Puppet master nginx 扩展提升性能（puppet自动化系列4）

puppet使用SSL(https)协议来进行通讯，默认情况下，puppet server端使用基于Ruby的WEBRick HTTP服务器。由于WEBRick HTTP服务器在处理agent端的性能方面并不是很强劲，因此需要扩展puppet，搭建nginx或者其他强劲的web服务器来处理客户的https请求。

需要解决的问题：

  • 扩展传输方式：提高性能并增加Master和agent之间的并发连接数量。
  • 扩展SSL：采用良好的SSL证书管理方法来加密Master和agent之间的通讯。

Nginx+Passenger方式：

6.1 安装编译nginx所需要的开发包

[[email protected] ~]# groupadd -g 3001 nginx
[[email protected] ~]# useradd -u 3001 -g 3001 nginx
[[email protected] ~]# yum install ruby-devel gcc make pcre-devel zlib-devel openssl-devel pam-devel curl-devel rpm-build

6.2 安装passenger

最好是更换gem源，gem sources -a http://ruby.taobao.org

gem sources -u

gem install  rake rack passenger --no-rdoc --no-ri

6.3 编译并安装nginx

备注：主要是为了将模块passenger-config编译进来。

wget http://nginx.org/download/nginx-1.7.9.tar.gz

wget http://sourceforge.net/projects/pcre/files/pcre/8.36/pcre-8.36.tar.gz

[[email protected] ~]# cd /usr/local/src/nginx-1.7.9/
[[email protected] ~]# ./configure --user=nginx --group=nginx --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-pcre=/usr/local/src/pcre-8.36 --add-module=`passenger-config --root`/ext/nginx
[[email protected] ~]# make && make install

与passenger结合

备注：注意config.ru的属主和属组应该为puppet

[[email protected] ~]# mkdir  -p /etc/puppet/rack/public
[[email protected] ~]# cp /usr/share/puppet/ext/rack/config.ru  /etc/puppet/rack/public
[[email protected] ~]#  chown -R puppet. /etc/puppet/rack/

7、配置nginx（建议此处配置成虚拟主机）

备注：注意和puppet结合的证书名称及路径

情况一：直接passenger配置在nginx主配置文件

[[email protected] conf]# cat nginx.conf

user  nginx nginx;

worker_processes  1;

pid        /var/run/nginx.pid;

events {

worker_connections  1024;

}

http {

passenger_root /usr/lib/ruby/gems/1.8/gems/passenger-4.0.55;

passenger_ruby /usr/bin/ruby;

include       mime.types;

default_type  application/octet-stream;

sendfile        on;

keepalive_timeout  65;

server {

listen 8140                ssl;

server_name                puppetmaster;

passenger_enabled          on;

passenger_set_cgi_param    HTTP_X_CLIENT_DN $ssl_client_s_dn;

passenger_set_cgi_param    HTTP_X_CLIENT_VERIFY $ssl_client_verify;

proxy_buffer_size 4000k;

proxy_buffering on;

proxy_buffers 32 1280k;

proxy_busy_buffers_size 17680k;

client_max_body_size 10m;

client_body_buffer_size 4096k;

access_log /var/log/nginx/puppet_access.log;

error_log /var/log/nginx/puppet_error.log;

root /etc/puppet/rack/public;

#此处切记是public下，不是public的话passenger就不知道哪里去找 config文件，导致 *4 directory index of "/etc/puppet/rack/" is forbidden, client: 192.168.122.1, server: pm01.jq.com, request: "GET / HTTP/1.1", host: "pm01.jq.com:8140"

ssl off;

ssl_session_timeout 5m;

ssl_certificate /var/lib/puppet/ssl/certs/puppetmaster1.jq.com.pem;

ssl_certificate_key /var/lib/puppet/ssl/private_keys/puppetmaster1.jq.com.pem;

ssl_client_certificate /var/lib/puppet/ssl/certs/ca.pem;

ssl_crl /var/lib/puppet/ssl/ca/ca_crl.pem;

ssl_verify_client optional;

ssl_ciphers SSLv2:-LOW:-EXPORT:RC4+RSA;

ssl_prefer_server_ciphers on;

ssl_verify_depth 1;

ssl_session_cache shared:SSL:128m;

