Puppet之基础
一、简介
1、puppet是什么？
开源的新一代集中化配置管理工具，它通过自己专有的“声明语言”来定义目标状态，并且通过C/S模式架构，达成目标。
puppet是一个IT基础设施自动化管理工具，它能够帮助系统管理员管理基础设施的整个生命周期：
供应（provisioning),配置（configuration)，联动（orchestration)及报告（reportiong).
基于puppet可以实现自动化重复任务，快速部署关键性应用以及在本地或云端完成主动管理变更和快速扩展架构规模等
Ruby语言研发
公司：Puppet labs ,主要作者：Luke Kanies
puppet： agent/master
master:
agent：默认每隔30分钟向master检索一次和自己相关的配置，
master和agent基于https的xmlrpc协议通信，验证是双向的：
master:证书，一般为自签，master可自行扮演CA的角色
agent:证书，生成csr发送给master(CA)
2、特性
完全面向对象：任何东西都是对象，没有基础类型
变量没有类型（动态类型）
任何东西都有值：不管是四则运算、逻辑表达式还是一个语句，都有回传值。
运算符重载
垃圾回收
强类型
变量无需声明
在Windows上，加载DLL
3、工作步骤
1）定义：使用puppet的声明语言定义基础配置信息
2）模拟：agent端从master拿到自己相关的配置之后先做测试性的应用于本地
3）强制：将配置应用于本机
4）报告：向master报告应用结果状态
4、Puppet的三层模型
| Configuration Language （配置语言层） |
| Transactional Layer （事务层） |
| Resource Abstraction Layer （资源抽象层） |
资源分为多种类型：例如用户、组、文件、程序包等；
属性及状态描述与实现方式分离：定义时只需描述属性，而无须关心实现方式
期望状态：present,absent等
5、puppet的核心术语
资源(resource)：
清单（manifest):资源定义的文件
资源清单：定义资源
站点清单：定义主机及其调用的模块
模块（module)：manifest及其内部所定义的资源依赖到的其它数据，例如文件和模版 等，按特定结构形成的目录结构
6、puppet的使用模型
agent:单机模式
agent/master:主从模式
puppet单机模式工作过程：
puppet主从模式工作过程：
二、puppet安装及配置
1、puppet安装
2005年发布第一个版本V0.2
第一个流行的版本：0.24.x-->0.25.x-->2.6.x-->2.7.x-->3.x
可以直接从yum安装（epel源）: #版本比较低
[root@localhost ~]# yum list|grep puppet puppet.noarch 2.7.26-2.el6 epel puppet-gluster.noarch 0.0.3-1.el6 epel puppet-gluster-doc.noarch 0.0.3-1.el6 epel puppet-server.noarch 2.7.26-2.el6 epel puppetlabs-stdlib.noarch 4.5.1-2.20150121git7a91f20.el6 rubygem-puppet-lint.noarch 1.1.0-1.el6 epel rubygem-puppet-lint-doc.noarch 1.1.0-1.el6 epel
puppet官方配备了详细的yum源，依赖包也很全，可以访问http://yum.puppetlabs.com/下载系统对应的yum包puppetlabs-release-el，通过yum命令安装即可获得对应的repo。由于官方源默认安装的是最新版本的puppet版本，而最新版本由于其不稳定性并不是我们想要的，那么如何指定版本进行安装呢 请看这里http://kisspuppet.com/2014/01/26/puppet_create_repo/，如果你比较懒，不想自己做yum源，那就去下载KissPuppet准备的yum源吧，更全，更强大http://kisspuppet.com/2013/12/05/puppet_repo_pak/
这里给点建议：官方yum源已经做的很到位了，如果条件允许，尽量通过rpm包安装而不是源码安装，至于原因自己想去。
通过puppet管理资源是需要写模块呢，有些人并不喜欢写模块，可以去http://forge.puppetlabs.com/下载你需要的模块，如何下载安装呢，请点击这里http://kisspuppet.com/2014/01/14/puppet_forge_modules/
日常学习当中，如何去查找puppet相关资料或者询问呢，这里教你9种方法去获取http://kisspuppet.com/2014/02/10/puppet_irc/
[root@localhost ~]# rpm -ivh http://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm Retrieving http://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm warning: /var/tmp/rpm-tmp.zLaUwM: Header V4 RSA/SHA1 Signature, key ID 4bd6ec30: NOKEY Preparing... ########################################### [100%] 1:puppetlabs-release ########################################### [100%] [root@localhost ~]# ls /etc/yum.repos.d/ Centos-6.repo CentOS-Media.repo mirrors-rpmforge puppetlabs.repo CentOS-Base.repo.bak CentOS-Vault.repo mirrors-rpmforge-extras rpmforge.repo.bak CentOS-Debuginfo.repo epel-6.repo mirrors-rpmforge-testing [root@localhost ~]# yum list|grep puppet-server puppet-server.noarch 3.8.5-1.el6 puppetlabs-products
这里我用已经准备好的3.7的版本来安装：
[root@localhost src]# ls puppet-3.7 [root@localhost src]# cd puppet-3.7/ [root@localhost puppet-3.7]# ls facter-1.7.6-1.el6.x86_64.rpm mcollective-common-2.6.0-1.el6.noarch.rpm facter-2.2.0-1.el6.x86_64.rpm puppet-3.7.1-1.el6.noarch.rpm hiera-1.3.4-1.el6.noarch.rpm puppet-dashboard-1.2.23-1.el6.noarch.rpm mcollective-2.6.0-1.el6.noarch.rpm puppet-server-3.7.1-1.el6.noarch.rpm mcollective-client-2.6.0-1.el6.noarch.rpm
2、agent端:
1）、安装facter依赖一些ruby相关包
[root@localhost puppet-3.7]# yum install facter-2.2.0-1.el6.x86_64.rpm Dependencies Resolved =================================================================================================== Package Arch Version Repository Size =================================================================================================== Installing: facter x86_64 1:2.2.0-1.el6 /facter-2.2.0-1.el6.x86_64 260 k Installing for dependencies: compat-readline5 x86_64 5.2-17.1.el6 base 130 k pciutils x86_64 3.1.10-4.el6 base 85 k ruby x86_64 1.8.7.374-4.el6_6 base 538 k ruby-libs x86_64 1.8.7.374-4.el6_6 base 1.7 M virt-what x86_64 1.11-1.2.el6 base 24 k Updating for dependencies: pciutils-libs x86_64 3.1.10-4.el6 base 34 k Transaction Summary =================================================================================================== Install 6 Package(s) Upgrade 1 Package(s) [root@localhost puppet-3.7]# rpm -ql facter /usr/bin/facter /usr/lib/ruby/site_ruby/1.8/facter
2）安装puppet
[root@localhost puppet-3.7]# yum install puppet-3.7.1-1.el6.noarch.rpm Dependencies Resolved ========================================================================================= Package Arch Version Repository Size ========================================================================================= Installing: puppet noarch 3.7.1-1.el6 /puppet-3.7.1-1.el6.noarch 6.2 M Installing for dependencies: augeas-libs x86_64 1.0.0-10.el6 base 314 k hiera noarch 1.0.0-4.el6 epel 22 k libselinux-ruby x86_64 2.0.94-5.8.el6 base 100 k ruby-augeas x86_64 0.4.1-1.el6 epel 21 k ruby-irb x86_64 1.8.7.374-4.el6_6 base 317 k ruby-rdoc x86_64 1.8.7.374-4.el6_6 base 381 k ruby-shadow x86_64 1.4.1-13.el6 epel 11 k rubygem-json x86_64 1.4.6-1.el6 epel 457 k rubygems noarch 1.3.7-5.el6 base 207 k Updating for dependencies: libselinux x86_64 2.0.94-5.8.el6 base 108 k libselinux-devel x86_64 2.0.94-5.8.el6 base 137 k libselinux-utils x86_64 2.0.94-5.8.el6 base 82 k Transaction Summary ========================================================================================= Install 10 Package(s) Upgrade 3 Package(s) [root@localhost puppet-3.7]# rpm -ql puppet|less /etc/NetworkManager /etc/NetworkManager/dispatcher.d /etc/NetworkManager/dispatcher.d/98-puppet /etc/logrotate.d/puppet /etc/puppet /etc/puppet/auth.conf /etc/puppet/modules /etc/puppet/puppet.conf /etc/rc.d/init.d/puppet /etc/sysconfig/puppet /usr/bin/extlookup2hiera /usr/bin/puppet /usr/lib/ruby/site_ruby/1.8/hiera /usr/lib/ruby/site_ruby/1.8/hiera/backend /usr/lib/ruby/site_ruby/1.8/hiera/backend/puppet_backend.rb /usr/lib/ruby/site_ruby/1.8/hiera/scope.rb /usr/lib/ruby/site_ruby/1.8/hiera_puppet.rb /usr/lib/ruby/site_ruby/1.8/puppet /usr/lib/ruby/site_ruby/1.8/puppet.rb
3）puppet命令的使用
[root@localhost puppet-3.7]# puppet help Usage: puppet <subcommand> [options] <action> [options] Available subcommands: agent The puppet agent daemon apply Apply Puppet manifests locally ca Local Puppet Certificate Authority management. catalog Compile, save, view, and convert catalogs. cert Manage certificates and requests certificate Provide access to the CA for certificate management. certificate_request Manage certificate requests. certificate_revocation_list Manage the list of revoked certificates. config Interact with Puppet's settings. describe Display help about resource types device Manage remote network devices doc Generate Puppet documentation and references facts Retrieve and store facts. file Retrieve and store files in a filebucket filebucket Store and retrieve files in a filebucket help Display Puppet help. inspect Send an inspection report instrumentation_data Manage instrumentation listener accumulated data. DEPRECATED. instrumentation_listener Manage instrumentation listeners. DEPRECATED. instrumentation_probe Manage instrumentation probes. Deprecated key Create, save, and remove certificate keys. kick Remotely control puppet agent man Display Puppet manual pages. master The puppet master daemon module Creates, installs and searches for modules on the Puppet Forge. node View and manage node definitions. parser Interact directly with the parser. plugin Interact with the Puppet plugin system. queue Deprecated queuing daemon for asynchronous storeconfigs report Create, display, and submit reports. resource The resource abstraction layer shell resource_type View classes, defined resource types, and nodes from all manifests. secret_agent Mimics puppet agent. status View puppet server status. See 'puppet help <subcommand> <action>' for help on a specific subcommand action. See 'puppet help <subcommand>' for help on a specific subcommand. Puppet v3.7.1
