zoukankan      html  css  js  c++  java

  • 在CentOS 6.4上安装Puppet配置管理工具

    在CentOS 6.4上安装Puppet配置管理工具

    linux, puppetAdd comments
    五052013

     

    上篇说了下在ubuntu12.04上安装puppet，安装的版本为puppet2.7.11版本，今天尝试了下在CentOS6.4系统上安装puppet 3.1.1版本,本文参考chenshake的文章

    ?
    1
    2
    3
    4
    OS:centso 6.4 X64
    Puppet 3.1.1
    Puppet master: master.canghai.com
    Puppet clients:node1-5.canghai.com

    Puppet 要求所有机器有完整的域名（FQDN），如果没有 DNS 服务器提供域名的话，可以在两台机器上设置主机名（注意要先设置主机名再安装 Puppet，因为安装 Puppet 时会把主机名写入证书，客户端和服务端通信需要这个证书）,因为我配置了DNS，所以就不用改hosts了，如果没有就需要改hosts文件指定。
    1.关闭selinux，iptables，并设置ntp
    采用CentOS-6.4-x86_64-minimal.iso最小化安装，因此先要安装ntp、wget等常用工具
    安装ntp wget

    ?
    1
    yum install wget ntp -y

    关闭selinux

    ?
    1
    2
    sed -i '/SELINUX/ s/enforcing/disabled/g' /etc/selinux/config
    setenforce 0

    停止iptables

    ?
    1
    2
    3
    4
    chkconfig ip6tables off
    chkconfig iptables off
    /etc/init.d/ip6tables stop
    /etc/init.d/iptables stop

    设置ntp

    ?
    1
    2
    3
    ntpdate pool.ntp.org
    chkconfig ntp on
    service ntpd start

    2.安装puppet服务
    puppet不在CentOS的基本源中，需要加入 PuppetLabs 提供的官方源：

    ?
    1
    2
    3
    wget http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-7.noarch.rpm
    rpm -ivh puppetlabs-release-6-7.noarch.rpm
    yum update

    在 master上安装和启用 puppet 服务：

    ?
    1
    2
    3
    yum install puppet-server
    chkconfig puppet on
    service puppetmaster start

    在clients上安装puppet客户端

    ?
    1
    2
    3
    yum install puppet
    chkconfig puppet on
    service puppet start

    3.配置puppet
    对于puppet 客户端，修改/etc/puppet/puppet.conf，指定master服务器

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    vi /etc/puppet/puppet.conf
     
    [main]
    # The Puppet log directory.
    # The default value is '$vardir/log'.
    logdir = /var/log/puppet
     
    # Where Puppet PID files are kept.
    # The default value is '$vardir/run'.
    rundir = /var/run/puppet
     
    # Where SSL certificates are kept.
    # The default value is '$confdir/ssl'.
    ssldir = $vardir/ssl
     
    [agent]
    # The file in which puppetd stores a list of the classes
    # associated with the retrieved configuratiion. Can be loaded in
    # the separate ``puppet`` executable using the ``--loadclasses``
    # option.
    # The default value is '$confdir/classes.txt'.
    classfile = $vardir/classes.txt
     
    # Where puppetd caches the local configuration. An
    # extension indicating the cache format is added automatically.
    # The default value is '$confdir/localconfig'.
    localconfig = $vardir/localconfig
    server = master.canghai.com

    并重启puppet服务

    ?
    1
    service puppet restart

    4.Client申请证书
    服务端自动签发证书设置
    设置master自动签发所有的证书，我们只需要在/etc/puppet 目录下创建 autosign.conf 文件。（不需要修改 /etc/puppet/puppet.conf文件，因为我默认的autosign.conf 文件的位置没有修改）

    ?
    1
    2
    3
    4
    cat > /etc/puppet/autosign.conf <<EOF
    *.canghai.com
    EOF
    service puppetmaster restart

    这样就会对所有来自canghai.com的机器的请求，都自动签名。
    client需要向服务器端发出请求, 让服务器对客户端进行管理. 这其实是一个证书签发的过程. 第一次运行 puppet 客户端的时候会生成一个 SSL 证书并指定发给 Puppet 服务端, 服务器端如果同意管理客户端,就会对这个证书进行签发，可以用这个命令来签发证书，由于我们已经在客户端设置了server地址，因此不需要跟服务端地址