# File sections

location /production/file_content/files/ {

types { }

default_type application/x-raw;

alias /etc/puppet/files/;

}

}

include vhosts/*.conf;

}

 
情况二、passenger配置成虚拟机主机，配置如下：
[[email protected] conf]# cat nginx.conf
user  nginx nginx;
worker_processes  1;
 
#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;
pid        /var/run/nginx.pid;
events {
    worker_connections  1024;
}
 
 
http {
    passenger_root /usr/local/lib/ruby/gems/1.9.1/gems/passenger-4.0.57/;
    passenger_ruby /usr/local/bin/ruby;
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    server {
        listen       8088;
        server_name  localhost;
        location / {
            root   html;
            index  index.html index.htm;
        }
 
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
 
 
    }
 
    include vhosts/*.conf;
}
虚拟主机配置
[[email protected] conf]# cat vhosts/passenger.conf 
    server {
        listen 8140                ssl;
    server_name                pm01;
    passenger_enabled          on;
    passenger_set_cgi_param    HTTP_X_CLIENT_DN $ssl_client_s_dn;
    passenger_set_cgi_param    HTTP_X_CLIENT_VERIFY $ssl_client_verify;
    proxy_buffer_size 4000k;
    proxy_buffering on;
    proxy_buffers 32 1280k;
    proxy_busy_buffers_size 17680k;
    client_max_body_size 10m;
    client_body_buffer_size 4096k;
    access_log /var/log/nginx/puppet_access.log;
    error_log /var/log/nginx/puppet_error.log;
    root /etc/puppet/rack/public;
    ssl off;
    ssl_session_timeout 5m;
    ssl_certificate /var/lib/puppet/ssl/certs/pm01.jq.com.pem;
    ssl_certificate_key /var/lib/puppet/ssl/private_keys/pm01.jq.com.pem;
    ssl_client_certificate /var/lib/puppet/ssl/certs/ca.pem;
    ssl_crl /var/lib/puppet/ssl/ca/ca_crl.pem;
    ssl_verify_client optional;
    ssl_ciphers SSLv2:-LOW:-EXPORT:RC4+RSA;
    ssl_prefer_server_ciphers on;
    ssl_verify_depth 1;
    ssl_session_cache shared:SSL:128m;
    # File sections
    location /production/file_content/files/ {
      types { }
      default_type application/x-raw;
      alias /etc/puppet/files/;
  }
 }
 
 
 
 

配置puppet.conf

[[email protected]1 ~]# vim /etc/puppet/puppet.conf 
[master]
    certname = puppetmaster
    ca       = false
    ssl_client_verify_header = HTTP_X_CLIENT_VERIFY
    ssl_client_header = HTTP_X_CLIENT_DN

8、启动nginx

[[email protected] gem]# mkdir /var/log/nginx/
[[email protected] nginx-1.4.2]# /etc/init.d/puppetmaster stop
[[email protected] nginx-1.4.2]# chkconfig puppetmaster off
[[email protected] nginx-1.4.2]# /etc/init.d/nginx start
[[email protected] nginx-1.4.2]# chkconfig nginx on

9、测试

在多个节点发起puppet agent -t命令动作，查看nginx日志看nginx+passenger是否代理成功。

[[email protected] ~]# puppet  agent -t
[[email protected] ~]# tailf  /var/log/nginx/puppet_access.log
时间： 2024-08-26 16:08:09

Puppet master nginx 扩展提升性能（puppet自动化系列4）的相关文章

Advacned Puppet: Puppet Master性能调优

本文是Advanced Puppet系列的第一篇:Puppet master性能调优,谈一谈如何优化和提高C/S架构下master端的性能. 故事情节往往惊人地类似:你是一名使用Puppet管理线上业务的DevOps工程师,随着公司的业务发展,你所管理的集群规模日益扩大.终于某一天,你突然发现执行一次puppet agent -vt的时间长得不可接受,多台agent并发运行时竟然会有节点运行失败,往日从来没有考虑过Puppet的性能居然成为了瓶颈……首先要恭喜你,因为Puppet Master端