[root@localhost puppet-3.7]# puppet describe --help puppet-describe(8) -- Display help about resource types ======== SYNOPSIS -------- Prints help about Puppet resource types, providers, and metaparameters. USAGE ----- puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta] OPTIONS ------- * --help: Print this help text * --providers: Describe providers in detail for each type #为每种类型提供详细描述 * --list: List all types * --meta: List all metaparameters * --short: List only parameters without detail #仅列出参数而不显示详细描述 EXAMPLE ------- $ puppet describe --list $ puppet describe file --providers $ puppet describe user -s -m AUTHOR ------ David Lutterkort COPYRIGHT --------- Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
[root@localhost puppet-3.7]# puppet describe -l #获取所有可用资源类型 These are the types known to puppet: augeas - Apply a change or an array of changes to the ... computer - Computer object management using DirectorySer ... cron - Installs and manages cron jobs exec - Executes external commands file - Manages files, including their content, owner ... filebucket - A repository for storing and retrieving file ... group - Manage groups host - Installs and manages host entries interface - This represents a router or switch interface k5login - Manage the `.k5login` file for a user macauthorization - Manage the Mac OS X authorization database mailalias - .. no documentation .. maillist - Manage email lists mcx - MCX object management using DirectoryService ... mount - Manages mounted filesystems, including puttin ... nagios_command - The Nagios type command nagios_contact - The Nagios type contact nagios_contactgroup - The Nagios type contactgroup nagios_host - The Nagios type host nagios_hostdependency - The Nagios type hostdependency nagios_hostescalation - The Nagios type hostescalation nagios_hostextinfo - The Nagios type hostextinfo nagios_hostgroup - The Nagios type hostgroup nagios_service - The Nagios type service nagios_servicedependency - The Nagios type servicedependency nagios_serviceescalation - The Nagios type serviceescalation nagios_serviceextinfo - The Nagios type serviceextinfo nagios_servicegroup - The Nagios type servicegroup nagios_timeperiod - The Nagios type timeperiod notify - .. no documentation .. package - Manage packages resources - This is a metatype that can manage other reso ... router - .. no documentation .. schedule - Define schedules for Puppet scheduled_task - Installs and manages Windows Scheduled Tasks selboolean - Manages SELinux booleans on systems with SELi ... selmodule - Manages loading and unloading of SELinux poli ... service - Manage running services ssh_authorized_key - Manages SSH authorized keys sshkey - Installs and manages ssh host keys stage - A resource type for creating new run stages tidy - Remove unwanted files based on specific crite ... user - Manage users vlan - .. no documentation .. whit - Whits are internal artifacts of Puppet's curr ... yumrepo - The client-side description of a yum reposito ... zfs - Manage zfs zone - Manages Solaris zones zpool - Manage zpools
[root@localhost puppet-3.7]# puppet describe [-s] user #获取特定资源的使用帮助
user
====
Manage users. This type is mostly built to manage system
users, so it is lacking some features useful for managing normal
users.
