自动化运维工具puppet的安装和配置

简介
当手中有相当多的机器需要管理的时候，自动化处理冗余又无聊的任务对系统管理员来说就很重要了。很多管理员习惯了自己写脚本模拟复杂软件之间的调度。不幸的是，脚本会过时，脚本的作者会离职，如果不花费巨大精力来维护这些脚本的话，它们早晚会一点儿用也没有。如果能有一个系统，任何人都可以使用、安装工具，不论其受雇于何人，那真是太期待了。目前已有几种系统可以解决这类需求，puppet就是其中之一。

Puppet是一种Linux、Unix平台的集中配置管理系统，使用ruby语言，可管理配置文件、用户、cron任务、软件包、系统服务等。Puppet把这些系统实体称之为资源，Puppet的设计目标是简化对这些资源的管理以及妥善处理资源间的依赖关系。

puppet依赖于C/S（客户端/服务器）的部署架构。它需要在puppet服务器上安装puppet-server软件包（以下简称master），在需要管理的目标主机上安装puppet客户端软件（以下简称agent）
安装
由于 Puppet 不是 CentOS 或 RHEL 发行版的基本仓库，所以我们得手动添加 Puppet 实验室提供的自定义仓库。
rpm -ivh https://yum.puppetlabs.com/el/6.5/products/x86_64/puppetlabs-release-6-10.noarch.rpm
在服务端安装 puppet-server
[root@clone1_192.168.16.225 ~]# yum install puppet-server

安装完成后，设置 Puppet 服务器开机自动启动，然后启动它。
[root@clone1_192.168.16.225 ~]# chkconfig puppetmaster on
[root@clone1_192.168.16.225 ~]# service puppetmaster start
[root@clone1_192.168.16.225 ~]# netstat -tulnp |grep 8140
tcp 0 0 0.0.0.0:8140 0.0.0.0:* LISTEN 75638/ruby

修改服务端配置文件
[root@clone1_192.168.16.225 ~]# vim /etc/puppet/puppet.conf
[main]
#The Puppet log directory.
#The default value is ‘KaTeX parse error: Expected 'EOF', got '#' at position 46: …/puppet　　　　　　　　#̲##默认存放日志路径 #Whe…vardir/run’.
rundir = /var/run/puppet　　　　　　　　###pid存放路径

#Where SSL certificates are kept.
#The default value is ‘$confdir/ssl’.
ssldir = KaTeX parse error: Expected 'EOF', got '#' at position 22: …/ssl　　　　　　　　　　 #̲##证书存放目录，vardir为/var/lib/puppet

[agent]
#The file in which puppetd stores a list of the classes
#associated with the retrieved configuratiion. Can be loaded in
#the separate puppet executable using the --loadclasses
#option.
#The default value is ‘$confdir/classes.txt’.
classfile = $vardir/classes.txt

#Where puppetd caches the local configuration. An
#extension indicating the cache format is added automatically.
#The default value is ‘$confdir/localconfig’.
localconfig = $vardir/localconfig

certname = puppet-master.nlf.com #设置agent端certname名称
　　server = puppet-master.nlf.com ###设置agent认证连接master端的服务器名称，此名称必须得能够解析
[master]
certname = puppet-master.nlf.com ###设置puppetmaster认证服务器名称

在客户端节点安装 Puppet 客户端
[root@sgfs_read_s001a_192.168.16.227 yum.repos.d]# yum install puppet

安装完成后，确保 Puppet 会随开机自动启动
chkconfig puppet on
[root@sgfs_read_s001a_192.168.16.227 ~]# /etc/init.d/puppet start
[root@sgfs_read_s001a_192.168.16.227 ~]# ps aux |grep puppet
root 80968 0.1 2.1 145296 45080 ? Ss 15:22 0:03 /usr/bin/ruby /usr/bin/puppet agent
[root@sgfs_read_s001a_192.168.16.227 ~]# cat /etc/puppet/puppet.conf
[main]
#The Puppet log directory.
#The default value is ‘$vardir/log’.
logdir = /var/log/puppet

#Where Puppet PID files are kept.
#The default value is ‘$vardir/run’.
rundir = /var/run/puppet

#Where SSL certificates are kept.
#The default value is ‘$confdir/ssl’.
ssldir = $vardir/ssl

[agent]
#The file in which puppetd stores a list of the classes
#associated with the retrieved configuratiion. Can be loaded in
#the separate puppet executable using the --loadclasses
#option.
#The default value is ‘$confdir/classes.txt’.
classfile = $vardir/classes.txt

#Where puppetd caches the local configuration. An
#extension indicating the cache format is added automatically.
#The default value is ‘$confdir/localconfig’.
localconfig = $vardir/localconfig
certname = puppet-agent1.nlf.com ###设置本机的certname名称
server = puppet-master.nlf.com 　　　　###指向puppetmaster进行身份验证

添加hosts记录
vim /etc/hosts
192.168.16.225 puppet-master.nlf.com
192.168.16.226 puppet-agent1.nlf.com
192.168.16.227 puppet-agent2.nlf.com

Agent端向Master验证
[root@sgfs_read_s001a_192.168.16.226 log]# puppet agent --test
Exiting; no certificate found and waitforcert is disabled

解决办法：

删除已有证书：

[root@sgfs_read_s001a_192.168.16.226 puppet]# cd /var/lib/puppet/
[root@sgfs_read_s001a_192.168.16.226 puppet]#rm -rf /var/lib/puppet/

