zoukankan      html  css  js  c++  java

  • Puppet 安装配置




    环境说明：

    OS:CentOS 5.4 i386
    puppetmaster    192.168.0.12    hostname: puppetmaster.info.com
    client        192.168.0.64    hostname: client1.info.com


    原理图：




    1)         客户端通过facter收集客户端信息并发送至服务端
    2)         连接服务端并请求catalog日志
    3)         请求节点（node）的信息
    4)         从服务器端接收节点（node)的实例
    5)         编译代码（包括语法检查等工作）
    6)         查询是否有exported 虚拟资源
    7)         如有，则从数据库接收虚拟资源
    8)         接收完整的catalog日志
    9)         存储catalog日志到数据库
    10)       客户端接收完整的catalog日志


    一、 时间同步,并写入crontab

    点击(此处)折叠或打开

    1. 15 1 * * * /usr/sbin/ntpdate pool.ntp.org; hwclock -w >/dev/null 2>&1

    二、 修改主机名,并写入/etc/hosts文件

    Puppet 要求所有机器有完整的域名（FQDN），如果没有 DNS 服务器提供域名的话，可以在两台机器上设置主机名
    （注意建议先设置主机名再安装 Puppet，因安装 Puppet 时会把主机名写入证书，客户端和服务端通信需要这个证书）

    点击(此处)折叠或打开

    1. 192.168.0.12 puppetmaster.info.com
    2. 192.168.0.64 client1.info.com


    三、 安装ruby

    点击(此处)折叠或打开

    1. [root@puppetmaster ~]# yum install ruby ruby-libs ruby-rdoc -y


    4. [root@puppetmaster ~]# ruby --version
    5. ruby 1.8.5 (2006-08-25) [i386-linux]
    我安装的是1.8.5 ，不要安装1.8.7 puppet 还不支持，( 我没试过，如果出现不支持的情况，注意一下这里。)

    四、 安装facter

    安装puppet之前必须先安装facter
    facter是一个系统盘点工具，收集主的一些资料，比如CPU，主机IP等，它收集到值发送给puppet服务器端,服务器端就可以根据不同的条件来对不同的节点机器生成不同的puppet配置文件


    puppet资源下载点 http://downloads.puppetlabs.com/

    点击(此处)折叠或打开

    1. [root@puppetmaster src]# wget http://downloads.puppetlabs.com/facter/facter-1.6.8.tar.gz
    2. [root@puppetmaster src]# tar xzvf facter-1.6.8.tar.gz
    3. [root@puppetmaster src]# cd facter-1.6.8
    4. [root@puppetmaster facter-1.6.8]# ruby install.rb
    5. [root@puppetmaster puppet-2.7.14]# ruby install.rb


    五、 安装puppet

    点击(此处)折叠或打开

    1. [root@puppetmaster src]# wget http://downloads.puppetlabs.com/puppet/puppet-2.7.14.tar.gz
    2. [root@puppetmaster src]# tar xzvf puppet-2.7.14.tar.gz
    3. [root@puppetmaster src]# cd puppet-2.7.14


    六、 复制配置文件

    点击(此处)折叠或打开

    1. [root@puppetmaster puppet-2.7.14]# cp conf/redhat/fileserver.conf /etc/puppet/
    2. [root@puppetmaster puppet-2.7.14]# cp conf/redhat/puppet.conf /etc/puppet/
    3. [root@puppetmaster puppet-2.7.14]# cp conf/redhat/server.init /etc/init.d/puppetmaster


    七、 设置puppetmaster 服务开机启动

    点击(此处)折叠或打开

    1. [root@puppetmaster puppet-2.7.14]# ls -l /etc/init.d/puppetmaster
    2. -rwxr-xr-x 1 root root 3936 Sep 3 12:13 /etc/init.d/puppetmaster
    3. [root@puppetmaster puppet-2.7.14]#
    4. [root@puppetmaster puppet-2.7.14]# chkconfig --add puppetmaster
    5. [root@puppetmaster puppet-2.7.14]# chkconfig --level 35 puppetmaster on

    八、 创建puppet帐号

    点击(此处)折叠或打开

    1. [root@puppetmaster puppet-2.7.14]# puppetmasterd --mkusers


    1）确认是否生成清单文件夹

    点击(此处)折叠或打开

    1. [root@puppetmaster puppet-2.7.14]# ls -l /etc/puppet/
    2. total 16
    3. -rw-r--r-- 1 root root 2552 Sep 3 12:11 auth.conf
    4. -rwxr-xr-x 1 root root 381 Sep 3 12:13 fileserver.conf
    5. drwxr-xr-x 2 root root 4096 Sep 3 12:17 manifests
    6. -rwxr-xr-x 1 root root 853 Sep 3 12:13 puppet.conf

