Foreman Salt Smart Proxy -- apt-get install error

Hi,

I'm trying to install a smart proxy on our salt-master. I use the
foreman-installer like this

foreman-installer --no-enable-foreman
–no-enable-foreman-cli
–no-enable-foreman-plugin-bootdisk
–no-enable-foreman-plugin-setup
–no-enable-puppet
–enable-foreman-proxy
–foreman-proxy-tftp=false
–foreman-proxy-foreman-base-url=https://realforemaninstance.zone.loc
–foreman-proxy-trusted-hosts=realforemaninstance.zone.loc
–foreman-proxy-oauth-consumer-key=from_realinstance
–foreman-proxy-oauth-consumer-secret=from_realinstance
–enable-foreman-plugin-salt
–enable-foreman-proxy-plugin-salt

So far so good. During installation process it ends with errors getting
salt from repository via apt-get

Execution of '/usr/bin/apt-get -q -y -o DPkg::Options::=–force-confold
install salt' returned 100: Reading package lists…
/Stage[main]/Foreman::Plugin::Salt/Foreman::Plugin[salt]/Package[salt]/ensure:
change from purged to present failed: Execution of '/usr/bin/apt-get -q -y
-o DPkg::Options::=–force-confold install salt' returned 100: Reading
package lists…
Proxy salt-master.zone.loc cannot be registered (422 Unprocessable
Entity): Unable to communicate with the proxy: ERF12-2530
[ProxyAPI::ProxyException]: Unable to detect features
([Errno::ECONNREFUSED]: Connection refused - connect(2) for
"salt-master.zone.loc" port 8443) for proxy
https://salt-master.zone.loc:8443/features Please check the proxy is
configured and running on the host.
/Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[salt-master.zone.loc]/ensure:
change from absent to present failed: Proxy salt-master.zone.loc cannot be
registered (422 Unprocessable Entity): Unable to communicate with the
proxy: ERF12-2530 [ProxyAPI::ProxyException]: Unable to detect features
([Errno::ECONNREFUSED]: Connection refused - connect(2) for
"salt-master.zone.loc" port 8443) for proxy
https://salt-master.zone.loc:8443/features Please check the proxy is
configured and running on the host.

A manual try :

salt-master:~# /usr/bin/apt-get -q -y -o DPkg::Options::=–force-confold
install salt

Paketlisten werden gelesen…

Abhängigkeitsbaum wird aufgebaut…

Statusinformationen werden eingelesen…

E: Paket salt kann nicht gefunden werden. (paket salt not found)

What am I doing wrong, or are there some problems with the repository?

Thanks for help,

Tom

>
> Hi,
>
> I'm trying to install a smart proxy on our salt-master. I use the
> foreman-installer like this
>
> foreman-installer --no-enable-foreman
> --no-enable-foreman-cli
> --no-enable-foreman-plugin-bootdisk
> --no-enable-foreman-plugin-setup
> --no-enable-puppet
> --enable-foreman-proxy
> --foreman-proxy-tftp=false
> --foreman-proxy-foreman-base-url=https://realforemaninstance.zone.loc
> --foreman-proxy-trusted-hosts=realforemaninstance.zone.loc
> --foreman-proxy-oauth-consumer-key=from_realinstance
> --foreman-proxy-oauth-consumer-secret=from_realinstance
> --enable-foreman-plugin-salt \

Remove this line - you don't want to install the Foreman plugin if
you're just installing a smart proxy. It's probably the cause of the error.

> --enable-foreman-proxy-plugin-salt

This is the line you need to keep for the smart proxy.

··· On 17/02/16 10:31, Tom K. wrote:


Dominic Cleal
dominic@cleal.org

>
> Thanks Dominic for response.

