Puppet安裝部署入門版

時間  2019-12-23
標籤 puppet 安裝 部署 入門 简体版
原文   原文鏈接
puppet 簡介
puppet官方網站： http://www.puppetlabs.com/
puppet中文wiki： http://puppet.chinaec2.com/
puppet中文論壇： http://www.puppetfans.com/
puppet是一種Linux、Unix平臺的集中配置管理系統，所謂配置管理系統，就是管理機器裏面諸如文件，用戶，進程，軟件包這些資源，其設計目標是簡化對這些資源的管理以及妥善處理資源間的依賴關係
puppet使用一種描述性語言來定義配置項，配置項中被稱爲」資源」，描述性語言能夠聲明你的配置的狀態---好比聲明一個軟件包應該被安裝或者一個服務應該被啓動
用puppet，能夠運行一個服務器端，而後每一個客戶端經過ssl證書鏈接服務器，獲得本機器的配置列表，而後更加列表的來完成配置工做，因此若是硬件配置好，在一天以內配置好上千上萬臺機器是很容易實現的事情，前提得大部分機器配置相似
在大規模的生成環境中，若是隻有一臺puppetmaster會忙不過來的，由於puppet是用ruby寫的，ruby是解析型語言，每一個客戶端來訪 問，都要解析一次，當客戶端多了就忙不過來，因此須要擴展成一個服務器組。puppetmaster能夠看做一個web服務器，實際上也是由ruby提供 的web服務器模塊來作的。所以能夠利用web代理軟件來配合puppetmaster作集羣設置
puppe項目主要開發者是Luke Kanies，目前是puppet labs CEO，puppet遵循GPLv2版權協議。從1997年開始Kanies參與UNIX的系統管理工做，Puppet的開發源於這些經驗。由於對已有的配置工具不甚滿意，從2001年到2005年間，Kanies開始在Reductive實驗室從事工具的開發。很快，Reductive實驗室發佈了他們的旗艦產品——

與Luke Kanies談Puppet工具：http://article.yeeyan.org/view/neilalaer/4629
puppet 系統架構
Puppet是開源的基於Ruby的系統配置管理工具，puppet是一個C/S結構, 固然,這裏的C能夠有不少,所以,也能夠說是一個星型結構. 全部的puppet客戶端同一個服務器端的puppet通信. 每一個puppet 客戶端每半小時( 能夠設置) 鏈接一次服務器端, 下載最新的配置文件,而且嚴格按照配置文件來配置服務器. 配置完成之後,puppet客戶端能夠反饋給服務器端一個消息. 若是出錯,也會給服務器端反饋一個消息. 下圖展現了一個典型的puppet配置的數據流動狀況
puppet 工做流程


實驗環境：

puppetmaster   10.13.89.165    lianglab.com
puppet         10.13.89.185    lianglab4.com
安裝步驟：
因爲centos最小化安裝，須要yum一些經常使用工具
[root@lianglab ~]#  yum install ntp vixie-cron wget vim-enhanced telnet
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.163.com
* extras: mirrors.163.com
* rpmforge: ftp.riken.jp
* updates: mirrors.163.com
Setting up Install Process
安裝NTP同步時間，統一master和client上的時間
crontables（用來安裝、卸裝、或列舉用來驅動 cron 守護進程的表格的程序）默認是安裝的，可vixie-cron軟件包是cron的主程序
wget下載安裝文件
VI只默認安裝了vim-minimal－7.x，因此不管是輸入vi或者 vim查看文件，syntax功能都沒法正常啓用。所以須要用yum安裝另外兩個組件：vim-common-7.x和vim-enhanced- 7.x ，yum vim-enhanced-會自動下載關聯vim-common
telnet只安裝client，便於測試網絡連通性
[root@lianglab soft]# chkconfig --level 35 ntpd on
[root@lianglab soft]# crontab -e
no crontab for root - using an empty one
10 5 * * * root /usr/sbin/ntpdate time.nist.gov ; /sbin/hwclock –w
#天天凌晨5點10分同步time.nist.gov，並將 Linux 時間寫入 BIOS時
[root@lianglab soft]# service crond restart
[root@lianglab soft]# ntpdate pool.ntp.org;hwclock -w
15 Jun 11:27:31 ntpdate[4925]: adjust time server 180.153.100.115 offset 0.031925 sec
[root@lianglab soft]#
Puppet 要求全部機器有完整的域名（FQDN），若是沒有 DNS 服務器提供域名的話，能夠在兩臺機器上設置主機名（注意要先設置主機名再安裝 Puppet，因安裝 Puppet 時會把主機名寫入證書，客戶端和服務端通訊須要這個證書）：
