puppet安装
开源版本的puppet和puppetlab的都安装过,相对来说puppetlabs的版本更新点,所以推荐安装puppetlabs的
准备
最重要的一步是设置hostname。我在这里的设置如下
需要注意hostname不要加下划线,master最好设置一个别名为puppet。同时也需要设置一个完整的域名（不设置其实也没关系，但是有可能会遇到其他问题。比如你的主机名为computer-1，在puppet证书里面可能会变成computer-1.localdomain）
安装
首先需要安装puppetlabs的一个包，下载地址如下https://apt.puppetlabs.com/。根据自己的版本下载安装。然后执行apt-get update，这个包的主要功能是添加了puppetlabs的源。
wget https://apt.puppetlabs.com/puppetlabs-release-trusty.deb dpkg -i puppetlabs-release-trusty.deb apt-get update
如果是master就安装puppetmaster，同时也会安装facter（通过facter可以获取系统的一些基本参数，作为变量传递给puppet使用，不如ipaddress、hostname）
如果是puppet agent则只要安装puppet就可以了。
由于以前安装过puppet，所以有点问题下列软件包有未满足的依赖关系：
puppet-common : 依赖: hiera (>= 1.0.0) 但是它将不会被安装
puppetmaster : 依赖: puppetmaster-common (= 3.6.2-1puppetlabs1) 但是 3.4.3-1 正要被安装
puppetmaster-common : 依赖: puppet-common (= 3.4.3-1) 但是 3.6.2-1puppetlabs1 正要被安装
E: 有未能满足的依赖关系。请尝试不指明软件包的名字来运行“apt-get -f install”(也可以指定一个解决办法)。apt-get -f install 来修复就可以了
root@master:~#apt-get install puppetmaster root@master:~# puppet --version 3.6.2
默认puppet agent不是开机启动的。需要修改下配置，我们也不需要让它以service的形式存在，所以也不需要修改。如果是实际的生产环境，那么puppet service需要开启。
测试
puppet master所在的/etc/puppet/manifests/下面新建一个文件名为site.pp
root@master:/etc/puppet/manifests# touch site.pp
puppet agent申请证书
root@client1:~# puppet agent -t Info: Creating a new SSL key for client1 Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for client1 Info: Certificate Request fingerprint (SHA256): 25:04:EF:53:28:C0:BA:46:A9:15:2C:D1:A9:27:8A:67:A1:86:F5:23:52:25:09:B0:D3:5C:1D:C3:DA:99:D8:0F
puppet master签证书
#查看证书 root@master:~# puppet cert list --all "client1" (SHA256) 25:04:EF:53:28:C0:BA:46:A9:15:2C:D1:A9:27:8A:67:A1:86:F5:23:52:25:09:B0:D3:5C:1D:C3:DA:99:D8:0F + "master" (SHA256) 4D:B5:F4:CC:3F:A9:80:00:DF:8A:84:22:86:30:C0:B3:CB:59:83:B5:ED:E5:D8:E1:E0:67:15:42:2E:24:A4:7E #签证 root@master:~# puppet cert sign --all
puppet agent验证
提示需要enable，照做就可以了。
root@client1:~# puppet agent -t Info: Creating a new SSL key for client1 Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for client1 Info: Certificate Request fingerprint (SHA256): 25:04:EF:53:28:C0:BA:46:A9:15:2C:D1:A9:27:8A:67:A1:86:F5:23:52:25:09:B0:D3:5C:1D:C3:DA:99:D8:0F Exiting; no certificate found and waitforcert is disabled
还是遇到了问题
root@client1:/etc/puppet# puppet agent -t Warning: Unable to fetch my node definition, but the agent run will continue: Warning: Server hostname 'puppet' did not match server certificate; expected master Info: Retrieving pluginfacts Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': Server hostname 'puppet' did not match server certificate; expected master Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet://puppet/pluginfacts: Server hostname 'puppet' did not match server certificate; expected master Wrapped exception: Server hostname 'puppet' did not match server certificate; expected master Info: Retrieving plugin Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': Server hostname 'puppet' did not match server certificate; expected master Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet://puppet/plugins: Server hostname 'puppet' did not match server certificate; expected master Wrapped exception: Server hostname 'puppet' did not match server certificate; expected master Error: Could not retrieve catalog from remote server: Server hostname 'puppet' did not match server certificate; expected master Warning: Not using cache on failed catalog Error: Could not retrieve catalog; skipping run Error: Could not send report: Server hostname 'puppet' did not match server certificate; expected master
主要的问题还是hostname设置的问题，证书上要求连接的主机名字是master，而默认puppet 连接的是名为puppet的主机。所以需要修改下。
执行
puppet agent -t --server master
是成功的。所以只要把默认的连接改为master就行了（当然最好的方法是hostname那里就设置好。）
编辑/etc/puppet/puppet.conf 在agent字段中添加
[agent] server = master
就可以了。
其他
puppet配置中经常需要不停的修改配置，很重要的一点是要删除证书。
在master端 执行 puppet cert clean xxx
而agent可以直接在/var/lib/puppet/ssl这个文件夹中存放的证书删除就可以了。