Puppet安装配置Puppet

Posted 2022-02-22 xuyebao

一、参考链接

阿里巴巴开源镜像站-OPSX镜像站-阿里云开发者社区

puppet镜像-puppet下载地址-puppet安装教程-阿里巴巴开源镜像站

序 | Puppet运维实战 (gitbooks.io)

二、Puppet介绍

三、Puppet安装

安装准备

# 修改主机名
hostnamectl set-hostname master

#配置域名解析
 vim /etc/hosts
192.168.200.11  master
192.168.200.12  node

#关闭防火墙
systemctl stop firewalld
systemctl disable firewalld

#关闭SELinux安全模式
setenforce 0
sed -i s/SELINUX=.*/SELINUX=disabled/g /etc/selinux/config

#配置时间同步
yum install -y ntpdate
ntpdate ntp1.aliyun.com

#配置CentOS镜像源
curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo

sed -i -e /mirrors.cloud.aliyuncs.com/d -e /mirrors.aliyuncs.com/d /etc/yum.repos.d/CentOS-Base.repo

#更新YUM源
yum clean all
yum makecache

#升级系统
yum update

安装master端

安装、配置并使用Puppet | Puppet运维实战

https://puppet.com/

# 安装阿里云仓库
rpm -ivh https://mirrors.aliyun.com/puppet/yum/puppetlabs-release-el-7.noarch.rpm

# 安装Puppet-server、puppet和facter
yum install -y puppet puppet-server facter

# 备份配置文件
cp /etc/puppet/puppet.conf,.bak 

# 配置puppet.conf
[root@master puppet]# vim puppet.conf
[root@master puppet]# cat puppet.conf
[main]
    # The Puppet log directory.
    # The default value is $vardir/log.
    logdir = /var/log/puppet

    # Where Puppet PID files are kept.
    # The default value is $vardir/run.
    rundir = /var/run/puppet

    # Where SSL certificates are kept.
    # The default value is $confdir/ssl.
    ssldir = $vardir/ssl

[agent]
    # The file in which puppetd stores a list of the classes
    # associated with the retrieved configuratiion.  Can be loaded in
    # the separate ``puppet`` executable using the ``--loadclasses``
    # option.
    # The default value is $confdir/classes.txt.
    classfile = $vardir/classes.txt

    # Where puppetd caches the local configuration.  An
    # extension indicating the cache format is added automatically.
    # The default value is $confdir/localconfig.
    localconfig = $vardir/localconfig
    server = master
    certname = node

[master]
    certname = master
[root@master puppet]# 

# 启动puppetmaster服务
systemctl start puppetmaster
systemctl enable puppetmaster
systemctl status puppetmaster

# 查看本地证书情况
# puppetmaster第一次启动会自动生成证书自动注册自己
[root@master puppet]# tree /var/lib/puppet/ssl/
/var/lib/puppet/ssl/
├── ca
│   ├── ca_crl.pem
│   ├── ca_crt.pem
│   ├── ca_key.pem
│   ├── ca_pub.pem
│   ├── inventory.txt
│   ├── private
│   │   └── ca.pass
│   ├── requests
│   ├── serial
│   └── signed
│       └── master.pem
├── certificate_requests
├── certs
│   ├── ca.pem
│   └── master.pem
├── crl.pem
├── private
├── private_keys
│   └── master.pem
└── public_keys
    └── master.pem

9 directories, 13 files
[root@master puppet]# 

# 查看监听状态
# puppetmaster服务开启后，默认监听TCP 8140端口
[root@master puppet]# netstat -nlatp | grep 8140
tcp        0      0 0.0.0.0:8140            0.0.0.0:*               LISTEN      1396/ruby 
[root@master puppet]# lsof -i:8140
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
puppet  1396 puppet    8u  IPv4  24447      0t0  TCP *:8140 (LISTEN)

