PUPPET集中化管理学习
puppetmaster 主机名puppet.zhouml.comslave1主机名 slave.puppet1.com
slave2主机名 logserver-SW
安装服务器端（master）
rpm -ivh epel-release-5-4.noarch.rpm
yum install -y puppet puppet-server facter
服务器端hosts
# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1puppet.zhouml.com puppet
::1localhost6.localdomain6 localhost6
192.168.188.132slave.puppet2.com
192.168.188.135slave.puppet1.com
puppet 服务器端目录树
|-- auth.conf
|-- fileserver.conf
|-- manifests
||-- nodes
|||-- 1.pp
||`-- 2.pp
||-- nodes.pp
||-- site.pp
||-- site.pp.back
||-- site.pp.new
|`-- zhouml.pp
|-- modules
||-- mediaserver
|||-- files
|||`-- home
|||`-- mediaserver
|||-- manifests
|||`-- init.pp
||`-- templates
||-- sudo
|||-- files
|||`-- etc
|||`-- sudoers
|||-- manifests
|||`-- init.pp
||`-- templates
||-- svn
||`-- templates
|`-- system
||-- files
||`-- puppet.conf
||-- manifests
|||-- init.pp
||`-- puppet_client.pp
|`-- templates
`-- puppet.conf
服务器端/etc/puppet/puppet.conf 配置文件
# The Puppet log directory.
# The default value is '$vardir/log'.
logdir = /var/log/puppet
# Where Puppet PID files are kept.
# The default value is '$vardir/run'.
rundir = /var/run/puppet
# Where SSL certificates are kept.
# The default value is '$confdir/ssl'.
ssldir = $vardir/ssl
# The file in which puppetd stores a list of the>
# associated with the retrieved configuratiion.Can be loaded in
# the separate ``puppet`` executable using the ``--loadclasses``
# option.
# The default value is '$confdir/classes.txt'.
classfile = $vardir/classes.txt
# Where puppetd caches the local configuration.An
# extension indicating the cache format is added automatically.
# The default value is '$confdir/localconfig'.
localconfig = $vardir/localconfig
certname=puppet.zhouml.com
server=puppet.zhouml.com
推送mediaserver为例子
入口文件site.pp
import 'nodes/1.pp'
include mediaserver
$puppetserver = 'puppet.zhouml.com'
注：此处'nodes/1.pp' 可支持通配符'nodes/*.pp'
节点定义
nodes下的1.pp
node 'slave.puppet1.com' {
}
2.pp
node 'logserver-SW' {
}
模块定义
|-- mediaserver
||-- files
||`-- home
||`-- mediaserver
||-- manifests
||`-- init.pp
|`-- templates
|-- sudo
||-- files
||`-- etc
||`-- sudoers
||-- manifests
||`-- init.pp
|`-- templates
|-- svn
|`-- templates
`-- system
|-- files
|`-- puppet.conf
|-- manifests
||-- init.pp
|`-- puppet_client.pp
`-- templates
mediaserver 模块
init.pp
class mediaserver {
#package { mediaserver:
#ensure => present,
#}
file { "/home/mediaserver":
owner => "root",
group => "root",
mode => 755,
source => "puppet://$puppetserver/modules/mediaserver/home/mediaserver",
#require => Package["mediaserver"],
}
}
file文件夹下
`-- home
`-- mediaserver
安装客户端（slave）
rpm -ivh epel-release-5-4.noarch.rpm
yum install -y puppet facter
客户端hosts
# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1slave.puppet1.comlocalhost.localdomain localhost
