@lbetz: Thanks for your fast reply. I’ve changed it back to ticketsalt because of this points from @dnsmichi: https://github.com/Icinga/puppet-icinga2/issues/495 …
My code on my Puppet-Master for the Icinga2-Slave is this:
$master_cert = 'icinga2master.vorlage.local'
$master_ip = '192.168.117.30'
# get it on CA host 'openssl x509 -noout -fingerprint -sha1 -inform pem -in /var/lib/icinga2/certs/master.localdomain.crt'
$fingerprint = 'CC:90:41:24:D0:92:CA:C3:C8:A4:75:97:C7:32:CB:91:45:78:6H:28'
class { '::icinga2':
manage_repo => true,
manage_package => true,
confd => false,
features => ['checker','mainlog','notification','statusdata','compatlog','command'],
constants => {
'NodeName' => $facts['fqdn'],
},
}
class { '::icinga2::feature::api':
pki => 'icinga2',
ca_host => $master_ip,
ticket_salt => '<ticketsalt>',
ensure => 'present',
accept_config => true,
accept_commands => true,
endpoints => {
'NodeName' => {},
"${master_cert}" => {
'host' => $master_ip,
}
},
zones => {
'ZoneName' => {
'endpoints' => [ 'NodeName' ],
'parent' => 'master',
},
'master' => {
'endpoints' => [ $master_cert ],
},
},
fingerprint => $fingerprint,
}
icinga2::object::zone { 'global-templates':
global => true,
}
( ticket_salt => ’ <ticketsalt>’ is from /etc/icinga2/constants.conf )
(fingerprint ==> ‘CC:90:41:24:D0:92:CA:C3:C8:A4:75:97:C7:32:CB:91:45:78:6H:28’ is that value which I get when I execute ‘openssl x509 -noout -fingerprint -sha1 -inform pem -in /var/lib/icinga2/certs/master.localdomain.crt’)
…when I do then an ‘puppet agent -t’ the following /etc/icinga2/zones.conf will be created on my Slave:
# This file is managed by Puppet. DO NOT EDIT.
object Endpoint NodeName {
}
object Endpoint "icinga2master.vorlage.local" {
host = "192.168.117.30"
}
object Zone ZoneName {
endpoints = [ NodeName, ]
parent = "master"
}
object Zone "global-templates" {
global = true
}
object Zone "master" {
endpoints = [ "icinga2master.vorlage.local", ]
}
(I don’t know the correct Syntax how to ask “ZoneName” and “NodeName” correct from hiera, do you have an idea? )
When I reexecute the command from @dnsmichi icinga2 pki ticket --cn worker-template.local
I got the same as this morning:
root@icinga2master:~# icinga2 pki ticket --cn worker-template.local
<ticketsalt>
root@icinga2master:~#
But I also have to say that I signed my Icinga2 node - which I created via puppet - on my Icinga2 master by hand and it worked.
Then I reset the Icinga2 node to test it again but the old Status of the VM is signed anymore on my Icinga2-Master…
Hope that’s all understandable what I’ve written…