puppet部署与应用

Posted 2020-09-17

               Puppet部署于应用

1、工作流程

1）客户端puppet调用facter（facter是通过ssl加密收集及检测分析客户端配置信息的一个工具），facter探测出主机的一些变量，如主机名，内存大小，ip地址等。Puppet把这些信息通过ssl连接发送到服务器器端

2）服务器端的puppetmaster通过facter工具分析检测客户端的主机名，然后找到项目主配置文件mainfest里面对应的node配置，并对该部分内容进行解析。Facter发送过来的信息可以作为变量处理，node牵扯到的代码才解析，其他没牵涉的代码不解析，解析分为几个阶段，首先进行语法检查，如果语法没错，就继续解析，解析的结果生成一个中间的“伪代码”，然后把伪代码发送给客户端。

3）客户端接收到伪代码，并执行，客户端把执行的结果发送给服务器。

4）服务器把客户端的执行结果写入日志。

 Puppet工作过程有以下两点值得注意：

1）为了保证安全，client和master之间是基于ssl和证书的，只有经master证书认证的client可以与master通信。

2）Puppet会让系统保持在人们所期望的某种状态并一直维持下去，例如：检测某个文件并保证其一直存在，保证ssh服务始终开启，如果文件被删除了或者ssh服务被关闭了，puppet下次执行时（默认30分钟），会重新创建该文件或者启动ssh服务。

 

 

 

实验环境：

实验目标：

1.通过puppetmaster管理clinet端的ssh服务

2.客户端可以主动拉取

3.master可以主动推送

一、搭建ntp server（已经安装)

server 127.127.1.0

fudge 127.127.1.0 stratum 8

 

[[email protected] ~]# service ntpd start

[[email protected] ~]# chkconfig ntpd on

 

二、搭建puppetmaster

1.规划服务器主机名

[[email protected] ~]# vim  /etc/sysconfig/network

NETWORKING=yes

HOSTNAME=master.test.com

 

[[email protected] ~]# hostname master.test.com

[[email protected] ~]# bash

 

2.添加主机名解析；在互联网中可以搭建DNS服务

[[email protected] ~]# vim /etc/hosts

192.168.1.1 master.test.com

192.168.1.2 client1.test.com

192.168.1.3 client2.test.com

 

2.服务器时间同步

[[email protected] ~]#yum  -y  install  ntp( 默认已经安装)

[[email protected] ~]# ntpdate 192.168.1.4

 

3.安装ruby，先安装compat-readline5（系统盘中），也可以一并安装

由于puppet是采用ruby语言开发，所以无论是源码还是RPM方式安装puppet，我们都必须要先安装ruby语言环境

[[email protected] ~]# rpm  -ivh  /mnt/Packages/compat-readline5-5.2-17.1.el6.x86_64.rpm

 

[[email protected] ~]# rpm  -ivh  /mnt/ruby-*.rpm

 

4.检查ruby版本

[[email protected] ~]# ruby  -v

ruby 1.8.7 (2011-06-30 patchlevel 352) [x86_64-linux]

 

5.安装facter安装

[[email protected] ~]# useradd  -s /sbin/nologin  puppet

 

安装facter源码包

[[email protected] ~]# tar  zxf  /mnt/facter-1.7.1.tar.gz  -C  /usr/src

[[email protected] ~]# cd  /usr/src/facter-1.7.1/

[[email protected] facter-1.7.1]# ruby  install.rb

 

6.安装puppet源码包

①安装

[[email protected] puppet-2.7.21]# tar zxf /mnt/puppet-2.7.21.tar.gz -C /usr/src

[[email protected] puppet-2.7.21]# cd  /usr/src/puppet-2.7.21/

[[email protected] puppet-2.7.21]# ruby install.rb

 

②复制配置文件

[[email protected] puppet-2.7.21]# cp  conf/redhat/fileserver.conf   /etc/puppet/

[[email protected] puppet-2.7.21]# cp  conf/redhat/puppet.conf  /etc/puppet/

[[email protected] puppet-2.7.21]# cp  conf/redhat/server.init  /etc/init.d/puppetmaster

 

③修改文件属性

[[email protected] puppet-2.7.21]# chmod +x  /etc/init.d/puppetmaster

 

④创建puppet主目录

[[email protected] puppet-2.7.21]# mkdir /etc/puppet/manifests  //存放配置文件

[[email protected] puppet-2.7.21]# mkdir /etc/puppet/modules   //存放模块配置

 

