Jira (PUP-4938) Puppet agent dies on SIGUSR1 if certificate isn't yet signed

[Ioannis Papaioannou (JIRA)]

Title: Message Title

Ioannis Papaioannou commented on PUP-4938   Re: Puppet agent dies on SIGUSR1 if certificate isn't yet signed When a FQDN change occurs, puppet automatically generates a request for new certificate at startup. If a SIGUSR1 is received while the request takes place, the procedure is interrupted by an exception which leads to an unrecoverable state for the daemon process. Wed Oct 14 17:44:26 +0100 2015 Puppet (debug): Finishing transaction 69953137929160 Wed Oct 14 17:44:26 +0100 2015 Puppet (debug): Closing streams for daemon mode Wed Oct 14 17:44:26 +0100 2015 Puppet (notice): Reopening log files Wed Oct 14 17:44:26 +0100 2015 Puppet (debug): Finished closing streams for daemon mode Wed Oct 14 17:44:26 +0100 2015 Puppet (debug): Finishing transaction 69953138128720 Wed Oct 14 17:44:26 +0100 2015 Puppet (info): Creating a new SSL key for node1.example.com Wed Oct 14 17:44:27 +0100 2015 Puppet (err): Could not request certificate: SIGUSR1 Wed Oct 14 17:46:27 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:46:27 +0100 2015 Puppet (info): Creating a new SSL certificate request for node1.example.com Wed Oct 14 17:46:27 +0100 2015 Puppet (err): Could not request certificate: undefined method `public_key' for nil:NilClass Wed Oct 14 17:48:27 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:48:27 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:48:27 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:50:28 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:50:28 +0100 2015 Puppet (notice): Did not receive certificate Wed Oct 14 17:52:28 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:52:28 +0100 2015 Puppet (notice): Did not receive certificate Wed Oct 14 17:54:28 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:54:28 +0100 2015 Puppet (notice): Did not receive certificate Wed Oct 14 17:56:28 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:56:28 +0100 2015 Puppet (notice): Did not receive certificate Wed Oct 14 17:58:28 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 17:58:28 +0100 2015 Puppet (notice): Did not receive certificate Wed Oct 14 18:00:28 +0100 2015 Puppet (debug): Using cached certificate for ca Wed Oct 14 18:00:28 +0100 2015 Puppet (notice): Did not receive certificate ... and so on ... By using mcollective's puppet agent, we're triggering puppet to retrieve and apply the new catalog (mco puppet runonce). This has been automated and sometimes can happens while a node is rebooting. During the start-up, mcollective starts first (S24) and can receive the mco call about the same time the daemon is starting (S98). If agent.pid file is detected, the mcollective agent sends SIGUSR1 to the puppet process and if a new certificate is requested it results to the issue described above. It seems that the puppet process is trying to recover, but some instance is left uninitialized which then leads to a never ending loop of failed attempts to retrieve a certificate. The process should either ignore SIGUSR1 at this stage or be able to recover from the exception call. Environment: OS: RHEL6.6 Puppet: 3.3.2 mcollective-puppet-agent: 1.10.0 Add Comment   This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.