[root@lianglab soft]# echo "10.13.89.185 lianglab4.com" >>/etc/hosts
[root@lianglab soft]# hostname
lianglab.com
[root@lianglab soft]# cat /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=lianglab.com
[root@lianglab soft]#
[root@lianglab soft]# cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search taobao.ali.com
nameserver 10.13.2.6
nameserver 10.1.23.6
[root@lianglab soft]#
--------------------------------------------------------------------------------------------------
安裝ruby
因爲puppet是由ruby語言編寫，因此要安裝ruby環境及庫文件,命令幫助文件
[root@lianglab soft]# yum install ruby ruby-libs ruby-rdoc
安裝facter
puppet資源下載點 http://downloads.puppetlabs.com/
facter是一個系統盤點工具，收集主機的一些資料，好比CPU，主機IP等，它收集到值發送給puppet服務器端,服務器端就能夠根據不一樣的條件來對不一樣的節點機器生成不一樣的puppet配置文件
安裝puppet以前必須先安裝facter
[root@lianglab soft]# wget http://downloads.puppetlabs.com/facter/facter-1.6.8.tar.gz
--2013-06-15 12:15:55--  http://downloads.puppetlabs.com/facter/facter-1.6.8.tar.gz
正在解析主機 downloads.puppetlabs.com... 96.126.116.126, 2600:3c00::f03c:91ff:fe93:711a
Connecting to downloads.puppetlabs.com|96.126.116.126|:80... 已鏈接。
已發出 HTTP 請求，正在等待迴應... 200 OK
長度：119323 (117K) [application/x-gzip]
Saving to: `facter-1.6.8.tar.gz'
100%[===================================================>] 119,323      152K/s   in 0.8s    
2013-06-15 12:15:57 (152 KB/s) - `facter-1.6.8.tar.gz' saved [119323/119323]
[root@lianglab soft]#
[root@lianglab soft]#
[root@lianglab soft]# tar -zxvf facter-1.6.8.tar.gz
------省略--------
facter-1.6.8/conf/osx/PackageInfo.plist
facter-1.6.8/conf/osx/preflight
facter-1.6.8/bin/facter
[root@lianglab soft]# cd facter-1.6.8
[root@lianglab facter-1.6.8]# ruby install.rb
facter-1.6.8/conf/osx/PackageInfo.plist
facter-1.6.8/conf/osx/preflight
facter-1.6.8/bin/facter
[root@lianglab soft]# cd facter-1.6.8
[root@lianglab facter-1.6.8]# ruby install.rb
which: no rst2man.py in (/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin)
install -c -p -m 0755 /tmp/facter-binfile.27543.0 /usr/bin/facter
mkdir -p -m 755 /usr/lib/ruby/site_ruby/1.8
-------------省略-------------------
install -c -p -m 0644 lib/facter/util/plist/generator.rb /usr/lib/ruby/site_ruby/1.8/facter/util/plist/generator.rb
Loaded suite install
Started
Finished in 0.000588 seconds.
0 tests, 0 assertions, 0 failures, 0 errors
[root@lianglab facter-1.6.8]#
安裝puppet
[root@lianglab facter-1.6.8]# cd ..
