【puppet初识】
学习目录 领导说saltstack太慢 机器量一旦上来，saltstack就力不从心，所以要将saltstack转向puppet。
【安装背景】
系统centos 6.5
软件地址:
http://downloads.puppetlabs.com/puppet/
master: 192.168.100.10
agent: 192.168.100.13
因为puppet对ca证书的办法是很对域名了。所以域名一定要解析并且master端最好不要变。
【安装步骤】
时钟同步
ntpdate pool.ntp.org
设置hostname并放入hosts解析
echo "192.168.100.10 master.test.com" >> /etc/hosts echo "192.168.100.13 agent.test.com" >> /etc/hostspuppet端master和agent端的安装:
puppet是基于ruby的，所以首先要安装ruby语言环境。
yum install ruby -y
安装facter -->收集系统信息的软件命令
################# master 和agent 共同的步骤 #############
tar xvf facter-1.6.13.tar.gz
cd facter-1.6.13
ruby install.rb
## 检查facter安装是否成功
facter 收集系统的信息的命令工具
tar xvf puppet-3.0.0.tar.gz
cd puppet-3.0.0
ruby install.rb
创建puppet 用户否则启动失败
useradd puppet
######################## master 拷贝配置
[root@master puppet-3.0.0]# pwd
/usr/local/src/puppet-3.0.0
[root@master puppet-3.0.0]# cp ext/redhat/server.init /etc/init.d/puppetmaster
[root@master puppet-3.0.0]# chmod 755 /etc/init.d/puppetmaster
cp ext/redhat/puppet.conf /etc/puppet/
######################## agent 拷贝配置
[root@agent puppet-3.0.0]# cp ext/redhat/client.init /etc/init.d/puppetclient
[root@agent puppet-3.0.0]# chmod 755 /etc/init.d/puppetclient
##### master启动
/etc/init.d/puppetmaster start
#### master启动检测
[root@master puppet-3.0.0]# ps -ef |grep ruby
puppet 10915 1 1 16:34 ? 00:00:01 /usr/bin/ruby /usr/bin/puppet master
root 11272 6458 0 16:36 pts/0 00:00:00 grep --color=auto ruby
[root@master puppet-3.0.0]# netstat -tulnp |grep ruby
tcp 0 0 0.0.0.0:8140 0.0.0.0:* LISTEN 10915/ruby
##### agent 启动
[root@agent puppet-3.0.0]# /etc/init.d/puppetclient start
Starting puppet agent:
#### agent 启动检测
[root@agent puppet-3.0.0]# ps -ef |grep ruby
root 5623 1 5 16:40 ? 00:00:02 /usr/bin/ruby /usr/bin/puppet agent
############## agent 请求证书 master签发证书
agent request agent端向maser端发起证书请求 puppet agent --test --server master.test.com
master accept puppet cert sign agent.test.com 接收指定的 puppet cert sign --all 接收所有的请求
agent fetch
过程1
[root@agent puppet-3.0.0]# puppet agent --test --server master.test.com
Info: Caching certificate for ca
Info: Creating a new SSL certificate request for agent.test.com
Info: Certificate Request fingerprint (SHA256): DB:AC:CB:4E:FC:68:E3:71:B5:45:6E:6C:73:C9:EE:27:11:0F:2D:5A:8F:43:21:53:0D:33:7F:85:87:4B:0E:59
Exiting; no certificate found and waitforcert is disabled
[root@agent puppet-3.0.0]#
过程2:
master端已经有这个请求了 接受就可以了
[root@master puppet]# puppet cert list 或者 puppet cert list --all
"agent.test.com" (SHA256) DB:AC:CB:4E:FC:68:E3:71:B5:45:6E:6C:73:C9:EE:27:11:0F:2D:5A:8F:43:21:53:0D:33:7F:85:87:4B:0E:59
[root@master puppet]#
接收证书:
[root@master puppet]# puppet cert sign agent.test.com
Signed certificate request for agent.test.com
Removing file Puppet::SSL::CertificateRequest agent.test.com at '/var/lib/puppet/ssl/ca/requests/agent.test.com.pem'
过程3:
agent端测试
puppet agent --test --server master.test.com############### 出错过程 ##########
[root@agent puppet-3.0.0]# puppet agent --test
Error: Could not request certificate: Connection refused - connect(2)
Exiting; failed to retrieve certificate and waitforcert is disabled
我这里的原因是 agent的使用的都是默认配置 没有知道指定master 解决方法:
puppet agent --test --server master.test.com
排除了网络问题的命令: telnet master.test.com 8140
####### 写一个测试用例 测试 master 和 agnet可以通信了 及 master可以管理agent端了 agent可以同步master端了
master端编写一个测试pp
[root@master manifests]# cat site.pp
file { "/tmp/temp1.txt":
content => "Hello World\n"; }
[root@master manifests]# pwd
/etc/puppet/manifests
### agent 进行同步
[root@agent puppet-3.0.0]# puppet agent --test --server master.test.com
Info: Retrieving plugin
Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve information from environment production source(s) puppet://master.test.com/plugins
Info: Caching catalog for agent.test.com
Info: Applying configuration version '1480151413'
/Stage[main]//File[/tmp/temp1.txt]/ensure: defined content as '{md5}e59ff97941044f85df5297e1c302d260'
Finished catalog run in 0.04 seconds
[root@agent puppet-3.0.0]# cat /tmp/temp1.txt
Hello World
[root@agent puppet-3.0.0]#
上面错误的信息原因:
Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve information from environment production source(s) puppet://master.test.com/plugins
不影响: 原因未知
【puppet清楚证书】
master端:
[root@shzr-vctr001 user]# puppet cert --clean shzr-vapp015.a.pa.com
Notice: Revoked certificate with serial 14
Notice: Removing file Puppet::SSL::Certificate shzr-vapp015.a.pa.com at '/var/lib/puppet/ssl/ca/signed/shzr-vapp015.a.pa.com.pem'
Notice: Removing file Puppet::SSL::Certificate shzr-vapp015.a.pa.com at '/var/lib/puppet/ssl/certs/shzr-vapp015.a.pa.com.pem'
client端:
\rm -r /var/lib/puppet/ssl/
另外有需要云服务器可以了解下创新互联cdcxhl.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。
