我正在尝试configurationpuppet-dashboard，并且遇到Inventory / facts的问题：
Could not retrieve facts from inventory service: 403 "Forbidden request: puppetmasterhostname(ip.address.was.here) access to /facts/agenthostname.example.com [find] at line 99 " 在puppet master的/etc/puppet/auth.conf中：
path /facts method find auth any allow *
我重新启动了木偶大师和傀儡仪表，但是我仍然得到了上述错误。 任何想法或疑难解答提示？
UPDATE
我正在运行木偶v2.7.13。 按照要求，这是我的完整的/etc/puppet/auth.conf。 其中大部分是已经在configuration中的默认值：
# allow nodes to retrieve their own catalog (ie their configuration) path ~ ^/catalog/([^/]+)$ method find allow $1 # allow nodes to retrieve their own node definition path ~ ^/node/([^/]+)$ method find allow $1 # allow all nodes to access the certificates services path /certificate_revocation_list/ca method find allow * # allow all nodes to store their reports path /report method save allow * # inconditionnally allow access to all files services # which means in practice that fileserver.conf will # still be used path /file allow * ### Unauthenticated ACL, for clients for which the current master doesn't ### have a valid certificate; we allow authenticated users, too, because ### there isn't a great harm in letting that request through. # allow access to the master CA path /certificate/ca auth any method find allow * path /certificate/ auth any method find allow * path /certificate_request auth any method find, save allow * # this one is not stricly necessary, but it has the merit # to show the default policy which is deny everything else path / auth any # Inventory path /facts method find auth any allow *
/etc/puppet/puppet.conf
[main] # The Puppet log directory. # The default value is '$vardir/log'. logdir = /var/log/puppet # Where Puppet PID files are kept. # The default value is '$vardir/run'. rundir = /var/run/puppet # Where SSL certificates are kept. # The default value is '$confdir/ssl'. ssldir = $vardir/ssl [agent] # The file in which puppetd stores a list of the classes # associated with the retrieved configuratiion. Can be loaded in # the separate ``puppet`` executable using the ``--loadclasses`` # option. # The default value is '$confdir/classes.txt'. classfile = $vardir/classes.txt # Where puppetd caches the local configuration. An # extension indicating the cache format is added automatically. # The default value is '$confdir/localconfig'. localconfig = $vardir/localconfig [master] reports = store, http reporturl = http://puppetmasterhostname.example.com:3000/reports/upload facts_terminus = yaml storeconfigs = true storeconfigs_backend = puppetdb node_terminus = exec external_nodes = /usr/bin/env PUPPET_DASHBOARD_URL=http://localhost:3000 /opt/puppet-dashboard/bin/external_node
我的configuration有以下…
path /facts auth any allow * path /fact auth any allow * path /facts_search allow *
我想我也必须像这样创build一个名为namespaceauth.conf的空文件;
touch /etc/puppet/namespaceauth.conf
我有同样的问题，发现/etc/puppet/auth.conf中的第99 /etc/puppet/auth.conf对应于以下内容：
# this one is not stricly necessary, but it has the merit # to show the default policy which is deny everything else path / auth any
注释path /和auth any允许仪表板使用以下configuration访问清单：
path /facts auth yes method find, search allow dashboard
…取自http://docs.puppetlabs.com/dashboard/manual/1.2/configuring.html 。
namespace.conf和其他path不是我需要的。
这是一个订购问题 – 确保部分：
path /facts method find auth any allow *
在默认部分之前：
# this one is not stricly necessary, but it has the merit # to show the default policy which is deny everything else path / auth any
这工作+为我解决了这个问题。 或者如上所述，你可以评论它！
你遇到的问题是双重的。 首先，你的auth.conf文件需要有适当的访问权限。 这里提到的许多解决scheme都能达到这个目标，但风险很大！ 通过使用以下内容：
path /facts auth any allow * path /fact auth any allow * path /facts_search allow *
…你允许*访问
“星号”意味着每个人！
要解决这个问题，你需要auth.conf来：
path /facts auth yes method find, search allow dashboard
然后，您需要为“仪表板”用户创build证书，就像您为节点做的一样。 在CentOS 6上用puppet-dashboard-1.2.23-1.el6.noarch，这些步骤是：
1）确保config / settings.yml具有正确的主机名和端口为您puppetmaster
2）为仪表板生成密钥对：
sudo -u puppet-dashboard rake cert:create_key_pair
3）生成仪表板的证书请求：
sudo -u puppet-dashboard rake cert:request
4）傀儡大师，签署证书：
puppet cert sign dashboard
5）取得木偶大师的证书
sudo -u puppet-dashboard rake cert:retrieve
6）重新启动仪表板
所有这些都将允许仪表板通过证书authentication访问您的木偶大师事实。
请享用！