为您的 Puppet/Foreman 服务器配置 Puppet 代理。
首先，从供应商的签名仓库安装与您的操作系统及 Puppet/Foreman 服务器兼容的代理。保持 TLS 证书和软件包签名验证处于启用状态，并按要求完成仓库身份验证。使用适用于您所用服务器版本的证书注册命令。
/opt/puppetlabs/bin/puppet config set server YOURSERVERHERE
/opt/puppetlabs/bin/puppet config set certname `hostname -f`
vim /etc/puppet/puppet.conf
- 删除 master 配置节
- 添加 [agent] 部分
- add server= YOURSERVERHERE
export PATH=/opt/puppetlabs/bin:$PATH
puppet agent --test
示例输出如下：
root@dcae:/work# puppet agent --test
Info: Creating a new RSA SSL key for sbc-de-02.multitel.ro
Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for sbc-de-02.multitel.ro
Info: Certificate Request fingerprint (SHA256): FD:F3:D1:17:CB:AF:E3:03:55:C4:B4:5E:DC:4C:ED:55:E2:E4:2D:F5:89:36:1A:76:1A:FE:A5:E8:E5:F2:00:21
Info: Certificate for sbc-de-02.multitel.ro has not been signed yet
Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (sbc-de-02.multitel.ro).
Exiting now because the waitforcert setting is set to 0.
（为安全起见，SHA256 指纹已修改）
- 这将创建本地证书，并向您的 puppet/foreman 服务器表明自身身份
- 系统会提示证书不被允许
现在通过 SSH 登录 foreman/puppet 服务器。
在 YOURSERVERHERE 上运行 puppet cert list。
运行： puppet cert sign YOURCLIENTHOSTNAMEHERE
示例输出如下：
root@repo55:~# puppet cert list
Warning: `puppet cert` is deprecated and will be removed in a future release.
(location: /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application.rb:370:in `run')
"dcae.multitel.net" (SHA256) FD:F3:D1:17:CB:AF:E3:03:55:C4:B4:5E:DC:4C:ED:55:E2:E4:2D:F5:89:36:1A:76:1A:FE:A5:E8:E5:F2:00:21
root@foreman:~# puppet cert sign dcae.multitel.net
Warning: `puppet cert` is deprecated and will be removed in a future release.
(location: /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application.rb:370:in `run')
Signing Certificate Request for:
"dcae.multitel.net" (SHA256) FD:F3:D1:17:CB:AF:E3:03:55:C4:B4:5E:DC:4C:ED:55:E2:E4:2D:F5:89:36:1A:76:1A:FE:A5:E8:E5:F2:00:21
Notice: Signed certificate request for dcae.multitel.net
Notice: Removing file Puppet::SSL::CertificateRequest dcae.multitel.net at '/etc/puppetlabs/puppet/ssl/ca/requests/dcae.multitel.net.pem'
root@repo55:~#
（出于安全考虑，已修改 SHA256 指纹和主机名）
返回您的 Puppet 客户端计算机。
请在服务器上再次运行“puppet agent --test”。现在应该可以正常工作了
- 如果它提示未启用
- 运行 "puppet agent --enable"