puppet集中配置管理系统

puppet是一个配置管理工具,典型的,puppet是一个C/S结构,当然,这里的C可以有很多,因

此,也可以说是一个星型结构.所有的puppet客户端同一个服务器端的puppet通讯.每个

puppet客户端每半小时(可以设置)连接一次服务器端,下载最新的配置文件,并且严格按照配

置文件来配置服务器.配置完成以后,puppet客户端可以反馈给服务器端一个消息.如果出错,

也会给服务器端反馈一个消息.下图展示了一个典型的puppet配置的数据流动情况.

稳定性puppet与其他手工操作工具有一个的区别就是puppet的配置具有稳定性,因此你可以多次执行puppet,一旦你更新了你的配置文件,puppet就会根据配置文件来更改你的机配置,通常每30分钟检查一次.puppet会让你的系统状态同配置文件所要求的状态保持一致.比如你配置文件里面要求ssh服务必须开启.假如不小心ssh服务被关闭了,那么下一次执行puppet的

时候,puppet会发现这个异常,然后会开启ssh服务.以使系统状态和配置文件保持一

致.puppet就象一个魔术师,会让你的混乱的系统收敛到puppet配置文件所想要的状态.

可以使用puppet管理服务器的整个生命周期,从初始化到退役.不同于传统的例如sun的

Jumpstart或者redhat的Kickstart,puppet可以长年让服务器保持最新状态.只要一开始就正

确的配置他们,然后再也不用去管他们.通常puppet用户只需要给机器安装好puppet并让他们

运行,然后剩余的工作都由puppet来完成.

puppet的细节和原理

1.客户端Puppetd向Master发起认证请求,或使用带签名的证书。

2.Master告诉Client你是合法的。

3.客户端Puppetd调用Facter,Facter探测出主机的一些变量,例如主机名、内存大小、IP地址

等。Puppetd将这些信息通过SSL连接发送到服务器端。

4.服务器端的PuppetMaster检测客户端的主机名,然后找到manifest对应的node配置,并对该部分内容进行解析。Facter送过来的信息可以作为变量处理,node牵涉到的代码才解析,其他没牵涉的代码不解析。解析分为几个阶段,首先是语法检查,如果语法错误就报错;如果语法没错,就继续解析,解析的结果生成一个中间的“伪代码”(catelog),然后把伪代码发给客户端。

5.客户端接收到“伪代码”,并且执行。

6.服务器端把客户端的执行结果写入日志,并发送给报告系统。

详细配置过程：

系统环境:rhel6.5selinuxandiptablesdisabled

sever:172.25.254.1vm1.example.compuppetmaster

client:172.25.254.2vm2.example.compuppetagent

client:172.25.254.3vm3.example.compuppetagent

重要:server与所有client之间需要解析,以及时间同步,不然会验证失败。

server端:

puppetmaster的安装:

a.如果主机能上网

#yumlocalinstall-yrubygems-1.3.7-1.el6.noarch.rpm

把以下条目加入yum仓库:

[puppet]

name=puppet

baseurl=http://yum.puppetlabs.com/el/6Server/products/x86_64/

gpgcheck=0

[ruby]

name=ruby

baseurl=http://yum.puppetlabs.com/el/6Server/dependencies/x86_64/

gpgcheck=0

#yuminstallpuppet-server-y

b.如果主机不能上网

需呀下载以下安装包：

[root@vm1update]#ls

facter-2.4.4-1.el6.x86_64.rpmruby-augeas-0.4.1-3.el6.x86_64.rpm

hiera-1.3.4-1.el6.noarch.rpmrubygem-json-1.5.5-3.el6.x86_64.rpm

puppet-3.8.1-1.el6.noarch.rpmrubygems-1.3.7-5.el6.noarch.rpm

puppet-dashboard-1.2.23-1.el6.noarch.rpmruby-shadow-2.2.0-2.el6.x86_64.rpm

puppet-server-3.8.1-1.el6.noarch.rpm

[root@vm1update]#yumlocalinstall-ypuppet-server-3.8.1-1.el6.noarch.rpmpuppet-3.8.1-1.el6.noarch.rpmfacter-2.4.4-1.el6.x86_64.rpmhiera-1.3.4-1.el6.noarch.rpmrubygem-json-1.5.5-3.el6.x86_64.rpmruby*

/etc/puppet配置目录:

组织结构如下:

|--puppet.conf#主配置配置文件,详细内容可执行puppet--genconfig

|--fileserver.conf#文件服务器配置文件

|--auth.conf#认证配置文件

|--autosign.conf#自动验证配置文件

|--tagmail.conf#邮件配置文件(将错误信息发送)

|--manifests#文件存储目录(puppet会先读取该目录的.PP文件)

|--nodes

|puppetclient.pp

|--site.pp#定义puppet相关的变量和默认配置。

|--modules.pp#加载class类模块文件(includesyslog)

|--modules #定义模块

|--syslog #以syslog为例

|--file

|--manifests

|--init.pp #class类配置

|--templates #模块配置目录

|--syslog.erb#erb模板

puppet的第一个执行的代码是在/etc/puppet/manifest/site.pp,因此这个文件必须存在,而

且其他的代码也要通过该文件来调用。

[root@vm1puppet]#touch/etc/puppet/manifest/site.pp #没有此文件puppetmaster无法启动,配置后面再定义

[root@vm1puppet]#servicepuppetmasterstart #启动puppetmaster

[root@vm1puppet]#netstat-antlp|grepruby

tcp000.0.0.0:81400.0.0.0:*LISTEN1863/ruby

client端:

只要安装puppet即可,安装方法同server端:

a.

#yuminstallpuppet-y

b.

[root@vm2~]#yumlocalinstall-ypuppet-3.8.1-1.el6.noarch.rpmpuppet-3.8.1-1.el6.noarch.rpmfacter-2.4.4-1.el6.x86_64.rpmhiera-1.3.4-1.el6.noarch.rpmrubygem-json-1.5.5-3.el6.x86_64.rpmruby*

puppet客户端连接到puppetmaster:

[root@vm2~]#puppetagent--servervm1.example.com--no-daemonize--verbose

Info:CreatinganewSSLkeyforvm2.example.com

Info:Cachingcertificateforca

Info:CreatinganewSSLcertificaterequestfor vm2.example.com

Info:CertificateRequestfingerprint(SHA256):

5C:72:77:D8:27:DF:5A:DF:34:EF:25:97:5A:CF:25:29:9F:58:83:A2:61:57:D9:20:7B:1E:C0:36:75:9D:

FB:FC

client向master发出证书验证请求,然后等待master签名并返回证书。

参数--server指定了需要连接的puppetmaster的名字或是地址,默认连接名为“puppet”的主机

如要修改默认连接主机可以修改/etc/sysconfig/puppet文件中的PUPPET_SERVER=puppet选项

参数--no-daemonize是puppet客户端运行在前台

参数--verbose使客户端输出详细的日志

在master端:

[root@vm1puppet]#puppetcertlist #显示所有等待签名的证书

"vm2.example.com"(SHA256)

CD:BD:13:D0:B8:46:07:F2:B7:AE:00:C4:E6:E9:E1:A4:92:F6:A4:F1:AB:F7:FF:8D:BE:B0:B7:90:E1:

7B:A8:C0

[root@vm1puppet]#puppetcertsignvm2.example.com #签名证书

Signedcertificaterequestforvm2.example.com

RemovingfilePuppet::SSL::CertificateRequestvm2.example.comat

\'/var/lib/puppet/ssl/ca/requests/vm2.example.com.pem\'

如要同时签名所有证书,执行以下命令:

[root@vm1puppet]#puppetcertsign--all

[root@vm1puppet]#puppetcertclean vm2.example.com #删除签名证书

在对证书签名后的两分钟后,在agent端上可以看到如下输出:

Info:Cachingcertificateforvm2.example.com

StartingPuppetclientversion3.0.0

Info:Cachingcertificate_revocation_listforca

Info:Retrievingplugin

Info:Cachingcatalogforvm2.example.com

Info:Applyingconfigurationversion\'1349536603\'

Finishedcatalogrunin0.13seconds

自动验证:

在server端,编辑puppet.conf文件:

[root@vm1puppet]#vim/etc/puppet/puppet.conf

[main]

autosign=true

#允许所有客户端的认证

/etc/puppet目录下创建autosign.conf文件,内容如下:

#vim/etc/puppet/autosign.conf

*.example.com #表示允许所有example.com域的主机

[root@vm1puppet]#servicepuppetmasterreload

在client端只需执行:

#puppetagent或#serverpuppetstart

在实际中有时会修改client端的主机名,这样就需要重新生成证书:

1)在server端执行:puppetcert--clean vm2.example.com#你要删除的原client端主机名

2)在client端执行:rm-fr/var/lib/puppet/ssl/*

3)puppetagent--servervm1.example.com--no-daemonize--verbose

puppet资源定义

以下资源均定义在/etc/puppet/manifest/site.pp文件中,在没有指定节点的情况下,对所有

已经经过验证的client都生效。

1.创建文件

[root@vm1puppet]#vim/etc/puppet/fileserver.conf加入以下行：

[files]

path/etc/puppet/files

allow*.example.com

[root@vm1puppet]#servicepuppetmasterreload#重启服务

[root@vm1manifests]#vimsite.pp

file{"/mnt/testfile":#在/mnt下创建testfile文件

source=>"puppet:///files/passwd"#来源：server端/etc/puppet/files/passwd

source=>"/etc/passwd"#来源：client端/etc/passwd

}

2.软件包定义

package{"httpd":ensure=>present;#安装httpd

"vsftpd":ensure=>absent#卸载vsftpd

}

3.服务定义

service{"httpd":ensure=>running; #启动httpd

"vsftpd":ensure=>stopped #关闭vsftpd

}

4.组定义

group{"wonder":gid=>600}

5.用户定义

user{"wonder": #创建wonder用户

uid=>600,

gid=>600,

home=>"/home/wonder",

shell=>"/bin/bash",

password=>westos

}

file{"/home/wonder":

owner=>wonder,

group=>wonder,

mode=>700,

ensure=>directory

}

file{"/home/wonder/.bash_profile":

source=>"/etc/skel/.bash_profile",

owner=>wonder,

group=>wonder

}

file{"/home/wonder/.bashrc":

source=>"/etc/skel/.bashrc",

owner=>wonder,

group=>wonder

}

user{"test":uid=>900, #创建test用户

home=>"/home/test",

shell=>"/bin/bash",

provider=>useradd,

managehome=>true,

ensure=>present

}

exec{"echowestos|passwd--stdintest":

path=>"/usr/bin:/usr/sbin:/bin",

onlyif=>"idtest"

}

6.文件系统挂载

mount{"/mnt":#172.25.254.252主机需要开启nfs服务

device=>"172.25.254.252:/var/ftp/pub",

fstype=>"nfs",

options=>"defaults",

ensure=>absent

}

自动挂载文件系统,并同步fstab文件,如果需要卸载,改为absent

7.crontab任务

cron{echo:#2点到4点每隔10分钟，把时间导入/tmp/echo

command=>"/bin/echo`/bin/date`>>/tmp/echo",

user=>root,

hour=>[\'2-4\'],

minute=>\'*/10\'

}

#任务会在client上/var/spool/cron目录中生成

不同节点的定义:

1.在puppetmaster上编辑site.pp

[root@vm1puppet]#vim/etc/puppet/manifests/site.pp#写上

import"nodes/*.pp"

2.建立节点文件

[root@vm1puppet]#vim/etc/puppet/manifests/nodes/vm2.pp

node\'vm2\'{

package{"httpd":ensure=>present}

}

[root@vm1puppet]#vim/etc/puppet/manifests/nodes/vm3.pp

node\'vm3\'{

user{"test":uid=>900,

home=>"/home/test",

shell=>"/bin/bash",

provider=>useradd,

managehome=>true,

ensure=>present

}

exec{"echowestos|passwd--stdintest":

path=>"/usr/bin:/usr/sbin:/bin",

onlyif=>"idtest"

}

}

编写模块:

[root@vm1puppet]#mkdir-p/etc/puppet/modules/httpd/{files,manifests,templates}

[root@vm1puppet]#cd/etc/puppet/modules/httpd/manifests

[root@vm1manifests]#viminstall.pp

classhttpd::install{

package{"httpd":

ensure=>present

}

}

[root@vm1manifests]#vimconfig.pp

classhttpd::config{

file{"/etc/httpd/conf/httpd.conf":

ensure=>present,

source=>"puppet:///modules/httpd/httpd.conf",

#实际路径在/etc/puppet/modules/httpd/files/httpd.conf

require=>Class["httpd::install"],

notify=>Class["httpd::service"]

}

}

[root@vm1manifests]#vimservice.pp

classhttpd::service{

service{"httpd":

ensure=>running,

require=>Class["httpd::install","httpd::config"]

}

file{"/var/www/html/index.html":#添加web主页

source=>"puppet:///files/index.html"

}

}

[root@vm1manifests]#viminit.pp

classhttpd{

includehttpd::install,httpd::config,httpd::service

}

[root@vm1manifests]#vim/etc/puppet/manifests/nodes/vm2.pp

node\'vm2\'{

includehttpd

}

[root@vm1manifests]#servicepuppetmasterreload

模板应用(添加虚拟主机配置):