[root@sgfs_read_s001a_192.168.16.226 puppet]# puppet agent --test
Info: Creating a new SSL key for puppet-agent1.nlf.com
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for puppet-agent1.nlf.com
Info: Certificate Request fingerprint (SHA256): CC:AC:2E:C9:0F:60:45:B4:0A:67:76:7C:AF:64:93:2C:88:71:A5:73:3F:5E:96:B6:5C:66:C9:73:C4:C2:27:FB
Info: Caching certificate for ca
Exiting; no certificate found and waitforcert is disabled

可以看到首次验证是没有通过，需要Master端进行身份验证

Master端查看请求验证

在puppet-master通过puppet-agent1的请求验证，查看puppet-master需要验证的客户端

[root@clone1_192.168.16.225 ~]# puppet cert --list --all #没有带“+”说明没有进行身份验证 也可以用 puppet cert --sign --list
“puppet-agent1.nlf.com” (SHA256) CC:AC:2E:C9:0F:60:45:B4:0A:67:76:7C:AF:64:93:2C:88:71:A5:73:3F:5E:96:B6:5C:66:C9:73:C4:C2:27:FB
“puppet-agent2.nlf.com” (SHA256) 70:4F:C7:43:76:C8:EE:F7:49:AB:20:96:F3:AF:4F:F2:BF:B3:FF:D9:A6:D7:AA:D0:73:78:F7:5C:47:25:CC:26

• “clone1” (SHA256) 10:E9:54:9E:13:A8:22:C8:18:6A:B4:30:57:61:E3:DC:6A:9A:7C:A7:1C:DA:E8:DD:D0:8C:F5:59:33:5E:2B:A3

Master通过客户端的验证
[root@master ~]# puppet cert --sign --all #注册所有请求的节点
[root@master ~]# puppet cert --list --all #查看所有节点认证

[root@clone1_192.168.16.225 ~]# puppet cert --list --all

• “clone1” (SHA256) DC:5E:5D:9D:C7:3F:CD:F7:21:19:A6:B7:D7:AF:14:62:5D:E2:1B:33:02:70:27:96:C7:D2:84:A3:90:8A:FD:C3
• “puppet-agent1.nlfcert.com” (SHA256) 0E:B6:7F:46:B6:9B:B9:65:D5:6D:18:65:10:B6:AE:53:24:8C:82:DD:7F:31:60:DF:4D:1C:F5:DD:51:59:65:8C
• “puppet-agent2.nlf.com” (SHA256) 7C:7C:B3:C2:D9:AD:E3:C5:23:78:A4:4F:0B:3F:78:C0:44:82:46:0A:24:AC:3D:B5:D0:47:EA:8B:D5:0D:6C:C2
• “puppet-master.nlf.com” (SHA256) 43:43:36:52:E0:88:3C:FE:91:FB:CE:40:A1:84:3C:F6:72:B9:41:6B:D2:55:75:9F:D8:A8:1B:24:8A:4C:B4:B4

也可以通过目录查看已注册的客户端
[root@clone1_192.168.16.225 ~]# ll /var/lib/puppet/ssl/ca/signed/
total 16
-rw-r–r-- 1 puppet puppet 1927 Jan 17 15:01 clone1.pem
-rw-r–r-- 1 puppet puppet 1956 Jan 17 15:16 puppet-agent1.nlfcert.com.pem
-rw-r–r-- 1 puppet puppet 1948 Jan 17 15:16 puppet-agent2.nlf.com.pem
-rw-r–r-- 1 puppet puppet 1948 Jan 17 15:07 puppet-master.nlf.com.pem

[root@sgfs_read_s001a_192.168.16.226 ~]# puppet agent --test
Info: Caching certificate for puppet-agent1.nlfcert.com
Info: Caching certificate_revocation_list for ca
Info: Caching certificate for puppet-agent1.nlfcert.com
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: undefined method `include?’ for nil:NilClass
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for puppet-agent1.nlfcert.com
Info: Applying configuration version ‘1547709419’
Info: Creating state file /var/lib/puppet/state/state.yaml
Notice: Finished catalog run in 0.11 seconds

解决方法如下：
清除Master和客户端的SSl证书：
Master：puppet cert --clean --all
Client：rm -rf /var/lib/puppet/ssl/
重启解决。

[root@sgfs_read_s001a_192.168.16.227 ~]# puppet agent --test
Info: Caching certificate for puppet-agent2.nlf.com
Info: Caching certificate_revocation_list for ca
Info: Caching certificate for puppet-agent2.nlf.com
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for puppet-agent2.nlf.com
Info: Applying configuration version ‘1547709796’
Notice: Finished catalog run in 0.04 seconds

测试

在服务端写个例子测试一下。这个例子作用很简单，用来在客户端的/tmp目录下新建一个 test.txt 文件，内容为：this is a test！在服务端编写代码：【服务器端不需要新建这个文件】
vim /etc/puppet/manifests/site.pp
node default {

file {"/tmp/test.txt":
content => “this is a test!”;}

同时site.pp文件创建完毕后，我们要先重启下master端，如下：
[root@clone1_192.168.16.225 manifests]# /etc/init.d/puppetmaster restart

在客户端执行更新命令
[root@sgfs_read_s001a_192.168.16.226 ~]# puppet agent --test
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for puppet-agent1.nlfcert.com
Info: Applying configuration version ‘1547713330’
Notice: Finished catalog run in 0.04 seconds

[root@sgfs_read_s001a_192.168.16.226 ~]# cat /tmp/test.txt
this is a test!

我们可以看到agent端确实已经同步到master端的资源。/tmp目录下确实有test.txt这个文件，而且内容也确实和master端的一样。

到此有关puppet的搭建与配置介绍完毕。