This resource type uses the prescribed native tools for creating
groups and generally uses POSIX APIs for retrieving information
about them. It does not directly modify `/etc/passwd` or anything.
**Autorequires:** If Puppet is managing the user's primary group (as
provided in the `gid` attribute), the user resource will autorequire
that group. If Puppet is managing any role accounts corresponding to the
user's roles, the user resource will autorequire those role accounts.
Parameters
----------
- **allowdupe**
Whether to allow duplicate UIDs. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **attribute_membership**
Whether specified attribute value pairs should be treated as the
**complete list** (`inclusive`) or the **minimum list** (`minimum`) of
attribute/value pairs for the user. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **attributes**
Specify AIX attributes for the user in an array of attribute = value
pairs.
Requires features manages_aix_lam.
- **auth_membership**
Whether specified auths should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of auths the user
has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **auths**
The auths the user has. Multiple auths should be
specified as an array.
Requires features manages_solaris_rbac.
- **comment**
A description of the user. Generally the user's full name.
- **ensure**
The basic state that the object should be in.
Valid values are `present`, `absent`, `role`.
- **expiry**
The expiry date for this user. Must be provided in
a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
If you want to make sure the user account does never
expire, you can pass the special value `absent`.
Valid values are `absent`. Values can match `/^\d{4}-\d{2}-\d{2}$/`.
Requires features manages_expiry.
- **forcelocal**
Forces the management of local accounts when accounts are also
being managed by some other NSS
Valid values are `true`, `false`, `yes`, `no`.
Requires features libuser.
- **gid**
The user's primary group. Can be specified numerically or by name.
This attribute is not supported on Windows systems; use the `groups`
attribute instead. (On Windows, designating a primary group is only
meaningful for domain accounts, which Puppet does not currently manage.)
- **groups**
The groups to which the user belongs. The primary group should
not be listed, and groups should be identified by name rather than by
GID. Multiple groups should be specified as an array.
- **home**
The home directory of the user. The directory must be created
separately and is not currently checked for existence.
- **ia_load_module**
The name of the I&A module to use to manage this user.
Requires features manages_aix_lam.
- **iterations**
This is the number of iterations of a chained computation of the
password hash (http://en.wikipedia.org/wiki/PBKDF2). This parameter
is used in OS X. This field is required for managing passwords on OS X
>= 10.8.
Requires features manages_password_salt.
- **key_membership**
Whether specified key/value pairs should be considered the
**complete list** (`inclusive`) or the **minimum list** (`minimum`) of
the user's attributes. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **keys**
Specify user attributes in an array of key = value pairs.
Requires features manages_solaris_rbac.
- **managehome**
Whether to manage the home directory when managing the user.
This will create the home directory when `ensure => present`, and
delete the home directory when `ensure => absent`. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **membership**
Whether specified groups should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of groups to which
the user belongs. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **name**
The user name. While naming limitations vary by operating system,
it is advisable to restrict names to the lowest common denominator,
which is a maximum of 8 characters beginning with a letter.
Note that Puppet considers user names to be case-sensitive, regardless
of the platform's own rules; be sure to always use the same case when
referring to a given user.