--2013-06-15 12:21:13--  http://downloads.puppetlabs.com/puppet/puppet-2.7.14.tar.gz
正在解析主機 downloads.puppetlabs.com... 96.126.116.126, 2600:3c00::f03c:91ff:fe93:711a
Connecting to downloads.puppetlabs.com|96.126.116.126|:80... 已鏈接。
已發出 HTTP 請求，正在等待迴應... 200 OK
長度：1898410 (1.8M) [application/x-gzip]
Saving to: `puppet-2.7.14.tar.gz'
100%[===================================================>] 1,898,410    474K/s   in 4.4s    
2013-06-15 12:21:18 (422 KB/s) - `puppet-2.7.14.tar.gz' saved [1898410/1898410]
[root@lianglab soft]#
[root@lianglab soft]# tar -zxvf puppet-2.7.14.tar.gz
[root@lianglab soft]# cd puppet-2.7.14
[root@lianglab puppet-2.7.14]# ruby install.rb
--------------省略-------------------
man/man8/puppet-doc.8 -> /usr/share/man/man8/puppet-doc.8
chmod 0644 /usr/share/man/man8/puppet-doc.8
man/man8/pi.8 -> /usr/share/man/man8/pi.8
chmod 0644 /usr/share/man/man8/pi.8
man/man8/puppet-describe.8 -> /usr/share/man/man8/puppet-describe.8
chmod 0644 /usr/share/man/man8/puppet-describe.8
man/man8/puppet-device.8 -> /usr/share/man/man8/puppet-device.8
chmod 0644 /usr/share/man/man8/puppet-device.8
man/man8/puppet-man.8 -> /usr/share/man/man8/puppet-man.8
chmod 0644 /usr/share/man/man8/puppet-man.8
man/man8/puppetca.8 -> /usr/share/man/man8/puppetca.8
chmod 0644 /usr/share/man/man8/puppetca.8
man/man5/puppet.conf.5 -> /usr/share/man/man5/puppet.conf.5
chmod 0644 /usr/share/man/man5/puppet.conf.5
[root@lianglab puppet-2.7.14]#
複製配置文件
[root@lianglab puppet-2.7.14]# cp conf/redhat/fileserver.conf /etc/puppet/
[root@lianglab puppet-2.7.14]# cp conf/redhat/puppet.conf /etc/puppet/
[root@lianglab puppet-2.7.14]# cp conf/redhat/server.init /etc/init.d/puppetmaster
[root@lianglab puppet-2.7.14]#
添加puppet用戶
[root@lianglab puppet-2.7.14]# groupadd puppet
[root@lianglab puppet-2.7.14]# useradd -g puppet -s /bin/false -M puppet
[root@lianglab puppet-2.7.14]#
驗證一下安裝是否成功
[root@lianglab puppet-2.7.14]# puppet master
[root@lianglab puppet-2.7.14]# ps -ef | grep puppet  | grep -v grep
puppet   27781     1  0 12:30 ?        00:00:00 /usr/bin/ruby /usr/bin/puppet master
[root@lianglab puppet-2.7.14]#
[root@lianglab puppet-2.7.14]# kill 27781
[root@lianglab puppet-2.7.14]# ps -ef | grep puppet  | grep -v grep
[root@lianglab puppet-2.7.14]#
設置puppetmaster爲服務，並自動啓動，確認puppetmaster是否有執行權限
將puppetmaster服務腳本添加爲服務，並在三、5級別啓動。
[root@lianglab puppet-2.7.14]# chmod 755 /etc/init.d/puppetmaster
[root@lianglab puppet-2.7.14]# chkconfig --add puppetmaster
[root@lianglab puppet-2.7.14]# chkconfig --level 35 puppetmaster on
[root@lianglab puppet-2.7.14]#
[root@lianglab puppet-2.7.14]# /etc/init.d/puppetmaster restart
中止 puppetmaster：[失敗]
啓動 puppetmaster：[肯定]
[root@lianglab puppet-2.7.14]#