I've removed it and reinstall it on a clean salt-master again. (thanks vm
snapshots)

foreman-installer --no-enable-foreman
–no-enable-foreman-cli
–no-enable-foreman-plugin-bootdisk
–no-enable-foreman-plugin-setup
–no-enable-puppet
–enable-foreman-proxy
–foreman-proxy-tftp=false
–foreman-proxy-foreman-base-url=https://realforemaninstance.zone.loc
–foreman-proxy-trusted-hosts=realforemaninstance.zone.loc
–foreman-proxy-oauth-consumer-key=from_realinstance
–foreman-proxy-oauth-consumer-secret=from_realinstance
–enable-foreman-proxy-plugin-salt

Proxy salt-master.zone.loc cannot be registered (422 Unprocessable
Entity): Unable to communicate with the proxy: ERF12-2530
[ProxyAPI::ProxyException]: Unable to detect features
([Errno::ECONNREFUSED]: Connection refused - connect(2) for
"salt-master.zone.loc" port 8443) for proxy
https://salt-master.zone.loc:8443/features Please check the proxy is
configured and running on the host.
/Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[salt-master.zone.loc]/ensure:
change from absent to present failed: Proxy salt-master.zone.loc cannot be
registered (422 Unprocessable Entity): Unable to communicate with the
proxy: ERF12-2530 [ProxyAPI::ProxyException]: Unable to detect features
([Errno::ECONNREFUSED]: Connection refused - connect(2) for
"salt-master.zone.loc" port 8443) for proxy
https://salt-master.zone.loc:8443/features Please check the proxy is
configured and running on the host.
/Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[salt-master.zone.loc]:
Failed to call refresh: Proxy salt-master.zone.loc cannot be registered
(ApipieBindings::MissingArgumentsError: id): N/A
/Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[salt-master.zone.loc]:
Proxy salt-master.zone.loc cannot be registered
(ApipieBindings::MissingArgumentsError: id): N/A
Installing Done
[100%]
[…]
Something went wrong! Check the log for ERROR-level output
** Foreman is running at https://salt-master.zone.loc*
Initial credentials are admin / securepwd

  • Foreman Proxy is running at https://salt-master.zone.loc:8443
  • Puppetmaster is running at port 8140
    The full log is at /var/log/foreman-installer/foreman-installer.log

Why is "Forman is running at" pointing to my salt-master instead of the
value for parameter
–foreman-proxy-foreman-base-url=https://realforemaninstance.zone.loc
Also : why is Puppetmaster at port 8140, I though I've disabled it with
"–no-enable-puppet", on the other hand if it's needed, how to set the real
puppetmaster which runs on realforemaninstance.zone.loc

The foreman-installer.log does not contain any errors.

– Tom

> Proxy salt-master.zone.loc cannot be registered (422 Unprocessable
> Entity): Unable to communicate with the proxy: ERF12-2530
> [ProxyAPI::ProxyException]: Unable to detect features
> ([Errno::ECONNREFUSED]: Connection refused - connect(2) for
> "salt-master.zone.loc" port 8443) for proxy
> https://salt-master.zone.loc:8443/features Please check the proxy is
> configured and running on the host.

Is the smart proxy process running? Is it listening on that port?

Perhaps it hit an error while starting up, in which case check the log
file under /var/log/foreman-proxy or try starting it yourself (service
foreman-proxy start).

> Something went wrong! Check the log for ERROR-level output
> */Foreman is running at https://salt-master.zone.loc/
> Initial credentials are admin / securepwd
> * Foreman Proxy is running at https://salt-master.zone.loc:8443
> * Puppetmaster is running at port 8140
> The full log is at /var/log/foreman-installer/foreman-installer.log
>
>
>
> Why is "Forman is running at" pointing to my salt-master instead of the
> value for parameter
> --foreman-proxy-foreman-base-url=https://realforemaninstance.zone.loc
> Also : why is Puppetmaster at port 8140, I though I've disabled it with
> "–no-enable-puppet", on the other hand if it's needed, how to set the
> real puppetmaster which runs on realforemaninstance.zone.loc

Just ignore those, they're for a default setup with Foreman and Puppet.
It's probably indicative of a bug though, as they shouldn't show up if
those modules are disabled. Please do file it!