- **password**
The user's password, in whatever encrypted format the local
system requires.
* Most modern Unix-like systems use salted SHA1 password hashes. You can
use
Puppet's built-in `sha1` function to generate a hash from a password.
* Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
* Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs
[stdlib][]
module contains a `str2saltedsha512` function which can generate
password
hashes for Lion.
* Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
managing passwords on these systems the salt and iterations properties
need to be specified as well as the password.
* Windows passwords can only be managed in cleartext, as there is no
Windows API
for setting the password hash.
[stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
Be sure to enclose any value that includes a dollar sign ($) in single
quotes (') to avoid accidental variable interpolation.
Requires features manages_passwords.
- **password_max_age**
The maximum number of days a password may be used before it must be
changed.
Requires features manages_password_age.
4）定义资源 保存于资源清单（manifest）中，以pp结尾
格式：
Resource_TYPE（资源类型） {title(资源名）:（用分号分隔）
attribute1(属性1） => value1（值1），
attribute2(属性2） => value2（值2），
。。。
｝
注意：
Recource_TYPE必须全部使用小写字母，
同一类型中的资源的title不允许相同，如果title中有空格可以用引号引起来也可不用
属性必须使用逗号分隔，最后一个属性逗号可有可无
例子：
[root@localhost ~]# mkdir manifests
[root@localhost ~]# cd manifests/
[root@localhost manifests]# vi test1.pp
user {"xxj":
uid => "700",
shell => "/bin/bash",
ensure => present, #创建
name => xiexiaojun #这里可省略，此时将使用资源名xxj代替
}
因为使用的是单机模式，pp文件要手动应用：
[root@localhost manifests]# puppet apply -h puppet-apply(8) -- Apply Puppet manifests locally ======== SYNOPSIS -------- Applies a standalone Puppet manifest to the local system. USAGE ----- puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] [-e|--execute] [--detailed-exitcodes] [-L|--loadclasses] [-l|--logdest syslog|eventlog|<FILE>|console] [--noop] [--catalog <catalog>] [--write-catalog-summary] <file> DESCRIPTION ----------- This is the standalone puppet execution tool; use it to apply individual manifests. When provided with a modulepath, via command line or config file, puppet apply can effectively mimic the catalog that would be served by puppet master with access to the same modules, although there are some subtle differences. When combined with scheduling and an automated system for pushing manifests, this can be used to implement a serverless Puppet site. Most users should use 'puppet agent' and 'puppet master' for site-wide manifests. OPTIONS ------- Note that any setting that's valid in the configuration file is also a valid long argument. For example, 'tags' is a valid setting, so you can specify '--tags <class>,<tag>' as an argument. See the configuration file documentation at http://docs.puppetlabs.com/references/stable/configuration.html for the full list of acceptable parameters. A commented list of all configuration options can also be generated by running puppet with '--genconfig'. * --debug: Enable full debugging. * --detailed-exitcodes: Provide transaction information via exit codes. If this is enabled, an exit code of '2' means there were changes, an exit code of '4' means there were failures during the transaction, and an exit code of '6' means there were both changes and failures. * --help: Print this help message * --loadclasses: Load any stored classes. 