[root@lianglab puppet-2.7.14]# ps -ef | grep puppet  | grep -v grep
puppet   27883     1  0 12:48 ?        00:00:00 /usr/bin/ruby /usr/sbin/puppetmasterd
[root@lianglab puppet-2.7.14]#
1）確認是否生成清單文件夾
[root@lianglab puppet-2.7.14]# ll /etc/puppet/
總計 16
-rw-r--r-- 1 root root 2552 06-15 12:22 auth.conf
-rwxr-xr-x 1 root root  381 06-15 12:23 fileserver.conf
drwxr-xr-x 2 root root 4096 06-15 12:30 manifests
-rwxr-xr-x 1 root root  853 06-15 12:23 puppet.conf
[root@lianglab puppet-2.7.14]#
2）確認系統生成puppet用戶
[root@lianglab puppet-2.7.14]# cat /etc/passwd | grep puppet
puppet:x:503:504::/home/puppet:/bin/false
[root@lianglab puppet-2.7.14]#
3）保證/var/lib/puppet/rrd目錄存在且屬主是puppet
[root@lianglab puppet-2.7.14]# ll /var/lib/puppet/
總計 36
drwxr-x--- 2 puppet puppet 4096 06-15 12:30 bucket
drwxr-xr-x 2 root root 4096 06-15 12:30 facts
drwxr-xr-x 2 root root 4096 06-15 12:30 lib
drwxr-x--- 2 puppet puppet 4096 06-15 12:30 reports
drwxr-x--- 2 puppet puppet 4096 06-15 12:30 rrd
drwxr-x--- 2 puppet puppet 4096 06-15 12:30 server_data
drwxrwx--x 8 puppet root 4096 06-15 12:30 ssl
drwxr-xr-t 2 root root 4096 06-15 12:30 state
drwxr-x--- 2 puppet puppet 4096 06-15 12:30 yaml
====================================客戶端配置=========================================
[root@lianglab4 ~]# echo "10.13.89.165 lianglab.com" >> /etc/hosts
[root@lianglab4 ~]# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1               lianglab4.com lianglab4 localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
10.13.89.165 lianglab.com
[root@lianglab4 ~]#
[root@lianglab4 ~]# hostname
lianglab4.com
[root@lianglab4 ~]# cat /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=lianglab4.com
[root@lianglab4 ~]#
在客戶端安裝ruby facter puppet的步驟與服務端安裝同樣
yum install ruby ruby-libs ruby-rdoc
wget http://downloads.puppetlabs.com/facter/facter-1.6.8.tar.gz
tar -zxvf facter-1.6.8.tar.gz
cd facter-1.6.8
ruby install.rb
wget http://downloads.puppetlabs.com/puppet/puppet-2.7.14.tar.gz
tar -zxvf puppet-2.7.14.tar.gz
cd puppet-2.7.14
ruby install.rb
特別說明：請注意客戶端和服務器端版本要一致。若是版本不一致的話，那麼高版本的只能是puppet server,另外一臺只能做爲puppet客戶端，也就是說puppet 服務端的版本能夠大於或者等於客戶端版本，不能夠小於
其中區別一些以下：
[root@lianglab4 puppet-2.7.14]# cp conf/redhat/client.init /etc/init.d/puppet
[root@lianglab4 puppet-2.7.14]# chkconfig --add puppet
[root@lianglab4 puppet-2.7.14]# chkconfig --level 35 puppet on
[root@lianglab4 puppet-2.7.14]# groupadd puppet
[root@lianglab4 puppet-2.7.14]# useradd -g puppet -s /bin/false -M puppet
[root@lianglab4 puppet-2.7.14]#
測試解析與puppetmaster端口是否暢通
[root@lianglab4 puppet-2.7.14]# telnet lianglab.com 8140
Trying 10.13.89.165...
Connected to lianglab.com (10.13.89.165).
Escape character is '^]'.
Connection closed by foreign host.
