puppet5.1 安装与配置

一、Puppet概念

简介

当服务器数量达到一定的规模时,仅依靠人为完成批量部署服务器个资源的配置,运维工作将变得繁琐且容易出错,为了解决这一问题,我们应该怎么办呢?我们可以引入一批工具,这批工具可编写相应的manifests代码,运行它便可以自动完成所有的工作,目前比较流行的运维工具主要有:puppet,ansible, slackstack等,在这我们主要以puppet来展开话题。在一些大型互联网企业中,运维自动化管理着几百甚至上千台服务器,它可以针对多台服务器进行统一操作,例如部署统一软件、进行统一上线维护等,而且能够快速完成上线部署,减少人力及人力误操作风险。

工作原理

puppet的目的是让系统管理员只集中于要管理的目标服务器,而忽略实现的细节。puppet既可以在单机上使用,也可以C/S结构使用,在大规模部署puppet的情况下,通常我们会使用C/S结构,在这种结构下,服务端运行puppet-master程序客户端运行puppet-client服务程序

具体的工作流程图如下所示:

对于puppet的的掌握,理解puppet的工作原理是一个必要的的阶段,只有在了解了puppet的工作原理后才能更好应用puppet,下面让我们一起了解学习puppet的工作原理:

说到puppet的工作原理,不得不从以下四个方面来说到,如下所示:

(1)定义:使用Puppet特定的语言定义基础配置信息。通常我们把这些信息写在Modules中。

(2)模板:在配置执行之前检测代码,但并不真正执行。

(3)执行:定义的配置自动部署。检测并记录下所发生变化的部分。

(4)报告:将期待的变化、实际发生的变化及任何修改发送给报告系统。

如下所示为puppet的工作数据流示意图

数据流说明:

1.首先所有的节点(Node)Node节点将Facts和本机信息发送给Master

2.Master告诉Node节点应该如何配置,将这些信息写入Catalog后传给Node。

3.Node节点在本机进行代码解析验证并执行,将结果反馈给Master。

4.Master通过API将数据发给分析工具。报告完全可以通过开放API或与其他系统集成。

整个数据流的走向是基于SSL安全协议的,如下图所示:

模板文件处理过程说明如下:

Puppet通过编译Manifest中的内容 (即模板中内容),将编译好的代码存入Catalog。在执行前先进行代码的验证,再执行,完成最开始所定义好的状态。代码编译过程如图所示:

如下所示为整个puppet自动部署过程中agent和master的详细的交互过程:

过程说明:

1. Puppet客户端Agent将节点名与facts信息发送给Master。

2. Puppet服务端Master通过分类判断请求的客户端是谁,它将要做什么。这个判断是通过site.pp中包含的Node.pp配置文件定义的。

3. Puppet服务端Master将所需要的Class类信息进行编译后存入Catalog并发送给Puppet客户端Agent,到此完成第一次交互。

4. Puppet客户端Agent对Catalog进行代码验证(语法检查及错误检查)并执行。主要是代码的验证,并将执行过程的信息及结果写入日志。

5. Puppet客户端Agent最终达到最开始所定义的状态,并且将结果及任何执行数据通过开放API的形式发送给Puppet服务端Master。

以上就是puppet的工作原理需要注意是:因为整个过程中都是基于ssl实现的,所以首要的是保证agent和master间可以基于ssl通讯!

Hardware

The Puppet agent service has no particular hardware requirements and can run on nearly anything.

However, the Puppet master service is fairly resource intensive, and should be installed on a robust dedicated server.

  • At a minimum, your Puppet master server should have two processor cores and at least 1 GB of RAM.
  • To comfortably serve at least 1,000 nodes, it should have 2-4 processor cores and at least 4 GB of RAM.

The demands on the Puppet master vary widely between deployments. The total needs are affected by the number of agents being served, how frequently those agents check in, how many resources are being managed on each agent, and the complexity of the manifests and modules in use.

来自 <https://docs.puppet.com/puppet/5.0/system_requirements.html>

Puppet consists of:

  • A puppet-agent "All-in-One" package that installs Puppet, Ruby, Facter, Hiera, and supporting code.
  • A puppetserver package that installs Puppet Server.
  • A puppetdb package that installs PuppetDB.

