On 27/06/16 09:15, Thomas Cheng wrote: > > > On Monday, June 27, 2016 at 12:36:29 AM UTC-7, Dominic Cleal wrote: > > On 23/06/16 20:15, Thomas Cheng wrote: > > I got the following errors in forman-proxy's proxy.log file, after I > > turned on debugging, Any one know what this error means? Thanks. > > > > # Logfile created on Wed Jun 22 17:15:26 -0700 2016 by > logger.rb/1.2.6 > > E, [2016-06-22T17:17:38.836692 #58935] ERROR -- : Failed to list > puppet > > environments: Connection refused - connect(2) > > E, [2016-06-22T17:17:48.592771 #58935] ERROR -- : Failed to list > puppet > > environments: Connection refused - connect(2) > > The smart proxy connects to the Puppet master to retrieve a list of > environments, this suggests that the master isn't running (usually > under > Apache). > > Also check that :puppet_url is set correctly in > /etc/foreman-proxy/settings.d/puppet.yml, see > https://theforeman.org/manuals/1.11/index.html#4.3.6Puppet > <https://theforeman.org/manuals/1.11/index.html#4.3.6Puppet>. You > should > be able to telnet to the same host/port specified in the config. > > I see. I checked the setup, and it points to a Load-balanced URL: > https://balanced_foreman.example.com/. so here is my question inviting > for recommendations / best practice: > > We have a Foreman cluster (more than an all-in-one installation) to > handle thousands of nodes. And so, Foreman (REST API, Reports, ENC, > Web), Foreman-proxy (with proxyed puppet master function), and puppet > masters are load balanced: > > load balanced Foreman (ports 80,443): balanced_foreman.example.com > load balanced Foreman-proxy (8443) : balanced_proxy.example.com > load balanced puppet master (8140): balanced_pm.example.com > > And loads/requests are distributed equally to 3 different 'worker' > nodes: nodeA, nodeB, nodeC. each nodes runs all three: Foreman (80 & > 443), Foreman-proxy (8443), and puppet master (8140). > > Then on each node, say, nodeA, when a service need to talk with another, > should it use load-balanced form, or better it should directly use the > service runs on the same node? > > i.e, when nodeA' foreman-proxy needs to get a list of puppet > environments, should the value ':puppet_url' better to be set as: > https://nodeA.example.com:8140, or https://balanced_pm.example.com? > > The first one ( https://nodeA.example.com:8140) may seems more efficient > (it doesn't need to go to load director, and potentially distributed > back to the same machine requests come from), also the debugging is > easier, don't need to check logs on three servers should error pops up; > > while the second solution mean more resilient, with the price of complexity. > > What's your suggestions and how's the popular choices here? Many thanks.
I don't recommend anything in particular, I doubt it matters much. Either should work provided the SSL certificates in use match the hostname you're connecting to (i.e. if connecting to the node directly, the sAN list must contain the node hostname). -- Dominic Cleal [email protected] -- You received this message because you are subscribed to the Google Groups "Foreman users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/foreman-users. For more options, visit https://groups.google.com/d/optout.
