You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In some environments, agents can't directly connect to the cluster's masters. In those situation, cluster onboarding (e.g. ticket generation) gets delegated to satellites. This is already possible, using icinga2_delegate_host.
However, for this to work, the satellite needs to have the TicketSalt of the master system(s) configured in order to calculate a valid ticket. This exposes the TicketSalt unnecessarily, as it gets persisted on the agent's file system.
Also, when provisioning for the first time, the passed TicketSalt hasn't been loaded into Icinga2's running state yet, and below command actually fails, leaving the instance in kind of a limbo.
However, it's possible to pass the TicketSalt to the CLI command being issued by Ansible in this situation:
Could we introduce another variable, e.g. delegated_ticket_salt, that allows us to only expose the TicketSalt during provisioning satellites/agents via Ansible?
The text was updated successfully, but these errors were encountered:
In some environments, agents can't directly connect to the cluster's masters. In those situation, cluster onboarding (e.g. ticket generation) gets delegated to satellites. This is already possible, using
icinga2_delegate_host
.However, for this to work, the satellite needs to have the
TicketSalt
of the master system(s) configured in order to calculate a valid ticket. This exposes the TicketSalt unnecessarily, as it gets persisted on the agent's file system.Also, when provisioning for the first time, the passed
TicketSalt
hasn't been loaded into Icinga2's running state yet, and below command actually fails, leaving the instance in kind of a limbo.However, it's possible to pass the TicketSalt to the CLI command being issued by Ansible in this situation:
icinga2 pki ticket --salt <salt_goes_here> --cn mocdaniel.example.com
Could we introduce another variable, e.g.
delegated_ticket_salt
, that allows us to only expose theTicketSalt
during provisioning satellites/agents via Ansible?The text was updated successfully, but these errors were encountered: