Force to apply changes through puppet on a puppet agent, through master?

Question

Is it possible to issue a command from master puppet, to a node, to run agent and apply the latest configuration to it?

Like, I have lost password for a user and i am not able to login, but puppet agent is installed on the server and I can apply the changes on the server by running the puppet agent, but as its not running automatically and I cannot login to run it manually, how to run it and apply configuration through the puppet master? (if possible)

Solution 1

According to their Deprecated Command Line Features:

[In Puppet 4.0] The puppet kick command is gone, and the agent daemon will no longer listen for incoming HTTPS connections.

If you or your scripts use puppet kick, you’ll need to either install MCollective for a more robust and parallel task running system or use a parallel SSH tool to kick off Puppet runs. If you use Puppet Enterprise, you can already use its orchestration features to trigger Puppet runs.

You’ll probably want to close port 8139, while you’re at it.

(Emphasis mine on closing port 8139)

Solution 2

Try

puppet kick --host <hostname>

Reference: kick man page.

Comments

[Admin]

Similar to what Zoredache mentions below, if the agent isn't running, there's no way to force it to check back in. Puppet is a pull system, not a push one (the agent decides when to check in, not the master). To reduce the chance of this happening in the future, you could (a) set up ssh key exchange between the puppetmaster and the clients for root login, (b) create cron jobs to start puppet agent if it's not running.

[Admin]

what is the agent is demonized? is there any way to push the changes to it?

[Admin]

If the agent is running on the client, you can do whatever you want by editing manifests on the puppetmaster and waiting on the agent to check in: install packages, copy ssh keys from the puppetmaster, rewrite configuration files, etc. If the agent is not running on the client, and you have no other working means of remote access as root, you will have to fix it physically with a rescue CD or some other method, which would be a different question.

[Admin]

have a look at this: github.com/alcCapone/doll Very basic, but still helpful

[Admin]

What version of Puppet?

[Zoredache]

Of course this assumes that his agent is daemonized. But since he mentions the agent is not running automatically, I suspect this will not help.

[iamauser]

As I understood, puppet should be configured on the client, but not necessarily need to be daemonized. In addition the client needs to be configured to be able listen to port 8139 for tcp connections. Related note, I realized that puppet kick is deprecated, don't know if it has an improved method.

[Farhan]

had been trying all day, no success. it gives error : Triggering vpmve.co.uk Host vpmve.co.uk failed: Connection refused - connect(2) vpmve.co.uk finished with exit code 2 Failed: vpmve.co.uk

[iamauser]

Yes, I ran across the same problem, trying myself, haven't looked in detail though. You could use a trace and debug for the command to see what's going on. e.g. puppet kick --trace --host <hostname> --debug

[ravi yarlagadda]

kick won't work unless listen = true is set in the agent's puppet.conf. It's also deprecated, you probably don't want to start using it now.

[Farhan]

so that means the master cannot trigger the client run in any way :( only traditional ssh passwordless key way out?

[John Mee]

kick is deprecated... so what the 'right' way to do this now?

[GabrieleV]

I use puppet-kick on old debian squeeze. Yes, it's deprecated, and puppetlabs suggest to use mcolletive.

[Gagan93]

@iamuser Please update documentation link : docs.puppet.com/puppet/3/reference/man/kick.html thanks :)

[shearn89]

I believe Puppet Bolt is the new orchestration framework. Although I've commonly used Ansible for orchestration alongside Puppet for config management...