Puppet实验一：安装puppet

安装puppet最方便的方式是使用EPEL软件源，因而在安装master和agent之前，请参考《配置EPEL软件源》添加EPEL软件源。

安装master

master环境：virtualbox虚拟机，操作系统为CentOS 6.2，机器名称为centos-server.s3lighting.com，IP地址为192.168.12.215。

1. 使用yum方式安装puppet-master包：

[root@centos-server ~]$ yum install puppet-server

安装完成后使用chkconfig可以发现多出了两个服务：puppetmaster和puppet。

2. 配置iptables防火墙。原来的防火墙策略如下：

[root@centos-server ~]$ iptables -L -n --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination  

按照下面的方式开启puppet的8140端口：

[root@centos-server ~]$ iptables -I INPUT 5 -p tcp -m tcp --dport 8140 -m state --state NEW -j ACCEPT

[root@centos-server ~]$ service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

[root@centos-server ~]$ service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules:                         [  OK  ]

 3. 启动puppetmaster服务：

[root@centos-server ~]$ chkconfig puppetmaster on
[root@centos-server ~]$ service puppetmaster start

安装agent

agent环境：virtualbox虚拟机，操作系统为CentOS 6.2，机器名称为centos-client.s3lighting.com，IP地址为192.168.12.54。

1. 使用yum方式安装puppet包：

[root@centos-client ~]$ yum install puppet

安装完成后使用chkconfig可以发现多出了一个服务：puppet。 

2. 配置puppet server：

[root@centos-client etc]# echo "server = centos-server.s3lighting.com" >> /etc/puppet/puppet.conf

3. 在/etc/hosts中添加服务器地址：

[root@centos-client etc]# echo "192.168.12.215 centos-server centos-server.s3lighting.com" >> /etc/hosts

服务器SSL认证

每一个agent都需要通过master认证以后，才能从master获取配置信息。

1. agent中发出请求：

[root@centos-client etc]# puppet agent --test
info: Creating a new SSL key for centos-client.s3lighting.com
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for ca
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
info: Creating a new SSL certificate request for centos-client.s3lighting.com
info: Certificate Request fingerprint (md5): 92:D8:57:A1:83:ED:F0:30:3C:08:98:6E:41:E7:1B:03
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
Exiting; no certificate found and waitforcert is disabled

2. master查询收到的认证请求：

[root@centos-server ~]$ puppet cert list
centos-client.s3lighting.com (92:D8:57:A1:83:ED:F0:30:3C:08:98:6E:41:E7:1B:03)

使用sign命令认证收到的请求：

[root@centos-server ~]$ puppet cert sign centos-client.s3lighting.com
notice: Signed certificate request for centos-client.s3lighting.com
notice: Removing file Puppet::SSL::CertificateRequest centos-client.s3lighting.com at '/var/lib/puppet/ssl/ca/requests/centos-client.s3lighting.com.pem'

3. agent再次发出请求命令：

[root@centos-client puppet]# puppet agent --test
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for centos-client.s3lighting.com
info: Caching certificate_revocation_list for ca
info: Caching catalog for centos-client.s3lighting.com
info: Applying configuration version '1343033559'
info: Creating state file /var/lib/puppet/state/state.yaml
notice: Finished catalog run in 0.01 seconds

OK，agent可以从master成功地获取配置信息了。

简单的测试

1. 在master创建文件/etc/puppet/manifests/site.pp，内容如下：

file {'testfile':
    path   => '/tmp/testfile',
    ensure => present,
    mode   => 0640,
    content=> "I'm a test file."
}

2. 在agent执行配置请求：

[root@centos-client ~]# puppet agent --test
info: Caching catalog for centos-client.s3lighting.com
info: Applying configuration version '1343091079'
notice: /Stage[main]//File[testfile]/ensure: created
notice: Finished catalog run in 0.02 seconds

可以看到testfile被创建了。

原文参考：http://docs.puppetlabs.com/guides/installation.html