    2）确认系统生成puppet用户

    点击(此处)折叠或打开

    1. [root@puppetmaster puppet-2.7.14]# id puppet
    2. uid=1002(puppet) gid=1002(puppet) groups=1002(puppet)

    4. [root@puppetmaster puppet]# cat /etc/passwd |grep puppet
    5. puppet:x:1002:1002::/home/puppet:/bin/bash


    3）保证/var/lib/puppet/rrd目录存在且属主是puppet

    点击(此处)折叠或打开

    1. [root@puppetmaster puppet]# ls -l /var/lib/puppet/
    2. total 36
    3. drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 bucket
    4. drwxr-xr-x 2 root root 4096 Sep 3 12:17 facts
    5. drwxr-xr-x 2 root root 4096 Sep 3 12:17 lib
    6. drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 reports
    7. drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 rrd
    8. drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 server_data
    9. drwxrwx--x 8 puppet root 4096 Sep 3 12:26 ssl
    10. drwxr-xr-t 2 root root 4096 Sep 3 12:17 state
    11. drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 yaml

    4）查看端口

    点击(此处)折叠或打开

    1. [root@puppetmaster puppet]# netstat -Tanlp | grep 8140
    2. tcp 0 0 0.0.0.0:8140 0.0.0.0:* LISTEN 4556/ruby


    客户端：

    安装facter,puppet 同puppetmaster 一样。但复制的文件如下

    点击(此处)折叠或打开

    1. [root@client1 puppet-2.7.14]# cp conf/redhat/client.init /etc/init.d/puppet
    2. [root@client1 puppet-2.7.14]# chkconfig --level 35 puppet on


    点击(此处)折叠或打开

    1. [root@client1 puppet-2.7.14]# puppetd --mkusers
    2. Could not prepare for execution: Got 1 failure(s) while initializing: change from absent to present failed: Could not create user puppet: Execution of '/usr/sbin/useradd -g puppet -M puppet' returned 3: useradd: invalid numeric argument 'puppet'

    4. [root@client1 puppet-2.7.14]# groupadd puppet;useradd -g puppet -M puppet
    5. [root@client1 puppet-2.7.14]# service puppet start
    6. Starting puppet: [ OK ]



    测试解析与puppetmaster端口是否畅通

    点击(此处)折叠或打开

    1. [root@client1 puppet-2.7.14]# telnet puppetmaster.info.com 8140
    2. Trying 192.168.0.12...
    3. Connected to puppetmaster.info.com (192.168.0.12).
    4. Escape character is '^]'.

    6. [root@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com
    7. warning: peer certificate won't be verified in this SSL session
    8. info: Caching certificate for ca
    9. warning: peer certificate won't be verified in this SSL session
    10. warning: peer certificate won't be verified in this SSL session
    11. info: Creating a new SSL certificate request for client1.info.com
    12. info: Certificate Request fingerprint (md5): 07:C9:D4:43:3C:3E:D6:D1:0A:B1:8B:71:DB:6B:9D:FE
    13. warning: peer certificate won't be verified in this SSL session
    14. warning: peer certificate won't be verified in this SSL session
    15. warning: peer certificate won't be verified in this SSL session
    16. Exiting; no certificate found and waitforcert is disabled
    # puppetd --test --server puppetmaster.info.com命令是指puppetd 从 puppetmaster.info.com去读取
    puppet配置文件. 第一次连接,双方会进行ssl证书的验证,这是一个新的客户端,在服务器端那里还没有被认证,因此需要在服务器端进行证书认证



    以下这步批准证书是在服务端操作

    查看当前待批准证书列表

    点击(此处)折叠或打开

    1. [root@puppetmaster ~]# puppetca -l
    2.   client1.info.com (07:C9:D4:43:3C:3E:D6:D1:0A:B1:8B:71:DB:6B:9D:FE)



    批准当前证书

    点击(此处)折叠或打开

    1. [root@puppetmaster ~]# puppetca -s client1.info.com
    2. notice: Signed certificate request for client1.info.com
    3. notice: Removing file Puppet::SSL::CertificateRequest client1.info.com at '/var/lib/puppet/ssl/ca/requests/client1.info.com.pem'