7.puppet服务证书请求与签名

master端配置

①关闭防火墙

#service  iptables  stop     //之前已经关闭

②修改配置文件。在【main】标题下添加以下一行：配置服务器模块路径

[[email protected] ~]# vim  /etc/puppet/puppet.conf    

modulepath = /etc/puppet/modules:/usr/share/puppet/modules

 

③启动puppet主程序

[[email protected] ~]# /etc/init.d/puppetmaster  start

Starting puppetmaster:                                     [  OK  ]

 

④查看puppet监听端口

[[email protected] ~]# netstat -anpt|grep 8140

tcp        0      0 0.0.0.0:8140                0.0.0.0:*                   LISTEN      2123/ruby     

 

二、搭建puppetclient1

1.规划服务器主机名

[[email protected] ~]# vim  /etc/sysconfig/network

NETWORKING=yes

HOSTNAME=client1.test.com

 

[[email protected] ~]# hostname client1.test.com

[[email protected] ~]# bash

 

2.添加主机名解析

[[email protected] ~]# vim /etc/hosts

192.168.1.1 master.test.com

192.168.1.2 client1.test.com

192.168.1.3 client2.test.com

 

3.确保通过域名ping通puppetmaster

[[email protected] ~]# ping master.test.com

PING master.test.com (192.168.1.1) 56(84) bytes of data.

64 bytes from master.test.com (192.168.1.1): icmp_seq=1 ttl=64 time=7.29 ms

 

3.服务器时间同步

[[email protected] ~]# ntpdate 192.168.1.4

 7 May 16:24:22 ntpdate[2532]: adjust time server 192.168.1.4 offset -0.144460 sec

 

4. 安装ruby，先安装compat-readline5（系统盘中），也可以一并安装

[[email protected] ~]# rpm  -ivh  /mnt/Packages/compat-readline5-5.2-17.1.el6.x86_64.rpm

[[email protected] ~]# rpm -ivh /mnt/ruby-*.rpm

 

5检查ruby版本

[[email protected] ~]# ruby  -v

ruby 1.8.7 (2011-06-30 patchlevel 352) [x86_64-linux]

 

6.安装facter

[[email protected] facter-1.7.1]# useradd  -s  /sbin/nologin  puppet

[[email protected] ~]# tar zxf /mnt/facter-1.7.1.tar.gz  -C  /usr/src

[[email protected] ~]# cd  /usr/src/facter-1.7.1/

[[email protected] facter-1.7.1]# ruby install.rb

 

7.安装puppet

[[email protected] facter-1.7.1]# tar  zxf /mnt/puppet-2.7.21.tar.gz  -C  /usr/src

[[email protected] facter-1.7.1]# cd  /usr/src//puppet-2.7.21/

[[email protected] puppet-2.7.21]# ruby install.rb

 

8.复制配置文件

[[email protected] puppet-2.7.21]# cp conf/redhat/puppet.conf  /etc/puppet

[[email protected] puppet-2.7.21]# cp conf/redhat/client.init /etc/init.d/puppetclient

 

9.修改文件属性

[[email protected] puppet-2.7.21]# chmod  +x  /etc/init.d/puppetclient

 

10.puppet服务证书与签名

①关闭防火墙

[[email protected] puppet-2.7.21]# service iptables stop   //之前已经关闭

②修改client配置文件（两台client配置完全一样）

#vim  /etc/puppet/puppet.conf

[main]

    # The Puppet log directory.

    # The default value is ‘$vardir/log‘.

    logdir = /var/log/puppet

    # Where Puppet PID files are kept.

    # The default value is ‘$vardir/run‘.

    rundir = /var/run/puppet

server = master.test.com

 

三、搭建puppetclient2

1.规划服务器主机名

[[email protected] ~]# vim  /etc/sysconfig/network

NETWORKING=yes

HOSTNAME=client2.test.com

 

[[email protected] ~]# hostname client2.test.com

[[email protected] ~]# bash

 

2.添加主机名解析

[[email protected] ~]# vim /etc/hosts

192.168.1.1 master.test.com

192.168.1.2 client1.test.com

192.168.1.3 client2.test.com

 

3.确保通过域名ping通puppetmaster

[[email protected] ~]# ping master.test.com

PING master.test.com (192.168.1.1) 56(84) bytes of data.

