Bug 475796

Summary:	puppet does not own al directories it needs
Product:	[Fedora] Fedora EPEL	Reporter:	S.A. Hartsuiker <s.a.hartsuiker>
Component:	puppet	Assignee:	David Lutterkort <lutter>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	el4	CC:	hbrock, k.georgiou, lutter, sebastian, tmz, vanmeeuwen+fedora
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-12-16 18:34:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description S.A. Hartsuiker 2008-12-10 15:06:01 UTC

Description of problem:
/var/lib/puppet/ssl en subdirectories not owned by puppet and therefore not created either.
The same goes for /var/lib/puppet/state/ and /var/lib/puppet/facts/

Version-Release number of selected component (if applicable):
puppet-0.24.4-1.el4
puppet-0.24.6-1.el5
puppet-0.24.4-1.fc8 (on F9)

How reproducible:
Always

Steps to Reproduce:
1. On a fresh install, yum install puppet
2. run puppetd --no-daemonize --verbose --debug --noop --one-time --wait-for-cert
3. 
  
Actual results:
Puppet complains about not being able to create a csr

Expected results:
Puppet waiting for signed cert

Additional info:

After making the following directories the problem is fixed:
/var/lib/puppet/ssl
/var/lib/puppet/ssl/certs
/var/lib/puppet/ssl/private
/var/lib/puppet/ssl/private_keys
/var/lib/puppet/ssl/public_keys
/var/lib/puppet/state
/var/lib/puppet/facts

Comment 1 Jeroen van Meeuwen 2008-12-10 15:12:45 UTC

What is the ownership of /var/lib/puppet/ ? (Should be drwxr-xr-x puppet:puppet)

Can you provide the full output of the puppet run where it complains about not being able to create a csr?

Comment 2 Jeroen van Meeuwen 2008-12-10 15:14:26 UTC

Note these directories should be created on-the-fly as the $vardir, $ssldir, $statedir settings in /etc/puppet/puppet.conf configure where these directories should be.

Comment 3 S.A. Hartsuiker 2008-12-10 15:23:39 UTC

drwxr-xr-x 7 puppet puppet 4096 Dec 10 16:19 /var/lib/puppet

I can not at this point in time provide you with the output. 
Puppet generates to much output ... I will create a vm to do this again.

The above mentioned dirs are, at least on EPEL 5 *not* created on the fly.

Comment 4 S.A. Hartsuiker 2008-12-16 18:33:12 UTC

I cannot reproduce this myself...
I don't know why this happened, I'm a bit puzzled about it really.
Therefore I am closing this bug as a one-of type of thing.

Comment 5 Sebastian Kayser 2010-04-26 08:47:06 UTC

I ran into the very same problem with 0.25.4. Putting the solution here for future reference in case anyone else stumbles upon the same problem.

puppetd usually ensures that required local directories exists, just like Jeroen pointed out. The only caveat here: it doesn't do so when called with --noop (this can be nicely seen with --debug).

So in case someon is seeing error messages like the following

err: Could not request certificate: Cannot save xxx; parent directory /var/lib/puppet/ssl/private_keys does not exist

please make sure you are not running in --noop mode.