安装node端

# 安装准备步骤相同

# 安装阿里云仓库
rpm -ivh https://mirrors.aliyun.com/puppet/yum/puppetlabs-release-el-7.noarch.rpm

# 安装puppet和facter
yum install puppet facter

# 配置puppet.conf
[root@node ~]# cp /etc/puppet/puppet.conf,.bak    #备份配置文件
[root@node ~]# cat /etc/puppet/puppet.conf      
[main]
    # The Puppet log directory.
    # The default value is $vardir/log.
    logdir = /var/log/puppet        #默认日志存放路径

    # Where Puppet PID files are kept.
    # The default value is $vardir/run.
    rundir = /var/run/puppet        #pid存放路径

    # Where SSL certificates are kept.
    # The default value is $confdir/ssl.
    ssldir = $vardir/ssl            #证书存放目录，默认$vardir为/var/lib/puppet

[agent]
    # The file in which puppetd stores a list of the classes
    # associated with the retrieved configuratiion.  Can be loaded in
    # the separate ``puppet`` executable using the ``--loadclasses``
    # option.
    # The default value is $confdir/classes.txt.
    classfile = $vardir/classes.txt

    # Where puppetd caches the local configuration.  An
    # extension indicating the cache format is added automatically.
    # The default value is $confdir/localconfig.
    localconfig = $vardir/localconfig
    server = master     #指向puppetmaster端
    certname = node     #设置自己的certname名

# 开启puppet服务
systemctl start puppet
systemctl enable puppet

Node端向Master端发起认证

# 通过调试模式启动节点向Puppetmaster端发起认证
[root@node ~]# puppet agent --test
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for node
Info: Applying configuration version 1645352953
Notice: Finished catalog run in 0.01 seconds

# 服务器端确定认证
[root@master ~]# puppet cert --list --all   #查看认证情况
  "node"   (SHA256) 6F:FC:CF:DB:1F:F1:B4:91:C7:8B:48:DE:64:A1:8D:D9:24:27:4B:B9:A9:72:5C:0E:6D:3F:A3:0B:B7:37:87:AE #未认证
+ "master" (SHA256) 87:C4:5B:16:2A:13:E1:D0:B0:58:63:2F:F1:87:98:6D:B6:A4:5D:9B:65:92:D8:72:38:45:FF:2A:18:FD:BA:41 #带+表示已经注册成功
[root@master ~]#

[root@master ~]# puppet cert --sign node    #注册node
Notice: Signed certificate request for node
Notice: Removing file Puppet::SSL::CertificateRequest node at /var/lib/puppet/ssl/ca/requests/node.pem
[root@master ~]#

[root@master ~]# puppet cert --list --all   #再次查看认证情况
+ "master" (SHA256) 87:C4:5B:16:2A:13:E1:D0:B0:58:63:2F:F1:87:98:6D:B6:A4:5D:9B:65:92:D8:72:38:45:FF:2A:18:FD:BA:41
+ "node"   (SHA256) 35:B1:01:AA:28:DF:76:AA:B2:67:BE:D4:5C:C1:90:3C:C2:68:44:9A:BA:F3:DD:96:2B:37:6E:9E:85:11:E3:E1

[root@master ~]# tree /var/lib/puppet/ssl/  #另外一种查看认证的方式
/var/lib/puppet/ssl/
├── ca
│   ├── ca_crl.pem
│   ├── ca_crt.pem
│   ├── ca_key.pem
│   ├── ca_pub.pem
│   ├── inventory.txt
│   ├── private
│   │   └── ca.pass
│   ├── requests
│   ├── serial
│   └── signed
│       ├── master.pem
│       └── node.pem
├── certificate_requests
│   └── node.pem
├── certs
│   ├── ca.pem
│   ├── master.pem
│   └── node.pem
├── crl.pem
├── private
├── private_keys
│   ├── master.pem
│   └── node.pem
└── public_keys
    ├── master.pem
    └── node.pem

9 directories, 18 files