64 bytes from master.test.com (192.168.1.1): icmp_seq=1 ttl=64 time=7.29 ms

 

3.服务器时间同步

[[email protected] ~]# ntpdate 192.168.1.4

 7 May 16:24:22 ntpdate[2532]: adjust time server 192.168.1.4 offset -0.144460 sec

 

4. 安装ruby，先安装compat-readline5（系统盘中），也可以一并安装

[[email protected] ~]# rpm  -ivh  /mnt/Packages/compat-readline5-5.2-17.1.el6.x86_64.rpm

[[email protected] ~]# rpm -ivh /mnt/ruby-*.rpm

 

5检查ruby版本

[[email protected] ~]# ruby  -v

ruby 1.8.7 (2011-06-30 patchlevel 352) [x86_64-linux]

 

6.安装facter

[[email protected] facter-1.7.1]# useradd -s /sbin/nologin  puppet

[[email protected] ~]# tar zxf /mnt/facter-1.7.1.tar.gz -C /usr/src

[[email protected] ~]# cd /usr/src/facter-1.7.1/

[[email protected] facter-1.7.1]# ruby install.rb

 

7.安装puppet

[[email protected] facter-1.7.1]# tar zxf /mnt/puppet-2.7.21.tar.gz -C /usr/src

[[email protected] facter-1.7.1]# cd /usr/src//puppet-2.7.21/

chmod 0644 /usr/share/man/man8/puppet-node.8

[[email protected] puppet-2.7.21]# ruby install.rb

 

8.复制配置文件

[[email protected] puppet-2.7.21]# cp conf/redhat/puppet.conf  /etc/puppet

[[email protected] puppet-2.7.21]# cp conf/redhat/client.init /etc/init.d/puppetclient

 

9.修改文件属性

[[email protected] puppet-2.7.21]# chmod  +x  /etc/init.d/puppetclient

 

10.puppet服务证书与签名

①关闭防火墙

[[email protected] puppet-2.7.21]# service iptables stop  //已经关闭

②修改client配置文件（两台client配置完全一样）

#vim  /etc/puppet/puppet.conf

[main]

    # The Puppet log directory.

    # The default value is ‘$vardir/log‘.

    logdir = /var/log/puppet

    # Where Puppet PID files are kept.

    # The default value is ‘$vardir/run‘.

    rundir = /var/run/puppet

server = master.test.com

 

四、注册与申请

1.分别在客户端client1和client2上注册

[[email protected] puppet-2.7.21]# puppet agent --server=master.test.com  --no-daemonize --verbose

 

[[email protected]2 puppet-2.7.21]# puppet agent --server=master.test.com  --no-daemonize --verbose

 

这个指令的作用是将puppet agent不用守护进程的模式启动，好处是能看到与服务器端的通信及证书签名的过程，方便debug。 默认puppet每2分钟向服务器端申请一次签名直到获得服务器端发来的经过签名的证书才 start agent 服务

2.在master上查看申请注册的客户端

[[email protected] ~]# puppet cert  --list  //查看申请注册的客户端

  "client1.test.com" (99:6A:C3:89:C8:1C:B5:75:24:BA:56:51:43:1E:EB:71)

  "client2.test.com" (B8:51:93:3D:5A:77:49:01:B6:1A:B8:EB:57:16:46:8B)

 

3.在master上将未注册的客户端进行注册

[[email protected] ~]# puppet cert  sign  --all

 

4.可以通过目录去查看已经注册的客户端

[[email protected] ~]# ll /var/lib/puppet/ssl/ca/signed/

total 12

-rw-r----- 1 puppet puppet 1915 May  7 17:59 client1.test.com.pem

-rw-r----- 1 puppet puppet 1915 May  7 17:59 client2.test.com.pem

-rw-r----- 1 puppet puppet 1988 May  7 16:17 master.test.com.pem

 

此时客户端已经完整了证书的申请和签名

五、配置实例

1.配置一个测试节点

n 节点信息：/etc/puppet/manifests/nodes

n 模块信息:/etc/puppet/modules

为了保护linux的ssh端口爆破，批量修改客户端sshd端口，将端口22改为9922，并实现重启工作

创建ssh模块，模块目录为ssh，模块下面有三个文件：manifests、templates和files

n manifests:此目录为存放配置文件的目录，里面必须包含一个init.pp的文件，这是该模块的入口文件

l 导入一个模块的时候，会从init.pp开始执行。可以把所有的代码都写道init.pp里面，也可以分成多个pp文件，init再去包含其他文件

l 定义class类名的时候必须是ssh，这样能实现调用

n files目录是该模块的文件发布目录，puppet提供一个文件分发机制/etc/ssh/sshd_conf

n templates目录包含erb模版文件

master端：

①创建需要的必要目录

#mkdir  -p  /etc/puppet/modules/ssh/{manifests,templates,files}

#mkdir  /etc/puppet/manifests/nodes   //节点目录作用与client

#mkdir /etc/puppet/modules/ssh/files/ssh   //控制ssh服务

#chown  -R  puppet  /etc/puppet/modules/  //修改权限

 

