Bug #1883
closedBare metal install fails to pull kickstart file
Description
Anaconda is unable to load kickstart files when kicking new host. WEBrick gives following error:
Started GET "/unattended/provision" for 10.21.96.90 at Wed Oct 03 14:21:08 -0700 2012 Processing by UnattendedController#provision as HTML Found lxtest2.local.com Remove puppet certificate for lxtest2.local.com Failed to remove lxtest2.local.com's puppet certificate: 406 Not Acceptable Rendered text template (0.0ms) Completed 500 Internal Server Error in 970ms (Views: 0.9ms | ActiveRecord: 2.6ms)
So its failing to remove it's old puppet certificate. Which there souldn't be one, its baremetal/brand new box. Following on this, here's the log from /var/log/foreman-proxy/proxy.log:
D, [2012-10-03T14:21:08.107492 #1616] DEBUG -- : Found puppetca at /usr/sbin/puppetca D, [2012-10-03T14:21:08.107688 #1616] DEBUG -- : Found sudo at /usr/bin/sudo D, [2012-10-03T14:21:08.107756 #1616] DEBUG -- : Executing /usr/bin/sudo -S /usr/sbin/puppetca --clean lxtest2.local.com W, [2012-10-03T14:21:09.051218 #1616] WARN -- : Failed to run puppetca: ^[[1;35merr: Could not call revoke: Could not find a serial number for lxtest2.local.com^[[0m Could not find a serial number for lxtest2.local.com E, [2012-10-03T14:21:09.051639 #1616] ERROR -- : Failed to remove certificate(s) for lxtest2.local.com: Execution of puppetca failed, check log files
Obviously running from command line gives same result as smart-proxy had.
[root@lxforeman1 ~]# /usr/sbin/puppetca --clean lxtest1.local.com err: Could not call revoke: Could not find a serial number for lxtest1.local.com Could not find a serial number for lxtest1.local.com
It looks like the error in WEBrick comes from foreman/app/models/orchestration/puppetca.rb where it tries to delete the cert. As a work around I'm creating the certs by hand with 'puppetca generate lxtest2.local.com'. I found this in [[http://theforeman.org/issues/1529]]
Either creating a new host in the web interface needs to create the initial puppet cert or calling the kickstart file shouldn't fail if the cert doesn't exist. Not sure which is best solution.