'puppet agent' caches configured classes (usually at /etc/puppet/classes.txt), and setting this option causes all of those classes to be set in your puppet manifest. * --logdest: Where to send log messages. Choose between 'syslog' (the POSIX syslog service), 'eventlog' (the Windows Event Log), 'console', or the path to a log file. Defaults to 'console'. * --noop: #跑一遍，不应用 Use 'noop' mode where Puppet runs in a no-op or dry-run mode. This is useful for seeing what changes Puppet will make without actually executing the changes. * --execute: Execute a specific piece of Puppet code * --test: #测试 Enable the most common options used for testing. These are 'verbose', 'detailed-exitcodes' and 'show_diff'. * --verbose: #显示详细信息 Print extra information. * --catalog: Apply a JSON catalog (such as one generated with 'puppet master --compile'). You can either specify a JSON file or pipe in JSON from standard input. * --write-catalog-summary After compiling the catalog saves the resource list and classes list to the node in the state directory named classes.txt and resources.txt EXAMPLE ------- $ puppet apply -l /tmp/manifest.log manifest.pp $ puppet apply --modulepath=/root/dev/modules -e "include ntpd::server" $ puppet apply --catalog catalog.json AUTHOR ------ Luke Kanies COPYRIGHT --------- Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
[root@localhost manifests]# puppet apply --test --noop --verbose test1.pp #跑一遍不应用只使用--noop选项即可 Notice: Compiled catalog for localhost in environment production in 0.25 seconds Info: Applying configuration version '1453961199' Notice: /Stage[main]/Main/User[xxj]/ensure: current_value absent, should be present (noop) Notice: Class[Main]: Would have triggered 'refresh' from 1 events Notice: Stage[main]: Would have triggered 'refresh' from 1 events Info: Creating state file /var/lib/puppet/state/state.yaml Notice: Finished catalog run in 0.03 seconds [root@localhost manifests]# puppet apply --test test1.pp #这里--test应用了 Notice: Compiled catalog for localhost in environment production in 0.26 seconds Info: Applying configuration version '1453961329' Notice: /Stage[main]/Main/User[xxj]/ensure: created #已创建完成 Notice: Finished catalog run in 0.07 seconds [root@localhost manifests]# puppet apply --test test1.pp #再运用一遍看看 Notice: Compiled catalog for localhost in environment production in 0.26 seconds Info: Applying configuration version '1453961368' Notice: Finished catalog run in 0.03 seconds [root@localhost manifests]#
三、puppet资源类型详解
每个资源的定义：类型，title，属性
手动应用manifests: puppet apply --test --noop file.pp
1、资源中的特殊属性
Name/NameVar:大多数资源都有一个名为name的属性，其通常可默认引用资源的title为其值
ensure:指明资源的存在性及额外属性
MetaParamters:?
2、常用的资源类型
notify,cron,exec,service,file,package,group,user
1)notify
常用属性：message 通知的信息内容
[root@localhost ~]# puppet describe notify notify ====== Sends an arbitrary message to the agent run-time log. #手动定义agent运行日志 Parameters ---------- - **message** The message to be sent to the log. - **name** An arbitrary tag for your own reference; the name of the message. - **withpath** Whether to show the full object path. Defaults to false. Valid values are `true`, `false`.
例子：
[root@localhost manifests]# cat test2.pp
notify { "warning":
message => "test form notify"
}
[root@localhost manifests]# puppet apply --noop --verbose test2.pp
Notice: Compiled catalog for localhost in environment production in 0.08 seconds
Info: Applying configuration version '1453963189'
Notice: /Stage[main]/Main/Notify[warning]/message: current_value absent, should be test form notify (noop)
Notice: Class[Main]: Would have triggered 'refresh' from 1 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Notice: Finished catalog run in 0.03 seconds
[root@localhost manifests]# puppet apply --verbose test2.pp
Notice: Compiled catalog for localhost in environment production in 0.08 seconds
Info: Applying configuration version '1453963230'
Notice: test form notify
Notice: /Stage[main]/Main/Notify[warning]/message: defined 'message' as 'test form notify'
Notice: Finished catalog run in 0.03 seconds
2）cron
ensure:目标状态
command:命令
minute,hour,month,monthday(天）,weekday
name:
environment:运行时的环境变量
创建：
[root@localhost manifests]# cat cron.pp
cron {"test3":
minute => '*/10',
command => '/bin/echo "puppet cron"',
name => 'echo something'