[root@lianglab4 puppet-2.7.14]#
[root@lianglab4 puppet-2.7.14]# /etc/init.d/puppet start
啓動 puppet：Could not prepare for execution: Could not create PID file: /var/lib/puppet/run/agent.pid
                                                          [肯定]
[root@lianglab4 puppet-2.7.14]#
puppetd --test --server lianglab.com命令是指puppetd 從 lianglab.com去讀取
puppet配置文件. 第一次鏈接,雙方會進行ssl證書的驗證,這是一個新的客戶端,在服務器端那裏尚未被認證,所以須要在服務器端進行證書認證
如下這步批准證書是在服務端操做
A。咱們要向服務器申請證書
[root@lianglab4 puppet-2.7.14]# puppetd --test --server lianglab.com
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for ca
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
info: Creating a new SSL certificate request for lianglab4.com
info: Certificate Request fingerprint (md5): 50:2D:89:E5:B8:6A:11:4A:6E:5D:AB:3F:47:21:A1:12
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
Exiting; no certificate found and waitforcert is disabled
[root@lianglab4 puppet-2.7.14]#
B：服務端接受申請
[root@lianglab puppet-2.7.14]# puppetca --list      #查看當前待批准證書列表
 lianglab4.com (50:2D:89:E5:B8:6A:11:4A:6E:5D:AB:3F:47:21:A1:12)
[root@lianglab puppet-2.7.14]#
[root@lianglab puppet-2.7.14]# puppetca -s lianglab4.com     #批准當前證書
notice: Signed certificate request for lianglab4.com
notice: Removing file Puppet::SSL::CertificateRequest lianglab4.com at '/var/lib/puppet/ssl/ca/requests/lianglab4.com.pem'
[root@lianglab puppet-2.7.14]#
查看驗證簽名,注意前面的+號，說明已經簽名
[root@lianglab puppet-2.7.14]# puppetca -a --list
+ lianglab.com  (71:46:13:EC:A1:FB:E2:43:57:6B:AA:14:CC:4B:0E:5E) (alt names: DNS:lianglab.com, DNS:puppet, DNS:puppet.com)
+ lianglab4.com (14:C3:F9:3C:7D:73:0B:08:CF:C4:1E:B6:71:7B:9C:A7)
[root@lianglab puppet-2.7.14]#
--------------------------------------------------------------------------------------------------
若是要批准所有證書
puppetca -s -a
也能夠在puppetmaster端的puppet.conf加入這行：
autosign = true
服務端就自動簽證書
--------------------------------------------------------------------------------------------------
C:回到客戶端操做，從服務端取回已批准的證書
[root@lianglab4 puppet-2.7.14]# puppetd --test --server lianglab.com
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for lianglab4.com
info: Caching certificate_revocation_list for ca
info: Caching catalog for lianglab4.com
info: Applying configuration version '1371275671'
info: Creating state file /var/lib/puppet/state/state.yaml
notice: Finished catalog run in 0.15 seconds
[root@lianglab4 puppet-2.7.14]#
注意：上文中的紅色部分，生成證書時主界面會寫入證書，若是生成證書後再更改主機名證書就失效了。
並且請不要用cliens相似簡稱名字，而應該用lianglab4.com這樣全名申請證書，從新審批舊機器的新證書，
當申請到證書之後咱們對比下這兩個文件，他們的MD5值是同樣的。
驗證證書是否正確
服務端：
[root@lianglab puppet-2.7.14]# md5sum /var/lib/puppet/ssl/ca/signed/lianglab4.com.pem
4b059e3937cfee49ff98d5bd5557b2db  /var/lib/puppet/ssl/ca/signed/lianglab4.com.pem
[root@lianglab puppet-2.7.14]#
客戶端：
[root@lianglab4 puppet]# md5sum /md5sum /var/lib/puppet/ssl/certs/lianglab4.com.pem
4b059e3937cfee49ff98d5bd5557b2db /var/lib/puppet/ssl/certs/lianglab4.com.pem
------------------------------------------------------------------------------------------------
其實申請證書的過程就是服務器端生成證書，併發送到客戶端的過程。
若是由於意外要從新給舊機器審批證書，咱們須要作如下兩點才能夠從新註冊。
出現修改主機名問題引發沒法認證，須要從新申請證書，操做如下兩個步驟：
puppetca --clean lianglab4.com        #清除服務端的證書。
或者rm -rf /var/lib/puppet/ssl/ca/signed/lianglab4.com.pem刪除已經註冊給客戶機「client.gongchang.com」的證書;
rm -rf /var/lib/puppet/ssl/  #客戶端要刪掉ssl目錄。而後執行a、b、c三步。
服務端：
[root@server ca]# rm -rf /var/lib/puppet/ssl/ca/signed/client1.viong.com.pem
客戶端：
[root@client1 puppet-2.7.14]# rm -rf /var/lib/puppet/ssl/
------------------------------------------------------------------------------------------------
功能測試-------------------------------------------------------
在服務器端新建一個/etc/puppet/manifests/site.pp文件，新建pp文件測試，puppet的第一個執行的代碼是在/etc/puppet/manifest/site.pp所以這個文件必須存在,並且其餘的代碼也要經過代碼來調用.