::1localhost6.localdomain6 localhost6
192.168.188.142 puppet.zhouml.com
puppet目录树结构
|-- auth.conf
|-- namespaceauth.conf
|-- puppet.conf
`-- ssl
|-- certificate_requests
|-- certs
||-- ca.pem
|`-- slave.puppet1.com.pem
|-- private
|-- private_keys
|`-- slave.puppet1.com.pem
`-- public_keys
`-- slave.puppet1.com.pem
规则文件auth.conf
path ~ ^/catalog/([^/]+)$
method find
allow $1
path /certificate_revocation_list/ca
method find
allow *
path /report
method save
allow *
path /file
allow *
path /certificate/ca
auth no
method find
allow *
path /certificate/
auth no
method find
allow *
path /certificate_request
auth no
method find, save
allow *
path /
auth any
allow *
namespaceauth.conf
# This is an example namespaceauth.conf file,
# which you'll need if you want to start a client
# in --listen mode.
allow *.domain.com
allow *.zhouml.com
allow puppet.zhouml.com
allow *.domain.com
allow *.domain.com
allow server.domain.com
客户端puppet.conf
# The Puppet log directory.
# The default value is '$vardir/log'.
logdir = /var/log/puppet
# Where Puppet PID files are kept.
# The default value is '$vardir/run'.
rundir = /var/run/puppet
# Where SSL certificates are kept.
# The default value is '$confdir/ssl'.
ssldir = $vardir/ssl
# The file in which puppetd stores a list of the>
# associated with the retrieved configuratiion.Can be loaded in
# the separate ``puppet`` executable using the ``--loadclasses``
# option.
# The default value is '$confdir/classes.txt'.
classfile = $vardir/classes.txt
# Where puppetd caches the local configuration.An
# extension indicating the cache format is added automatically.
# The default value is '$confdir/localconfig'.
localconfig = $vardir/localconfig
listen=true
/etc/sysconfig/puppet文件
# The puppetmaster server
PUPPET_SERVER=puppet.zhouml.com
# If you wish to specify the port to connect to do so here
#PUPPET_PORT=8140
# Where to log to. Specify syslog to send log messages to the system log.
#PUPPET_LOG=/var/log/puppet/puppet.log
# You may specify other parameters to the puppet client here
#PUPPET_EXTRA_OPTS=--waitforcert=500
PUPPET客户端测试命令
puppetd --server=puppet.zhouml.com --no-daemonize --verbose
puppet服务器端推送命令
puppetrun slave.puppet1.com
puppetca --list 查询请求主机
puppetca -s -a 允许所有请求主机申请
puppetca -l -a 查询已合法主机列表
puppet + nginx
在/etc/sysconfig/puppetmaster 末尾添加2行 开启多端口支持
PUPPETMASTER_PORTS=( 18141 18142 18143 18144 )
PUPPETMASTER_EXTRA_OPTS="--servertype=mongrel --ssl_client_header=HTTP_X_SSL_SUBJECT"
nginx配置
wget -c http://nginx.org/download/nginx-1.2.4.tar.gz
tar xzf nginx-1.2.4.tgz && cd nginx-1.2.4 &&./configure --prefix=/usr/local/nginx --with-http_ssl_module &&make &&make install
nginx配置文件
/usr/local/nginx/conf/nginx.conf
userdaemon daemon;
worker_processes4;
worker_rlimit_nofile 65535;
error_log/var/log/nginx-puppet.log notice;
pid/var/run/nginx-puppet.pid;
events {
useepoll;
worker_connections32768;
}
http {
sendfileon;
tcp_nopushon;
keepalive_timeout300;
tcp_nodelayon;
upstream puppetmaster {
server 127.0.0.1:18140;
server 127.0.0.1:18141;
server 127.0.0.1:18142;
server 127.0.0.1:18143;
}
server {
listen 8140;
root/etc/puppet;
sslon;
ssl_session_timeout5m;
ssl_certificate/var/lib/puppet/ssl/certs/puppet.zhouml.com.pem;
ssl_certificate_key/var/lib/puppet/ssl/private_keys/puppet.zhouml.com.pem;
ssl_client_certificate/var/lib/puppet/ssl/ca/ca_crt.pem;
ssl_crl/var/lib/puppet/ssl/ca/ca_crl.pem;
ssl_verify_clientoptional;
# File sections
location /production/file_content/files/ {
types { }
default_type application/x-raw;
alias /etc/puppet/manifests/files/;
}
# Modules files sections
location ~ /production/file_content/modules/.+/ {
root /etc/puppet/modules;
types { }
default_type application/x-raw;
rewrite ^/production/file_content/modules/([^/]+)/(.+)$ /$1/files/$2 break;
}
# Ask the puppetmaster for everything else
location / {
proxy_passhttp://puppetmaster;
proxy_redirectoff;
proxy_set_headerHost$host;
proxy_set_headerX-Real-IP$remote_addr;
proxy_set_headerX-Forwarded-For$proxy_add_x_forwarded_for;
proxy_set_headerX-Client-Verify$ssl_client_verify;
proxy_set_headerX-SSL-Subject$ssl_client_s_dn;
proxy_set_headerX-SSL-Issuer$ssl_client_i_dn;
proxy_buffer_size16k;
proxy_buffers8 32k;
proxy_busy_buffers_size64k;
proxy_temp_file_write_size64k;
proxy_read_timeout65;
}
}#server end
}#http end
PUPPET-DASHBOARD
升级ruby到1.8.7
tar -zxvf ruby-1.8.7.tar.gz
./configure
make -j5 && make install
在/etc/profile中加入环境变量
export PATH=/usr/local/ruby/bin/:$PATH
yum install -y mysql mysql-devel mysql-server ruby ruby-devel ruby-irb ruby-mysql ruby-rdoc ruby-ri
安装rubygems
tar -zxvf rubygems-1.3.5.tgz
cd rubygems-1.3.5
ruby setup.rb
gem uninstall rake -v=10.0.3 删除高版本
gem install rake -v=0.8.7
rake -V 版本
# vi /usr/share/puppet-dashboard/Rakefile +10
# Add your own tasks in files placed in lib/tasks ending in .rake,
# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
require(File.join(File.dirname(__FILE__), 'config', 'boot'))
require 'thread'
require 'rake'
require 'rake/testtask'
#require 'rake/rdoctask'
require 'rdoc/task'
require 'tasks/rails'
gem install rdoc
rpm -ivh puppet-dashboard-1.1.1-1.noarch.rpm
安装在/usr/share/puppet-dashboard下
config 下的cp database.yml.example database.yml
development:
database: dashboard
username: dashboard
password:
encoding: utf8
adapter: mysql
重启mysqld puppetmaster
在/usr/share/puppet-dashboard下
rake RAILS_ENV=production db:create
rake RAILS_ENV=production db:create && rake db:migrate
解决 Access denied for user ''@'localhost' to database 'mysql'
/usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock --pid-file=/var/run/mysqld/mysqld.pid --basedir=/usr --user=mysql