    ?
    1
    puppet agent

    为了详细了解注册的过程和日后排错,可以增加参数，因为配置文件里
    –no-daemonize 前台输出日志
    –verbose 输入更加详细的日志
    –debug 更加详细的日志，排错的时候使用
    –test 表示测试，就带一个–test参数就可以

    ?
    1
    puppet agent --no-daemonize --onetime --verbose --debug

    就可以申请证书了，由于我配置的自动签发证书，所以直接就签发了，在服务端执行

    ?
    1
    2
    3
    4
    5
    6
    7
    puppet cert list --all
    + "master.canghai.com" (SHA256) CA:50:6A:51:D5:AD:F0:73:BF:83:A0:4A:BF:1F:4E:F0:56:C9:4B:D8:4D:BB:62:10:EE:14:16:D5:96:D0:B6:F7 (alt names: "DNS:master.canghai.com", "DNS:puppet", "DNS:puppet.canghai.com")
    + "node1.canghai.com" (SHA256) B8:95:69:2B:7B:3E:F4:38:CA:63:BE:A0:ED:3C:E7:05:1F:93:53:2D:1C:60:67:E9:D8:20:99:90:B8:9B:D6:40
    + "node2.canghai.com" (SHA256) 6C:65:34:9D:B1:82:35:24:EF:3F:10:2B:10:F0:0B:44:42:AB:84:42:29:B5:73:1A:A0:1D:D5:1E:9E:24:BC:E3
    + "node3.canghai.com" (SHA256) 57:54:33:37:23:A7:CD:BE:F6:25:BD:6F:E3:DA:F9:57:48:50:C7:5E:36:8F:F4:BA:C8:27:DF:B0:A2:84:5F:AF
    + "node4.canghai.com" (SHA256) 65:2F:0E:E7:98:F5:05:40:31:2F:FF:36:A5:3E:DE:C1:91:E8:45:16:55:60:A1:82:74:BC:84:EC:BA:C0:62:F0
    + "node5.canghai.com" (SHA256) 8C:1B:31:B6:C0:9C:A5:AF:89:6C:85:1B:BA:D0:03:63:07:4C:B1:89:D4:E6:B7:4E:CA:4A:23:C7:3C:5F:CA:3D

    就可以看到所有客户端已经都已签发证书，前面带”+”号的就是签发成功的，撸过没有签名的，可以用

    ?
    1
    puppet cert --sign node1.canghai.com

    进行签发证书,签发后在master，执行

    ?
    1
    puppet cert list --all

    即可看到证书已经签发
    5.在服务端安装puppet的dashboard
    安装mysql

    ?
    1
    yum install -y mysql mysql-devel mysql-server

    优化mysql设置
    编辑 /etc/my.cnf, 在[mysqld]字段,增加最后一行

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    cat /etc/my.cnf
    [mysqld]
    datadir=/var/lib/mysql
    socket=/var/lib/mysql/mysql.sock
    user=mysql
    # Disabling symbolic-links is recommended to prevent assorted security risks
    symbolic-links=0
    max_allowed_packet = 32M
    [mysqld_safe]
    log-error=/var/log/mysqld.log
    pid-file=/var/run/mysqld/mysqld.pid

    启动服务

    ?
    1
    2
    /etc/init.d/mysqld start
    chkconfig mysqld on

    设置mysql密码，我这里使用是密码是123456

    ?
    1
    mysqladmin -u root password '123456'

    创建一个dashboard数据库

    ?
    1
    2
    3
    4
    5
    6
    mysql -uroot -p123456 <<EOF
    CREATE DATABASE dashboard CHARACTER SET utf8;
    CREATE USER 'dashboard'@'localhost' IDENTIFIED BY '123456';
    GRANT ALL PRIVILEGES ON dashboard.* TO 'dashboard'@'localhost';
    FLUSH PRIVILEGES;
    EOF

    Passenger+Apache+Dashboard
    这是让Apache支持ruby,由于Passenger不在centos官方源里，因此要添加epel的源

    ?
    1
    2
    3
    wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
    rpm -ivh epel-release-6-8.noarch.rpm
    yum install mod_passenger puppet-dashboard