Nginx对(apache+foreman+puppet)负载均衡

Nginx对(apache+foreman+puppet)负载均衡 一.前提准备 试验环境: OS:Centos 6.5_x86 puppet-server-3.8.3 foreman-1.9.2 foreman-proxy-1.9.2 httpd-2.2.15 服务器已经搭建好了apache+foreman+puppet详情请参考: http://4709096.blog.51cto.com/4699096/1710697 二.修改pupeptmaster相关配置 2.1修改puppetmas

nginx结合多套puppet实现(apach+forman+puppt)

nginx结合多套puppet实现(apach+forman+puppt) 本案例是将多套puppet服务端(puppet+apache+foreman+foreman-proxy)系统,利用nginx负载均衡实现统一服务的功能.其中用到的puppet+apache+foreman+foreman-proxy配置和nginx+puppet配置等内容可以参考本人前面的相关文章. 这里以2套为例,它们的信息如下: 软件信息:Centos6.5 x86_64,puppet3.8.3,foreman1.

puppet初始化安装和配置（puppet自动化系列1）

一.服务器规划 以下均直接yum安装最新版. 服务器操作系统为centos6.2 Puppetmaster1 10.168.32.116 puppstmaster1.jq.com Puppetmaster2 10.168.32.117 puppetmaster2.jq.com Puppet1 10.168.32.120 ag1.jq.com Puppet2 10.168.32.121 ag2.jq.com Puppetca1 10.168.32.118 puppetca1.jq.com Pupp

Puppet Master安裝手冊（CentOS 7）

Puppet Master安装 注意:Puppet Master不支持Windows平台,Puppet Agent支持Windows,但不是很理想. 因为foreman最低要求CentOS 6,所以建议使用6以上版本或使用Ubuntu 10以上版本.   本篇以CentOS 7为例安装Puppet Master   1．系统准备工作: 最小化安装CentOS 7, # yum update                                                      

puppet管理nginx

一:介绍 puppet管理nginx主机,将nginx主机加入到puppet中,实现自动安装.配置.和启动服务 二:nginx模块结构 [[email protected] modules]# tree /etc/puppet/modules/nginx/ /etc/puppet/modules/nginx/ ├── files ├── manifests │   ├── conf.pp │   ├── init.pp │   └── install.pp └── templates      

puppet插件fact和hiera（puppet自动化系列3）

四.Fact插件 4.1 使用pluginsync进行发布 这种方法比较特殊,节点factpath目录里除了编写好的rb文件之外,还需要在puppet模块中引用,运行一次之后才会转换成fact.通常在puppetmaster端模块里的lib库中添加,然后在puppet.conf中添加选项pluginsync=true即可,格式为ruby文件. 4.2 创建模块facts [[email protected] ~]# cd /etc/puppet/environments/jqprd/enviro

Puppet master/agent installation on RHEL7

======================================================================================================================================================master      172.31.10.249         linux1       linux1.test.comagent        172.31.10.220         lin

如何基于Python构建一个可扩展的运维自动化平台

嘉宾简介 刘天斯 从事互联网运维工作已13年,目前就职于腾讯-互动娱乐部,负责游戏大数据的运营,曾就职于天涯社区,担任首席架构师/系统管理员. 热衷开源技术的研究,包括系统架构.运维开发.负载均衡.缓存技术.数据库.NOSQL.分布式存储.消息中间件.大数据及云计算.Mesos.Docker.DevOps等领域.擅长大规模集群的运维工作,尤其在自动化运维方面有着非常丰富的经验.同时热衷于互联网前沿技术的研究,活跃在国内社区.业界技术大会,充当一名开源技术的传播与分享者. 导言 受 Reboot