}
[root@localhost manifests]# puppet apply cron.pp
Notice: Compiled catalog for localhost in environment production in 0.17 seconds
Notice: /Stage[main]/Main/Cron[test3]/ensure: created
Notice: Finished catalog run in 0.07 seconds
[root@localhost manifests]# crontab -l
# HEADER: This file was autogenerated at Thu Jan 28 14:54:35 +0800 2016 by puppet.
# HEADER: While it can still be managed manually, it is definitely not recommended.
# HEADER: Note particularly that the comments starting with 'Puppet Name' should
# HEADER: not be deleted, as doing so could cause duplicate cron jobs.
# Puppet Name: echo something
*/10 * * * * /bin/echo "puppet cron"
删除：
[root@localhost manifests]# cat cron.pp
cron {"test3":
minute => '*/10',
command => '/bin/echo "puppet cron"',
name => 'echo something',
ensure => absent
}
[root@localhost manifests]# puppet apply cron.pp
Notice: Compiled catalog for localhost in environment production in 0.18 seconds
Notice: /Stage[main]/Main/Cron[test3]/ensure: removed
Notice: Finished catalog run in 0.05 seconds
[root@localhost manifests]# crontab -l
# HEADER: This file was autogenerated at Thu Jan 28 14:58:25 +0800 2016 by puppet.
# HEADER: While it can still be managed manually, it is definitely not recommended.
# HEADER: Note particularly that the comments starting with 'Puppet Name' should
# HEADER: not be deleted, as doing so could cause duplicate cron jobs.
3）exec
command(NameVar）：要执行的命令，必须幂等
creates:此属性指定的文件不存在时才执行此资源
onlyif:此属性指定的命令返回成功状态码时，才运行此资源指定的命令
unles:此属性指定的命令返回错误状态码时，才运行此资源指定的命令
user:以此属性指定的用户身份运行资源指定的命令
group
path:命令搜索路径合集
cwd:在此属性指定的路径下运行此资源指定的命令
refresh:定义 如何refresh此资源，当此exec资源接收到其它资源的事件通知时的默认行为是再一次运行此资源，refresh属性用于改变这种默认行为：
refreshonly:仅在收到refresh通知时才执行此exec资源指定的命令
timeout:命令运行超时时长
tries：尝试运行的次数
[root@localhost manifests]# cat exec.pp
exec {'test3':
command => '[ -f /tmp/hello.puppet ] || echo "hi from exec">/tmp/hello.puppet',
path => '/bin/:/sbin:/usr/bin:/usr/sbin' #如果不指定path属性，则命令必须用绝对路径
}
[root@localhost manifests]# puppet apply exec.pp
Notice: Compiled catalog for localhost in environment production in 0.16 seconds
Notice: /Stage[main]/Main/Exec[test3]/returns: executed successfully
Notice: Finished catalog run in 0.10 seconds
[root@localhost manifests]# cat /tmp/hello.puppet
hi from exec
修改下exec.pp文件：
[root@localhost manifests]# cat exec.pp
exec {'test3':
command => 'echo "hi from exec again">>/tmp/hello.puppet',
path => '/bin/:/sbin:/usr/bin:/usr/sbin',
unless => '[ -f /tmp/hello.puppet ]',
}
[root@localhost manifests]# puppet apply exec.pp
Notice: Compiled catalog for localhost in environment production in 0.16 seconds
Notice: Finished catalog run in 0.09 seconds
[root@localhost manifests]# rm /tmp/hello.puppet
rm: remove regular file `/tmp/hello.puppet'? y
[root@localhost manifests]# puppet apply exec.pp
Notice: Compiled catalog for localhost in environment production in 0.15 seconds
Notice: /Stage[main]/Main/Exec[test3]/returns: executed successfully
Notice: Finished catalog run in 0.17 seconds
4）file
content:直接给定文件内容
source:复制此属性指定的文件为此file定义的文件的内容
recurse：如果source指定的路径为目录可递归传输整个目录，true or false
checksum:指定使用何种方式检查文件内容是否发生改变
ctime,mtime:
ensure:文件存在与否及其文件类型 file,directory，link,present,absent
target:当ensure为link时，指定链接的源文件
force:强制运行与否 true or false
owner,group：属主，属组
linKs:复制时如何处理链接文件 follow(跟随找到源文件并复制),ignore,manage
mode：权限
path:NameVar,文件路径 指明新创建文件的路径
[root@localhost manifests]# cat file.pp
file {'/tmp/mydir':
ensure => directory,
}
file { '/tmp/mydir/test.txt':
content => 'hell from file resource'
}
file {'/tmp/mydir/fstab.puppet':
source => '/etc/fstab',
ensure => file,
}
file {'/tmp/mydir/fstab.link':
target => '/tmp/mydir/fstab.puppet',
ensure => link,
}
file {'/tmp/pam.puppet':
source => '/etc/pam.d',
recurse => true,
ensure => directory,
}
[root@localhost manifests]# puppet apply file.pp
Notice: Compiled catalog for localhost in environment production in 0.21 seconds
Notice: /Stage[main]/Main/File[/tmp/mydir]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/mydir/fstab.puppet]/ensure: defined content as '{md5}cb9a6e0236fb83317f0b540abda1ee19'