To install these, read the pre-install instructions, then see the Puppet installation guides for Linux, Windows, and macOS.

Puppet 5 Platform contents

Puppet 5 Platform contains the following components:


Package


Contents


puppet-agent


Puppet, Facter, Hiera, MCollective, pxp-agent, root certificates, and prerequisites like Ruby and Augeas


puppetserver


Puppet Server; depends on puppet-agent 5 or greater


puppetdb


PuppetDB


puppetdb-termini


Plugins to let Puppet Server talk to PuppetDB

What puppet-agent and Puppet Server are

We distribute Puppet as two core packages.

  • puppet-agent — This package contains Puppet‘s main code and all of the dependencies needed to run it, including Facter, Hiera, and bundled versions of Ruby and OpenSSL. It also includes MCollective. Once it‘s installed, you have everything you need to run the Puppet agent service and the puppet apply command.
  • puppetserver — This package depends on puppet-agent, and adds the JVM-based Puppet Server application. Once it‘s installed, Puppet Server can serve catalogs to nodes running the Puppet agent service.

Settings for agents (all nodes)

Roughly in order of importance. Most of these can go in either [main] or [agent], or be specified on the command line.

Basics

  • server — The Puppet master server to request configurations from. Defaults to puppet; change it if that‘s not your server‘s name.

    • ca_server and report_server — If you‘re using multiple masters, you‘ll need to centralize the CA; one of the ways to do this is by configuring ca_server on all agents. See the multiple masters guide for more details. The report_server setting works about the same way, although whether you need to use it depends on how you‘re processing reports.
  • certname — The node‘s certificate name, and the unique identifier it uses when requesting catalogs; defaults to the fully qualified domain name.

    • For best compatibility, you should limit the value of certname to only use letters, numbers, periods, underscores, and dashes. (That is, it should match /\A[a-z0-9._-]+\Z/.)
    • The special value ca is reserved, and can‘t be used as the certname for a normal node.
  • environment — The environment to request when contacting the Puppet master. It‘s only a request, though; the master‘s ENC can override this if it chooses. Defaults to production.

    Note on Non-Certname Node Names

    Although it‘s possible to set something other than the certname as the node name (using either the node_name_fact or node_name_value setting), we don‘t generally recommend it. It allows you to re-use one node certificate for many nodes, but it reduces security, makes it harder to reliably identify nodes, and can interfere with other features.

    Setting a non-certname node name is not officially supported in Puppet Enterprise.

来自 <https://docs.puppet.com/puppet/5.1/puppet_platform.html>

二、环境准备

CentOS7.3.1611

NTP/chroynd

DNS

Sudo users

SELinux/Firewalld

/etc/hosts

puppet master: puppet-master.gw.local

puppet client: lux-vm32.gw.local

三、软件安装

  1. 软件下载

rpm repo

rpm -Uvh https://yum.puppetlabs.com/puppet5/puppet5-release-el-7.noarch.rpm

rpm pacakge

puppetserver

wget https://yum.puppetlabs.com/puppet/el/7/x86_64/puppetserver-5.0.0-1.el7.noarch.rpm

puppet-agent

wget https://yum.puppetlabs.com/puppet/el/7/x86_64/puppet-agent-5.1.0-1.el7.x86_64.rpm

2、安装

puppet master

yum -y install puppetserver (同时会安装puppet-agent)

puppet agent

yum -y install puppet-agent

3、配置

Config files

  • puppet.conf — Puppet‘s main config file. (Any node.)
  • auth.conf — access control rules for the Puppet master‘s network services. (Master only.)
  • autosign.conf — a list of pre-approved certificate requests. (CA master only.)
  • csr_attributes.yaml — optional data to be inserted into new certificate requests. (Any node.)
  • device.conf — configuration for network devices managed by the puppet device command. (Any node acting as an intermediary to configure network devices.)
  • fileserver.conf — configuration for additional fileserver mount points. (Master only.)
  • hiera.yaml — global configuration for the Hiera data lookup system. Note that environments and modules can have their own hiera.yaml files. (Master, or standalone nodes running Puppet apply.)
  • routes.yaml — advanced configuration of indirector behavior. (Master only.)