[root@lianglab puppet-2.7.14]# vi /etc/puppet/manifests/site.pp
node default {
file {"/tmp/Puppet_test.txt":                         #這是文件路徑名；
content=>"This is test of PUPPET"; }                 #這是文件的內容；
　}
上面的代碼對默認連入的puppet客戶端執行一個操做,在/tmp目錄生成一個Puppet_test.txt文件,內容是goThis is test of PUPPET! 並自動回車換行
初次建立pp文件，須要重啓puppetmaster
[root@lianglab puppet-2.7.14]# /etc/init.d/puppetmaster restart
中止 puppetmaster：[肯定]
啓動 puppetmaster：[肯定]
[root@lianglab puppet-2.7.14]#
[root@lianglab puppet-2.7.14]# puppet /etc/puppet/manifests/site.pp    #執行此命令使site.pp配置生效；
warning: Implicit invocation of 'puppet apply' by passing files (or flags) directly
to 'puppet' is deprecated, and will be removed in the 2.8 series.  Please
invoke 'puppet apply' directly in the future.
notice: /Stage[main]//Node[default]/File[/tmp/Puppet_test.txt]/ensure: defined content as '{md5}d395f8aa0b8a631c726a9a3f411093c6'
notice: Finished catalog run in 0.04 seconds
[root@lianglab puppet-2.7.14]#
咱們在回到客戶端執行命令會獲得以下提示信息：
[root@lianglab4 puppet]# puppetd --test --server lianglab.com
info: Caching catalog for lianglab4.com
info: Applying configuration version '1371277359'
notice: /Stage[main]//Node[default]/File[ /tmp/Puppet_test.txt]/ensure: defined content as '{md5}d395f8aa0b8a631c726a9a3f411093c6'
notice: Finished catalog run in 0.05 seconds
[root@lianglab4 puppet]#
[root@lianglab4 puppet]# cat /tmp/Puppet_test.txt
This is test of PUPPET
[root@lianglab4 puppet]#
設置客戶端的守護進程
[root@lianglab4 puppet]# service puppet stop
[root@lianglab4 puppet]# puppetd --test --server lianglab.com --verbose --waitforcert 100
info: Caching catalog for lianglab4.com
info: Applying configuration version '1371277359'
notice: Finished catalog run in 0.03 seconds
[root@lianglab4 puppet]#
--server 服務端FQDN –-verbose 輸出冗餘信息 –-waitforcert 超時100
部分狀況下puppet服務會沒法啓動，且提示puppet已經啓動，這個時候須要刪除一個文件：
[root@client ~]#/usr/sbin/puppetd --test --server master.gongchang.com
notice: Run of Puppet configuration client already in progress; skipping
[root@client ~]#rm /var/lib/puppet/state/puppetdlock
Puppet C/S環境搭建完畢。
文檔先整理到這來，資源管理這塊涉及到不少內容須要花時間慢慢研究的，
文章整理共計花費4個小時多，可是仍是挺順利的。
感謝這個博主： http://viong.blog.51cto.com
相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程