Re: [Puppet Users] Best practices for infrastructure

jcbollinger
Thu, 29 Aug 2013 13:02:20 -0000

On Wednesday, August 28, 2013 12:00:21 PM UTC-5, Martin Langhoff
wrote:
>
> On Wed, Aug 28, 2013 at 9:31 AM, jcbollinger
<John.Bo...@stjude.org<javascript:>>
> wrote:
> > If the objective is to render it into a small number of words,
>
> Just to double-check my understanding is right. If the client-reported
> $::hostname does not match the certname, _and_ I am only using
''node
> "fqdn"'' entries in my Puppet manifests, puppet will
use... certname or
> client-reported $::hostname?
>
>
The master will always choose the node block to use based on the
client''s
SSL certname (spelled $::clientcert in Puppet DSL).  Likewise, if you use
an ENC then it is the certname that the master passes to it when requesting
a node classification.  It is common for $::hostname to have the same value
as the certname, but the master itself in no way depends on such a
coincidence.

Indeed, some sites intentionally assign certnames that do not match
hostnames.  For example, they may use MAC addresses instead.  That has
considerable advantages when machines do not have stable hostnames.


John