Location

The puppet.conf file is always located at $confdir/puppet.conf.

Although its location is configurable with the config setting, it can only be set on the command line (e.g. puppet agent -t --config ./temporary_config.conf).

The location of the confdir depends on your OS. See the confdir documentation for details.

Examples

Example agent config

[main]
certname = agent01.example.com
server = puppet
environment = production
runinterval = 1h

splay = true

Example master config

[main]
certname = puppetmaster01.example.com
server = puppet
environment = production
runinterval = 1h

strict_variables = true

[master]
dns_alt_names = puppetmaster01,puppetmaster01.example.com,puppet,puppet.example.com
reports = puppetdb
storeconfigs_backend = puppetdb
storeconfigs = true
environment_timeout = unlimited

Puppet uses four config sections:

  • main is the global section used by all commands and services. It can be overridden by the other sections.
  • master is used by the Puppet master service and the Puppet cert command.
  • agent is used by the Puppet agent service.
  • user is used by the Puppet apply command, as well as many of the less common Puppet subcommands.

Puppet prefers to use settings from one of the three application-specific sections (master, agent, or user). If it doesn‘t find a setting in the application section, it will use the value from main. (If main doesn‘t set one, it will fall back to the default value.)

来自 <https://docs.puppet.com/puppet/5.0/dirs_confdir.html>

puppet master

puppet client

/etc/puppetlabs/puppet/puppet.conf

Q:碰到的问题

Reason: puppet master 内存不够,默认JVM需要2G

A: 更改java vm内存设置

/etc/sysconfig/puppetserver

  1. Update the line:
    # Modify this if you‘d like to change the memory allocation, enable JMX, etc
    JAVA_ARGS="-Xms2g -Xmx2g"
    Replace 2g with the amount of memory you want to allocate to Puppet Server. For example, to allocate 1GB of memory, use JAVA_ARGS="-Xms1g -Xmx1g"; for 512MB, use JAVA_ARGS="-Xms512m -Xmx512m".
    For more information about the recommended settings for the JVM, see Oracle‘s docs on JVM tuning.
  2. Restart the puppetserver service after making any changes to this file.

#查询证书

puppet cert list --all


证书列表中有cs_agnet1的申请,目前是未审核状态(最前面没有+)。审核证书

#生成证书

puppet cert genarate <client DNS name>

#分配证书

puppet cert sign lux-vm32.gw.local

#启动 puppet agent

puppet agent --test

puppet agent -test --debug

puppet master

puppet module search <search_string>

puppet module search apaches

puppet module install <module name>

# puppet master --genconfig  #就会将master的所有配置选项都列出来,我们可以>到一个文件中,可以去查看其它的参数选项和介绍,但是实际情况我们并不需要如此全面的配置文件,只会用到很少的一部分,大部分的选项还是使用默认的。

时间: 2024-11-05 16:38:54

puppet5.1 安装与配置的相关文章

Windows下MySQL下载安装、配置与使用

用过MySQL之后,不论容量的话,发现比其他两个(sql server .oracle)好用的多,一下子就喜欢上了.下面给那些还不知道怎么弄的童鞋们写下具体的方法步骤. (我这个写得有点太详细了,甚至有些繁琐,有很多步骤在其他的教程文档里都是省略掉的,但我还是要写出来,因为我当时走了很多弯路,我希望你们能够避免我走的这些弯路.当然,知道同学的可以略过,选择你想知道的地方看) 第一大步:下载.(不需要注册也可以下载,直接点下面的no thanks) a.俗话说:“巧妇难为无米之炊”嘛!我这里用的是