此时/et/puppet/modules/ssh目录下结构

[[email protected] ~]# ll /etc/puppet/modules/ssh

 

②创建模块配置文件install.pp

[[email protected] ~]# vim /etc/puppet/modules/ssh/manifests/install.pp

class ssh::install{

package{ "openssh":

        ensure => present

        }

}

 

③创建模块配置文件config.pp

[[email protected] ~]# vim /etc/puppet/modules/ssh/manifests/config.pp

class ssh::config{

file { "/etc/ssh/sshd_config":

        ensure => present,

        owner =>"root",

        group =>"root",

        mode => "0600",

        source =>"puppet://$puppetserver/modules/ssh/ssh/sshd_config",

        require => Class["ssh::install"],

        notify => Class["ssh::service"],

 }

}

 

④创建service.pp

[[email protected] ~]# vim /etc/puppet/modules/ssh/manifests/service.pp

class ssh::service {

        service {"sshd":

                ensure => running,

                hasstatus =>true,

                hasrestart =>true,

                enable =>true,

                require =>Class["ssh::config"]

}

}

 

⑤创建模块主配置文件，将以上配置文件加载进去，输入以下信息：

[[email protected] ~]# vim /etc/puppet/modules/ssh/manifests/init.pp

class ssh{

        include ssh::install,ssh::config,ssh::service

}

 

此时/etc/puppet/modules/ssh/manifests下有四个文件

[[email protected] ~]# ll /etc/puppet/modules/ssh/manifests/

 

⑥建立服务器ssh统一维护文件

由于服务器和客户端的sshd_config文件默认一样，此时将服务器端/etc/ssh/sshd_config复制到模块默认路径

[[email protected] ~]# cp /etc/ssh/sshd_config  /etc/puppet/modules/ssh/files/ssh/

[[email protected] ~]#

⑦创建测试节点配置文件，并将ssh加载进去

[[email protected] ~]# vim /etc/puppet/manifests/nodes/ssh.pp

 

 

⑧将测试节点载入puppet，即修改site.pp

[[email protected] ~]# vim /etc/puppet/manifests/site.pp

 

⑨修改服务器端维护的sshd_config配置文件

[[email protected] ~]# vim /etc/puppet/modules/ssh/files/ssh/sshd_config

Port 9922    

 

⑩重新启动puppet

[[email protected] ~]# /etc/init.d/puppetmaster restart

Stopping puppetmaster:                                     [  OK  ]

Starting puppetmaster:                                     [  OK  ]      

             

2.客户端主动拉取  注：这里使用clinet1测试；client2同理

[[email protected] puppet]# puppet agent  -t

 

 ①检查客户端/etc/ssh/sshd_config配置是不是自动变了

[[email protected] puppet]# vim /etc/ssh/sshd_config

Port 9922

②查看服务器ssh服务是否重启，端口是否生效

[[email protected] puppet]# netstat -tunlp|grep ssh

    

3.服务器推送同步

客户端配置

①修改配置文件

[[email protected] puppet]# vim /etc/puppet/puppet.conf

最后一行添加如下

listen = true  //使puppet监听8139端口

 

[[email protected] puppet]# vim /etc/puppet/auth.conf

allow *  //允许任何服务器推送

 

②启动puppet客户端

[[email protected] puppet]# /etc/init.d/puppetclient start

Starting puppet:                                           [  OK  ]

 

[[email protected] puppet]# netstat -anpt|grep 8139  //自身puppet端口号

 

③修改/etc/ssh/sshd_config配置文件

[[email protected] puppet]# vim /etc/ssh/sshd_config

Port  22

 

[[email protected] puppet]#service  sshd  restart

 

服务器端配置

④从服务器开始向客户端推送

[[email protected] ssh]# puppet kick  client1.test.com

 

⑤校验结果

[[email protected] puppet]# vim /etc/ssh/sshd_config

Port 9922

 

[[email protected] puppet]# service sshd restart

[[email protected] puppet]# netstat -anpt|grep 9922

   

本文出自 “apache” 博客，请务必保留此出处http://xiaorenwutest.blog.51cto.com/12754924/1923886