    配置Dashboard

    ?
    1
    2
    3
    4
    5
    6
    7
    vi /usr/share/puppet-dashboard/config/database.yml
    production:
      database: dashboard
      username: dashboard
      password: 123456
      encoding: utf8
      adapter: mysql

    修改时区

    ?
    1
    2
    3
    4
    vi /usr/share/puppet-dashboard/config/environment.rb
     
      #config.time_zone = 'UTC'
      config.time_zone = 'Beijing'

    初始化数据库

    ?
    1
    2
    cd /usr/share/puppet-dashboard/
    rake RAILS_ENV=production db:migrate

    配置Apache
    我们需要整合Passenger和apache

    ?
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    cat > /etc/httpd/conf.d/passenger.conf << EOF
    LoadModule passenger_module modules/mod_passenger.so
     
    PassengerRoot /usr/share/rubygems/gems/passenger-3.0.17
    PassengerRuby /usr/bin/ruby
    PassengerHighPerformance on
    PassengerMaxPoolSize 12
    PassengerPoolIdleTime 1500
    PassengerStatThrottleRate 120
    RailsAutoDetect On
     
    ServerName master.canghai.com
    DocumentRoot "/usr/share/puppet-dashboard/public/"
    &lt;Directory "/usr/share/puppet-dashboard/public/"&gt;
    Options None
    AllowOverride AuthConfig
    Order allow,deny
    allow from all
     
    ErrorLog /var/log/httpd/master.canghai.com_error.log
    LogLevel warn
    CustomLog /var/log/httpd/master.canghai.com_access.log combined
    ServerSignature On
     
    EOF

    启动服务

    ?
    1
    2
    /etc/init.d/httpd start
    chkconfig httpd on

    配置puppet
    让Dashboard使用Reports，现在默认agent是已经启用Report的功能，所以你就不需要设置agent,你只需要设置Server端就可以

    ?
    1
    2
    3
    4
    vi /etc/puppet/puppet.conf
    [master]
    reports = store, http
    reporturl = http://master.canghai.com:80/reports/upload

    重启puppetmaster 服务

    ?
    1
    /etc/init.d/puppetmaster restart

    这时候就可以直接用 http://ip 访问puppet Dashboard
    2013-05-05_210851
    导入报告

    ?
    1
    2
    cd /usr/share/puppet-dashboard
    rake RAILS_ENV=production reports:import

    这时候你访问Dashboard,可以看到导入的任务.
    2013-05-05_220858
    4. 执行导入的reports

    ?
    1
    2
    cd /usr/share/puppet-dashboard
    rake jobs:work RAILS_ENV="production"

    2013-05-05_221221

    Posted by  at 下午 9:37Tagged with: , , 

     16 Responses to “在CentOS 6.4上安装Puppet配置管理工具”

    1. adong says:
      2013 年 6 月 11 日 at 下午 12:35

      初始化数据库的时候：rake RAILS_ENV=production db:migrate

      出现以下错误：

      (in /usr/share/puppet-dashboard)
      config.gem: Unpacked gem sass-3.1.2 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem rspec-rails-1.3.4 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem rack-1.1.6 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem will_paginate-2.3.15 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem thoughtbot-shoulda-2.10.2 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem json_pure-1.7.7 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem mocha-0.9.7 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem rdoc-3.6.1 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem factory_girl-1.3.3 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem daemons-1.0.10 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem haml-3.1.2 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      config.gem: Unpacked gem rspec-1.3.2 in vendor/gems has no specification file. Run ‘rake gems:refresh_specs’ to fix this.
      rake aborted!
      syntax error on line 49, col 2: ` encoding: utf8′

      (See full trace by running task with –trace)

      是什么问题？

      回复
    2. MingmingS says:
      2014 年 1 月 6 日 at 上午 8:35

      Importing: 100% |###############################################################################################################| Time: 00:00:00
      7 of 7 reports queued

      这里测试用，我的report已经导出了，7条记录，但是在web页面中却没一直是— No reports found —，中间也没异常error

      回复
    3. Adams Dun says:
      2014 年 2 月 17 日 at 上午 11:31

      大神，完全按照你的步骤，两台CentOS 6.4部署Puppet
      到设置Passenger和apache整合的时候出现问题，提示/etc/httpd/conf.d/passenger.conf文件错误
      httpd启动失败，我把那提示错误的四行注释掉以后可以启动了，可是页面显示不了。