文件存放在templates目录中,以*.erb结尾。

[root@vm1manifests]#vim/etc/puppet/modules/httpd/manifests/init.pp#添加以下行

definehttpd::vhost($domainname){

#file{"/etc/httpd/conf/httpd.conf":

#

content=>template("httpd/httpd.conf.erb")

#}

file{"/etc/httpd/conf.d/${domainname}_vhost.conf":

content=>template("httpd/httpd_vhost.conf.erb"),

require=>Class["httpd::install"],

notify=>Class["httpd::service"]

}

file{"/var/www/$domainname":

ensure=>directory

}

file{"/var/www/$domainname/index.html":

content=>$domainname

}

}

[root@vm1manifests]#vim/etc/puppet/modules/httpd/templates/httpd_vhost.conf.erb

ServerName<%=domainname%>

DocumentRoot/var/www/<%=domainname%>

ErrorLoglogs/<%=domainname%>_error.log

CustomLoglogs/<%=domainname%>_access.logcommon

[root@vm1manifests]#vi/etc/puppet/manifests/nodes/vm2.pp

node\'vm2\'{

includehttpd

httpd::vhost{\'server2.example.com\':

domainname=>"server2.example.com",

}

}

Puppetdashboard安装(用以web方式管理puppet)

依赖性:

*Ruby1.8.7

*RubyGems

*Rake>=0.8.3

*MySQLserver5.x

*Ruby-MySQLbindings2.7.xor2.8.x

所需安装包puppet-dashboard-1.2.12-1.el6.noarch.rpmrubygem-rake-0.8.7-2.1.el6.noarch.rpmruby-mysql-2.8.2-1.el6.x86_64.rpm

[root@vm1manifests]#yumlocalinstall-ypuppet-dashboard-1.2.12-1.el6.noarch.rpmrubygem-rake-0.8.7-2.1.el6.noarch.rpmruby-mysql-2.8.2-1.el6.x86_64.rpm

[root@vm1manifests]#yuminstall-ymysqlmysql-server

[root@vm1manifests]#/etc/init.d/mysqldstart

配置mysql数据库:

mysql>CREATEDATABASEdashboard_productionCHARACTERSETutf8;

QueryOK,1rowaffected(0.00sec)

mysql>CREATEUSER\'dashboard\'@\'localhost\'IDENTIFIEDBY\'westos\';

QueryOK,0rowsaffected(0.01sec)

mysql>GRANTALLPRIVILEGESONdashboard_production.*TO\'dashboard\'@\'localhost\';

QueryOK,0rowsaffected(0.00sec)

mysql>

#cd/usr/share/puppet-dashboard/

[root@vm1puppet-dashboard]#vimconfig/database.yml#只留下生产环境配置

production:

database:dashboard_production

username:dashboard

password:westos

encoding:utf8

adapter:mysql

[root@vm1puppet-dashboard]#rakeRAILS_ENV=productiondb:migrate

#建立dashboard所需的数据库和表

puppet-dashboard默认时区不正确,需要修改:

[root@vm1puppet-dashboard]#vim/usr/share/puppet-dashboard/config/settings.yml

time_zone:\'Beijing\'

启动服务:

[root@vm1puppet-dashboard]#servicepuppet-dashboardstart

StartingPuppetDashboard:=>BootingWEBrick

=>Rails2.3.14applicationstartingonhttp://0.0.0.0:3000

[OK]

[root@vm1puppet-dashboard]#chmod0666/usr/share/puppet-dashboard/log/production.log

[root@vm1puppet-dashboard]#servicepuppet-dashboard-workersstart

实时报告汇总:

设置server端:

root@vm1~]#vim/etc/puppet/puppet.conf

[main]

#添加以下两项

reports=http

reporturl=http://172.25.254.1:3000/reports

root@vm1~]#servicepuppetmasterreload

设置client端:

[root@vm1puppet-dashboard]#vim/etc/puppet/puppet.conf#添加以下行

[agent]

report=true

[root@vm1puppet-dashboard]#servicepuppetreload

在客户端安装完puppet后,并且认证完后,我们可以看到效果,那怎样让它自动与服务器同步

呢?默认多少分钟跟服务器同步呢?怎样修改同步的时间呢,这时候我们需要配置客户端:

(1)配置puppet相关参数和同步时间:

[root@vm2~]#vim/etc/sysconfig/puppet

PUPPET_SERVER=puppet.example.com#puppetmaster的地址

PUPPET_PORT=8140 #puppet监听端口

PUPPET_LOG=/var/log/puppet/puppet.log#puppet本地日志

#PUPPET_EXTRA_OPTS=--waitforcert=500【默认同步的时间,我这里不修改这行参数】

(2)默认配置完毕后,客户端会半个小时跟服务器同步一次,我们可以修改这个时间。

[root@vm2~]#vim/etc/puppet/puppet.conf

[agent]

runinterval=60#代表60秒跟服务器同步一次

[root@vm2~]#servicepuppetreload

对puppet的优化 通过nginx + passenger替换掉puppet的WEBRickHTTP，来处理HTTPS请求，并实现对puppet的负载均衡。

实验步骤：
master 端需要能够连上外网
把以下条目加入 yum 仓库:
[puppet]
name=puppet
baseurl=http://yum.puppetlabs.com/el/6Server/products/x86_64/
gpgcheck=0
[ruby]
name=ruby
baseurl=http://yum.puppetlabs.com/el/6Server/dependencies/x86_64/
gpgcheck=0

# yum install -y gcc gcc-c++ curl-devel zlib-devel openssl-devel ruby-devel

# gem install rack passenger ##次过程需要等待一段时间

# gem list

*** LOCAL GEMS ***

json (1.5.5)
passenger (5.0.15)
rack (1.6.4)
rake (10.4.2)

# passenger-config --root
/usr/lib/ruby/gems/1.8/gems/passenger-5.0.15

# ls /usr/lib/ruby/gems/1.8/gems/passenger-5.0.15/ext/
apache2 boost common libev libuv nginx oxt ruby #nginx 等许多支持

# passenger-install-nginx-module
脚本会自动安装 nginx 支持,按提示操作,基本就是一路回车。

nginx 默认安装在/opt/nginx 目录:

# vim /opt/nginx/conf/nginx.conf
1 #user nobody;
2 worker_processes 4;
3
4 #error_log logs/error.log;
5 #error_log logs/error.log notice;
6 #error_log logs/error.log info;
7
8 #pid logs/nginx.pid;
9
10
11 events {
12 use epoll;
13 worker_connections 1024;
14 }
15
16
17 http {
18 passenger_root /usr/lib/ruby/gems/1.8/gems/passenger-5.0.15;
19 passenger_ruby /usr/bin/ruby;
20
21 include mime.types;
22 default_type application/octet-stream;
23
24 #log_format main \'$remote_addr - $remote_user [$time_local] "$request" \'
25 # \'$status $body_bytes_sent "$http_referer" \'
26 # \'"$http_user_agent" "$http_x_forwarded_for"\';
27
28 #access_log logs/access.log main;
29
30 sendfile on;
31 tcp_nopush on;
32
33 #keepalive_timeout 0;
34 keepalive_timeout 65;
35
36 #gzip on;
37
38 server {
39 listen 8140;
40 server_name benberba.example.com;
41 root /etc/puppet/rack/public;
42 passenger_enabled on;
43 passenger_set_header X_CLIENT_DN $ssl_client_s_dn;
44 passenger_set_header X_CLIENT_VERIFY $ssl_client_verify;
45 ssl on;
46 ssl_session_timeout 5m;
47 ssl_certificate /var/lib/puppet/ssl/certs/vm1.example.com.pem;
48 ssl_certificate_key /var/lib/puppet/ssl/private_keys/vm1.example.co m.pem;
49 ssl_client_certificate /var/lib/puppet/ssl/ca/ca_crt.pem;
50 ssl_crl /var/lib/puppet/ssl/ca/ca_crl.pem;
51 ssl_verify_client optional;
52 ssl_ciphers SSLv2:-LOW:-EXPORT:RC4+RSA;
53 ssl_prefer_server_ciphers on;
54 ssl_verify_depth 1;
55 ssl_session_cache shared:SSL:128m;
56 }
57 }

# mkdir /etc/puppet/rack/{public,tmp} -p
# cp /usr/share/puppet/ext/rack/config.ru /etc/puppet/rack/
# chown puppet.puppet /etc/puppet/rack/config.ru
# chkconfig puppetmaster off
# service puppetmaster stop
# /opt/nginx/sbin/nginx -t #检测 nginx
# /opt/nginx/sbin/nginx #启动 nginx
puppetmaster 不需要启动 , nginx 启动时会自动调用 puppet。

测试
master端
# netstat -antpl |grep 8140
tcp 0 0 0.0.0.0:8140 0.0.0.0:* LISTEN 4245/nginx
# /etc/init.d/puppetmaster status
puppet is stopped

client端
# puppet agent --server vm1.example.com --no-daemonize --verbose
Notice: Starting Puppet client version 3.8.1
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for vm2.example.com
Info: Applying configuration version \'1440218993\'
Notice: Finished catalog run in 0.21 seconds