    查看验证签名,注意前面的+号，说明已经签名

    点击(此处)折叠或打开

    1. [root@puppetmaster ~]# puppetca -a --list
    2. + client1.info.com (03:BE:50:AE:72:1A:39:79:17:F4:E5:74:FD:CC:BC:8C)
    3. + puppetmaster.info.com (97:34:BF:26:A6:0E:E9:9C:DB:76:D3:53:D0:56:60:83) (alt names: DNS:puppet, DNS:puppet.info.com, DNS:puppetmaster.info.com)


    如果要批准全部证书

    点击(此处)折叠或打开

    1. puppetca -s -a
    2. 也可以在puppetmaster端的puppet.conf加入这行：
    3. autosign = true
    4. 服务端就自动签证书

    回到客户端操作，从服务端取回已批准的证书

    点击(此处)折叠或打开

    1. [root@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com
    2. warning: peer certificate won't be verified in this SSL session
    3. info: Caching certificate for client1.info.com
    4. info: Caching certificate_revocation_list for ca
    5. info: Caching catalog for client1.info.com
    6. info: Applying configuration version '1378188531


    验证证书是否正确

    点击(此处)折叠或打开

    1. 服务端:
    2. [root@puppetmaster ~]# md5sum /var/lib/puppet/ssl/ca/signed/client1.info.com.pem
    3. 27a295f39a6b4a6c7ceb74c9c3a5084c /var/lib/puppet/ssl/ca/signed/client1.info.com.pem

    5. 客户端:
    6. [root@client1 puppet-2.7.14]# md5sum /etc/puppet/ssl/certs/client1.info.com.pem
    7. 27a295f39a6b4a6c7ceb74c9c3a5084c /etc/puppet/ssl/certs/client1.info.com.pem


    10. 出现修改主机名问题引起无法认证，需要重新申请证书，操作以下两个步骤：
    11. 服务端：
    12. [root@puppetmaster ~]# rm /var/lib/puppet/ssl/ca/signed/client1.info.com.pem -rf

    14. 客户端：
    15. [root@client1 puppet-2.7.14]# rm /etc/puppet/ssl/certs/ -rf


    功能测试

    服务端：
    建立pp文件测试
    puppet的第一个执行的代码是在/etc/puppet/manifest/site.pp ,因此这个文件必须存在,而且其他的代码也要通过代码来调用.

    点击(此处)折叠或打开

    1. [root@puppetmaster ~]# vim /etc/puppet/manifests/site.pp
    2. node default {
    3. file {"/tmp/viong.txt":
    4. content=>"good,test pass! Hello World! ";}
    5.     }

    上面的代码对默认连入的puppet客户端执行一个操作,在/tmp目录生成一个viong.txt文件,内容是good,test pass! 回车换行Hello World!回车换行.

    初次创建pp文件，需要重启puppetmaster

    点击(此处)折叠或打开

    1. [root@puppetmaster ~]# service puppetmaster restart
    2. Stopping puppetmaster: [ OK ]
    3. Starting puppetmaster: [ OK ]

    客户端：

    点击(此处)折叠或打开

    1. [root@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com
    2. info: Caching catalog for client1.info.com
    3. info: Applying configuration version '1378190404'
    4. notice: /Stage[main]//Node[default]/File[/tmp/viong.txt]/ensure: defined content as '{md5}4750aa5be82dae5db286a5859700dd51'
    5. notice: Finished catalog run in 0.03 seconds


    8. 如果报错
    9. [root@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com
    10. err: Could not retrieve catalog from remote server: Error 400 on SERVER: Could not parse for environment production: Syntax error at end of file; expected '}' at /etc/puppet/manifests/site.pp:4 on node client1.info.com
    11. warning: Not using cache on failed catalog
    12. err: Could not retrieve catalog; skipping run

    14. 可能是/etc/puppet/manifests/site.pp 这个文件书写格式有问题。


    在客户端查看:

    点击(此处)折叠或打开

    1. [root@client1 puppet-2.7.14]# ls -l /tmp/viong.txt
    2. -rw-r--r-- 1 root root 29 Sep 3 14:50 /tmp/viong.txt
    3. [root@client1 puppet-2.7.14]# cat /tmp/viong.txt
    4. good,test pass!
      Hello World!







  • 相关阅读:
    codeforces 616B Dinner with Emma
    codeforces 616A Comparing Two Long Integers
    codeforces 615C Running Track
    codeforces 612C Replace To Make Regular Bracket Sequence
    codeforces 612B HDD is Outdated Technology
    重写父类中的成员属性
    子类继承父类
    访问修饰符
    方法的参数
    实例化类
  • 原文地址：https://www.cnblogs.com/xialiaoliao0911/p/7523979.html
Copyright © 2011-2022 走看看