommer

No, the director is manging all zone and endpoint objects for agents automatically. There is nothing to do manually, hence, it’s not visible.

@Murkel

If I could understand it better, I would like to participate in creating documentation. I also do that professionally, for DAUS, which sometimes call themselves IT technicians. Who can I contact to help here?

@Roland Sommer

You could go to icinga on github.com and create issues and PRs accordingly.

Thanks, I’ll try to get involved…

@Murkel

What is the endpoint, is it the satellite or the agent at the end of the chain, which would actually make sense to me, or even the master?

@Roland Sommer

I’ve no idea what does this mean. In general, an endpoint object belong to a zone no matter if mast, satellite or agent.

So the end point can be the satellite from the agent and the master from the satellite, or is it always the master?

@Murkel

Do I need to specify the endpoint when creating a satellite or creating an agent through the director?

@Roland Sommer

Satellite zone and endpoint objects need to be created manually by editing zones.conf and then be imported using kickstart wizard. For agents there is no manually action required.

So I create all of them via the Zones.conf on the satellites and agents?

@Murkel

How can I see in the LOG files that the constellation is communicating correctly.

@Roland Sommer

Such a message report a successful (re-)connect:

… information/JsonRpcConnection: The certificate for CN ‘satellite.localdomain’ is valid and uptodate. Skipping automated renewal.

Perfect - that’s the case for me…