启动 ./script/server -p 3000 -d
/etc/init.d/puppet-dashboard启动脚本
#!/bin/bash
#
# Init script for puppet-dashboard
#
# chkconfig: - 85 15
# description: Init script for puppet-dashboard
# Source function library.
. /etc/rc.d/init.d/functions
if [ -f /etc/sysconfig/puppet-dashboard ]; then
. /etc/sysconfig/puppet-dashboard
fi
DASHBOARD_HOME=${DASHBOARD_HOME:-/usr/share/puppet-dashboard}
DASHBOARD_USER=${DASHBOARD_USER:-puppet-dashboard}
DASHBOARD_RUBY=${DASHBOARD_RUBY:-/usr/bin/ruby}
DASHBOARD_ENVIRONMENT=${DASHBOARD_ENVIRONMENT:-production}
DASHBOARD_IFACE=${DASHBOARD_IFACE:-0.0.0.0}
DASHBOARD_PORT=${DASHBOARD_PORT:-3000}
PIDFILE=/var/run/puppet-dashboard.pid
RETVAL=0
check_status() {
pidofproc -p ${PIDFILE} ${DASHBOARD_RUBY} > /dev/null
}
start() {
echo -n $"Starting Puppet Dashboard: "
# Don't start it twice.
check_status
RETVAL=$?
if [ $RETVAL = 0 ]; then
echo -n "Already running"
echo_success
echo
return 0
fi
# This is a dirty, dirty hack, but it's rather difficult to get
# script/server to daemonize in any way, and still give us useful
# debugging output (or a real exit code) if it fails to start.
# Also: We don't have>
su -s /bin/sh -c "${DASHBOARD_RUBY} ${DASHBOARD_HOME}/script/server -e ${DASHBOARD_ENVIRONMENT} -p ${DASHBOARD_PORT} -b ${DASHBOARD_IFACE}" ${DASHBOARD_USER} &
local PID=$!
echo $PID > ${PIDFILE}
sleep 5
check_status
RETVAL=$?
if [ $RETVAL = 0 ]; then
echo_success
else
echo_failure
fi
echo
return $RETVAL
}
stop() {
echo -n $"Stopping Puppet Dashboard: "
killproc -p ${PIDFILE} puppet-dashboard
RETVAL=$?
if [ $RETVAL = 0 ]; then
echo_success
else
echo_failure
fi
echo
return $RETVAL
}
# See how we were called.
case "$1" in
start)
start
exit $?
;;
stop)
stop
exit $?
;;
restart)
stop && start
exit $?
;;
status)
echo -n 'Puppet Dashboard is '
pidofproc -p ${PIDFILE} ${DASHBOARD_RUBY} > /dev/null
RETVAL=$?
if [ $RETVAL = 0 ]; then
echo 'running'
else
echo 'stopped'
fi
;;
*)
echo "Usage: $0 {start|stop|restart|status}"
exit 1
esac
exit $RETVAL
################导入现有报告##############
在/usr/share/puppet-dashboard目录下
rake RAILS_ENV=production reports:import
2.6版本后客户端打开
report = true
master上
reports = http
reporturl = http://dashboard.example.com:80/reports
http://dashboard.com可写IP地址
外部节点分类器
node_terminus = exec
external_nodes = /usr/share/puppet-dashboard/bin/external_node
puppet agent --configprint runinterval 检查客户端同步周期时间
Puppet在同步时遇到以下错误： 1 notice: Run of Puppet configuration client already in progress; skipping 删除puppetdlock重试解决： 1 rm /var/lib/puppet/state/puppetdlock
客户端修改 hostnamefirewallpuppetntprm -rf /var/lib/puppet/ssl
/sbin/iptables -A INPUT -p udp --dport 123 -j ACCEPT
转个puppet报错修复连接http://blog.chinaunix.net/uid-11915773-id-3059902.html
页:
[1]