      麻烦解惑啊，不甚感激！（刚刚接触这个不是太懂，能不能方便留个邮件什么的）

      LoadModule passenger_module modules/mod_passenger.so

      PassengerRoot /usr/share/rubygems/gems/passenger-3.0.17
      PassengerRuby /usr/bin/ruby
      PassengerHighPerformance on
      PassengerMaxPoolSize 12
      PassengerPoolIdleTime 1500
      PassengerStatThrottleRate 120
      RailsAutoDetect On

      ServerName puppet.jundeng.com
      DocumentRoot “/usr/share/puppet-dashboard/public/”
      #<Directory “/usr/share/puppet-dashboard/public/”>
      Options None
      #AllowOverride AuthConfig
      #Order allow,deny
      #allow from all

      ErrorLog /var/log/httpd/puppet.jundeng.com__error.log
      LogLevel warn
      CustomLog /var/log/httpd/puppet.jundeng.com_access.log combined
      ServerSignature On

      回复
      • sole says:
        2014 年 2 月 17 日 at 下午 1:26

        注视掉干嘛？不能注视，什么报错你贴报错出来。

        回复
        • 李洁 says:
          2014 年 4 月 9 日 at 上午 11:12

          passenger.conf具体内容如下：
          LoadModule passenger_module modules/mod_passenger.so

          PassengerRoot /usr/share/rubygems/gems/passenger-3.0.17
          PassengerRuby /usr/bin/ruby
          PassengerHighPerformance on
          PassengerMaxPoolSize 12
          PassengerPoolIdleTime 1500
          PassengerStatThrottleRate 120
          RailsAutoDetect On

          ServerName tool.temp
          DocumentRoot “/usr/share/puppet-dashboard/public/”

          Options None
          AllowOverride AuthConfig
          Order allow,deny
          allow from all

          ErrorLog /var/log/httpd/tool.temp__error.log
          LogLevel warna
          CustomLog /var/log/httpd/tool.temp_access.log combined
          ServerSignature On

          报错信息：Starting httpd: httpd: Syntax error on line 221 of /etc/httpd/conf/httpd.conf: Syntax error on line 13 of /etc/httpd/conf.d/passenger.conf: /etc/httpd/conf.d/passenger.conf:13: was not closed.

          回复
    4. Adams Dun says:
      2014 年 2 月 17 日 at 下午 1:42

      感谢楼主耐心解答，博文中配置Apache部分有一段代码被转意了，
      如果是直接粘贴，/etc/httpd/conf.d/passenger.conf文件会报错。
      在这里帮忙更正一下!

      Options None
      AllowOverride AuthConfig
      Order allow,deny
      allow from all

      回复
    5. Daniel says:
      2014 年 2 月 19 日 at 上午 9:13

      应该是下面这样的：

      #
      # Options None
      # AllowOverride AuthConfig
      # Order allow,deny
      # allow from all
      #

      回复
    6. 李洁 says:
      2014 年 4 月 8 日 at 下午 5:05

      我的web页面打开时Apache 2 Test Page 页面，我无法进入puppet管理页面

      回复
     

     Leave a Reply

     (required)

     (required)

     
     
    发表评论前，请滑动滚动条解锁
     

    You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>
  • 相关阅读:
    Hibernate的乐观锁与悲观锁 及应用
    用二进制进行权限管理(按位与 按位或 按位异或 运算 )
    最土团购开启Rewrite伪静态(地址重写|城市切换等)的方法以及规则文件 附：.htaccess
    Linux下获取详细硬件信息的工具：Dmidecode命令详解
    问题：cas单点注销后，再次登录不能返回原单点注销的系统问题。
    迎接十八大 google的搜索、邮箱等服务解决办法
    证书管理器工具 (Certmgr.exe)
    最土团购集成google map，marker跟随鼠标移动
    免费的网站速度测试平台
    java 正则表达式库
  • 原文地址：https://www.cnblogs.com/L-H-R-X-hehe/p/3957087.html
Copyright © 2011-2022 走看看