··· On 17/02/16 15:02, Tom K. wrote:


Dominic Cleal
dominic@cleal.org

Thanks a lot. No, it's not running.

proxy.log says

E, [2016-02-13T04:39:30.327401 #10441] ERROR – : Unable to load private
SSL key. Are the values correct in settings.yml and do permissions allow
reading?: No such file or directory @ rb_sysopen -
/var/lib/puppet/ssl/private_keys/salt-master.zone.loc.pem
E, [2016-02-13T04:39:30.327620 #10441] ERROR – : Error during startup,
terminating. No such file or directory @ rb_sysopen -
/var/lib/puppet/ssl/private_keys/salt-master.zone.loc.pem

Seems that my keys are missing. The Documentation is sometimes really
hard…

I try to do it as describe in the Documentation
at Foreman :: Plugin Manuals

Two things…

  1. if I need, describe in the error log, my pems, where to I get them? From
    MasterPuppet at realforemaninstance? (… how to create…)
  2. If I follow the Installation Guide, at 2.1.2 I have to provide in the
    /etc/salt/forman.yaml (thinking in salt-master) the ssl_key and ssl_cert.
    As described I think I've to copy the foreman's pems, am I right?

– Tom

··· Am Mittwoch, 17. Februar 2016 16:05:42 UTC+1 schrieb Dominic Cleal: > > On 17/02/16 15:02, Tom K. wrote: > > Proxy salt-master.zone.loc cannot be registered (422 Unprocessable > > Entity): Unable to communicate with the proxy: ERF12-2530 > > [ProxyAPI::ProxyException]: Unable to detect features > > ([Errno::ECONNREFUSED]: Connection refused - connect(2) for > > "salt-master.zone.loc" port 8443) for proxy > > https://salt-master.zone.loc:8443/features Please check the proxy is > > configured and running on the host. > > Is the smart proxy process running? Is it listening on that port? > > Perhaps it hit an error while starting up, in which case check the log > file under /var/log/foreman-proxy or try starting it yourself (service > foreman-proxy start). > > > Something went wrong! Check the log for ERROR-level output > > */Foreman is running at https://salt-master.zone.loc/ > > Initial credentials are admin / securepwd > > * Foreman Proxy is running at https://salt-master.zone.loc:8443 > > * Puppetmaster is running at port 8140 > > The full log is at /var/log/foreman-installer/foreman-installer.log > > > > > > > > Why is "Forman is running at" pointing to my salt-master instead of the > > value for parameter > > --foreman-proxy-foreman-base-url=https://realforemaninstance.zone.loc > > Also : why is Puppetmaster at port 8140, I though I've disabled it with > > "--no-enable-puppet", on the other hand if it's needed, how to set the > > real puppetmaster which runs on realforemaninstance.zone.loc > > Just ignore those, they're for a default setup with Foreman and Puppet. > It's probably indicative of a bug though, as they shouldn't show up if > those modules are disabled. Please do file it! > > -- > Dominic Cleal > dom...@cleal.org >

> Thanks a lot. No, it's not running.
>
> proxy.log says
>
> E, [2016-02-13T04:39:30.327401 #10441] ERROR – : Unable to load private
> SSL key. Are the values correct in settings.yml and do permissions allow
> reading?: No such file or directory @ rb_sysopen -
> /var/lib/puppet/ssl/private_keys/salt-master.zone.loc.pem
> E, [2016-02-13T04:39:30.327620 #10441] ERROR – : Error during startup,
> terminating. No such file or directory @ rb_sysopen -
> /var/lib/puppet/ssl/private_keys/salt-master.zone.loc.pem
>
> Seems that my keys are missing. The Documentation is sometimes really
> hard…
>
> I try to do it as describe in the Documentation
> at Foreman :: Plugin Manuals

I think this doc's slightly slanted towards installation on a single host.

> Two things…
>
> 1) if I need, describe in the error log, my pems, where to I get them?
> From MasterPuppet at realforemaninstance? (… how to create…)

You should generate a new certificate for this host, usually by running
"puppet cert generate salt-master.zone.loc" on your Puppet (CA) master
and copying the new salt-master cert/key over, or by running the Puppet
agent on the new host and signing as usual.

http://theforeman.org/manuals/1.10/index.html#3.2.3InstallationScenarios
has some instructions on the former.

Don't copy Foreman's own certs from one host to the other, they're not
applicable.

> 2) If I follow the Installation Guide, at 2.1.2 I have to provide in the
> /etc/salt/forman.yaml (thinking in salt-master) the ssl_key and
> ssl_cert. As described I think I've to copy the foreman's pems, am I right?

These will probably be the generated certs above, specifically for your
salt-master rather than Foreman's own certs.

··· On 17/02/16 15:24, Tom K. wrote:


Dominic Cleal
dominic@cleal.org