Notice: /Stage[main]/Main/File[/tmp/mydir/test.txt]/ensure: defined content as '{md5}85ee74eabd43cf908328a8aaf1eb10d9'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/system-auth-ac]/ensure: defined content as '{md5}e8aee610b8f5de9b6a6cdba8a33a4833'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/atd]/ensure: defined content as '{md5}000d2f30379d2bf8af09f51416e863ec'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/config-util]/ensure: defined content as '{md5}ac222217925c4552d63a8982a1c2937c'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/su]/ensure: defined content as '{md5}beca6a15d6403728b3019aa22487dbee'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/polkit-1]/ensure: defined content as '{md5}038eb4e924b8027bfe852e63edb998de'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/vmtoolsd]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/smartcard-auth-ac]/ensure: defined content as '{md5}dfa6696dc19391b065c45b9525d3ae55'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/sshd]/ensure: defined content as '{md5}64ba359d56f114c262fbe87ee670549b'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/runuser-l]/ensure: defined content as '{md5}da714d1ef1b85471f3bb1a83daa7a88b'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/smartcard-auth]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/reboot]/ensure: defined content as '{md5}2e34bf59ff292b2e03a0701a865881cf'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/system-auth]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/password-auth-ac]/ensure: defined content as '{md5}e8aee610b8f5de9b6a6cdba8a33a4833'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/other]/ensure: defined content as '{md5}af140f3d3ae7fcf504f103e72256cfef'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/ssh-keycat]/ensure: defined content as '{md5}5aa3a8dc7590c1bce2390edb99178b20'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/fingerprint-auth-ac]/ensure: defined content as '{md5}d851f318a16c32ed12f5b1cd55e99281'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/chsh]/ensure: defined content as '{md5}20697b6a640ccd785cb8c96ac8c1ff7c'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/password-auth]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/newrole]/ensure: defined content as '{md5}f4a2547443ac34fb30b7d06719328570'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/fingerprint-auth]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/opcontrol]/ensure: defined content as '{md5}60606299f1ba633d60314d4252f29a98'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/remote]/ensure: defined content as '{md5}0d8f97bd3b0cb2f3e0fe7a49edfcd96d'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/passwd]/ensure: defined content as '{md5}1590b6c8be9806d3c30da4994429eb5c'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/chfn]/ensure: defined content as '{md5}20697b6a640ccd785cb8c96ac8c1ff7c'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/halt]/ensure: defined content as '{md5}2e34bf59ff292b2e03a0701a865881cf'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/smtp]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/smtp.postfix]/ensure: defined content as '{md5}a4fb464fbcf0f1f470ea2016d120df62'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/sudo]/ensure: defined content as '{md5}ba24c05c27c14f376233910f656dfa66'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/poweroff]/ensure: defined content as '{md5}2e34bf59ff292b2e03a0701a865881cf'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/su-l]/ensure: defined content as '{md5}756fef5687fecc0d986e5951427b0c4f'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/runuser]/ensure: defined content as '{md5}b8b44b045259525e0fae9e38fdb2aeeb'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/run_init]/ensure: defined content as '{md5}ed90090331f922df29f123df2c59fd07'
Notice: /Stage[main]/Main/File[/tmp/mydir/fstab.link]/ensure: created
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/sudo-i]/ensure: defined content as '{md5}6151e51bcdcf427be3d57ca53cca02f7'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/crond]/ensure: defined content as '{md5}73dbc2487cc4d9f5fab5e4cdea7aed7e'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/cvs]/ensure: defined content as '{md5}0021b64175b18e68a404ee3eb29211ce'
Notice: /Stage[main]/Main/File[/tmp/pam.puppet/login]/ensure: defined content as '{md5}1bac22a4fbaae2d9ffdcada7778a552b'
Notice: Finished catalog run in 0.32 seconds
[root@localhost manifests]# tree /tmp/mydir/
/tmp/mydir/
├── fstab.link -> /tmp/mydir/fstab.puppet
├── fstab.puppet
└── test.txt
0 directories, 3 files