Centos 7.3下 Linux For SQL Server安装及配置介绍

Centos 7.3下Linux For SQL Server安装及配置介绍 说到SQL Server服务,我们大家都知道是Microsoft公司的数据库服务,当然说到数据库,现在主要分为三大商:1:Oracle.2:Msql Server.3:Mysql:三种数据库在当下环境受到不了不同程度的关注:比如oracle主要应用到大型的商业比较多,比如银行:SQL Server主要在常见的互联网公司使用:mysql主要应用于小型的企业或者服务商使用:当然从费用上来说,Oracle是最贵的,也是最为稳

redis的单机安装与配置以及生产环境启动方案

简单介绍一下redis的单机安装与配置,方便自己记录安装步骤的同时方便他人获取知识. 首先,从官网下载最新版的(稳定版)的redis安装包.官网地址如下:https://redis.io/download 下载源码包后,redis需要编译安装.需要安装gcc和tcl,gcc用于编译tcl用于测试. 使用命令安装gcc,yum install gcc,一路选择yes,gcc就可以安装成功. 接下来安装tcl,首先获取tcl源码包(见百度云盘)或者使用命令:wget http://downloads

Tomcat安装与配置

进行Tomcat的安装与配置,得要jdk的支持,jdk的安装与配置就不说了,毕竟学Java第一步就是这个,所以以下步骤是已有jdk的情况下进行的 首先进入Tomcat的官网http://tomcat.apache.org/,会出现左侧Download一栏,选择自己需要的Tomcat版本,这里我选择的是Tomcat 7 点击进入后到达如下界面,选择自己所对应的系统下载对应的zip包(个人感觉下载zip包简介一点,当然也可以下载可执行文件) 注意下载到哪个地方,下载完成后得到压缩包 对此压缩包进行解

MongoDB 3.2 在CentOS 上的安装和配置

MongoDB 3.2 在CentOS 上的安装和配置 2016-01-06 14:41:41 发布 您的评价:       0.0   收藏     0收藏 一.安装 编辑/etc/yum.repos.d/mongodb-org-3.2.repo [mongodb-org-3.2] name=MongoDB Repository baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.2/x86_64/ gpg

Keepalived安装与配置

一.简介 Keepalived是一个免费开源的,用C编写的类似于layer3, 4 & 7交换机制软件,具备我们平时说的第3层.第4层和第7层交换机的功能.主要提供loadbalancing(负载均衡)和 high-availability(高可用)功能,负载均衡实现需要依赖Linux的虚拟服务内核模块(ipvs),而高可用是通过VRRP协议实现多台机器之间的故障转移服务. 上图是Keepalived的功能体系结构,大致分两层:用户空间(user space)和内核空间(kernel space

Linux下Nagios的安装与配置[转]

一.Nagios简介 Nagios是一款开源的电脑系统和网络监视工具,能有效监控Windows.Linux和Unix的主机状态,交换机路由器等网络设置,打印机等.在系统或服务状态异常时发出邮件或短信报警第一时间通知网站运维人员,在状态恢复后发出正常的邮件或短信通知. Nagios原名为NetSaint,由Ethan Galstad开发并维护至今.NAGIOS是一个缩写形式: "Nagios Ain't Gonna Insist On Sainthood" Sainthood 翻译为圣徒

烂泥:redis3.2.3安装与配置

本文由ilanniweb提供友情赞助,首发于烂泥行天下 想要获得更多的文章,可以关注我的微信ilanniweb 前一段时间写过一篇codis集群的文章,写那篇文章主要是因为当时的项目不支持redis自身集群的功能. 而现在最新的项目是需要redis集群的,这篇文章我们就来介绍下有关redis的安装与配置. 一.redis源码安装 截至到2016.8.11,redis最新稳定版本为3.2.3.本篇文章我们就以此版本为基础,进行相关的讲解. 下载redis源码,并进行相关操作,如下: wget ht

部署FIM 2010 R2&mdash;&mdash;6安装和配置PCNS

部署FIM 2010 R2--6安装和配置PCNS 在所有域控安装安装PCNS 1. 如果第一次安装PSNS需要扩展构架,如果之前安装过PCNS,略过此步骤,扩展构建需要在CMD进入PCNS安装目录中运行"Password Change Notification Service.msi" SCHEMAONLY=TRUE 下载PCNS安装包,首先在每台DC上扩展架构, msiexec /i "C:\Users\Administrator\Desktop\Password Cha