Mud: puppet3.7 installation and configuration, mud puppet3.7 Configuration

Mud: puppet3.7 installation and configuration, mud puppet3.7 Configuration

This article was sponsored by Xiuyi linfeng and first launched in the dark world.

I have never touched on automatic server management before. I plan to add this knowledge during this time.

Currently, puppet is the most popular automated server management software.

So today we are playing a leading role in puppet. Perform the following steps:

1. What is puppet?

2. Advantages of puppet

3. Installation preparation

4. Prepare the environment

5. Install puppet with source code

6. Install puppet with RPM

7. puppet certificate authorization

8. puppet Resources

I. What is puppet?

Puppet is a centralized configuration management system developed based on ruby on Lnux, Unix, and windows platforms. It uses its own puppet Description Language to manage system entities such as the configuration file, user, cron task, software package, and system service.

Puppet calls these system entities resources. puppet is designed to simplify the management of these resources and properly handle dependencies between resources.

Puppet depends on the deployment architecture of C/S (Client/Server. It needs to install the puppet-server Software Package (master) on the puppet server, and install the puppet client software (agent) on the target host to be managed ).

After the agent is connected to the master, the configuration file defined on the master side will be compiled and then run on the agent. By default, each agent connects to the master once every 30 minutes to confirm Configuration updates. However, this method does not meet the requirements of the system administrator in many scenarios. Therefore, many system administrators manage the agent through crontab (Task Plan), which is more flexible.

Ii. Advantages of puppet

Puppet syntax allows you to create a separate script to create a user on all your target hosts. All target hosts use the syntax suitable for the local system to explain and execute this module in sequence. If this configuration is executed on the Red Hat server, create a user using the useradd command. If this configuration is executed on the FreddBSD server, use the adduser command.

Another outstanding aspect of puppet is its flexibility. Because of the nature of open-source software, you can freely obtain the source code of puppet. If you encounter a problem and have the ability to handle it, you can modify or enhance the puppet Code so that it applies to your environment and then solve the problem.

Puppet is also easy to expand. The support functions and special system environment configurations of customized software packages can be quickly and easily added to puppet installation programs.

Iii. Installation preparation

In this experiment, the OS is centos 6.5 64bit, the server is 192.168.199.247, and the client is 192.168.199.248.

Before the formal experiment, we have several things to do first.

3.1Host Time Synchronization

To reduce unnecessary troubles during the experiment, we need to synchronize time between all hosts (including servers and clients. That is, the time difference between the server and the client cannot exceed seconds.

Run the following command to synchronize time:

Ntpdate timekeeper.isi.edu

If the following error occurs during time synchronization:

21 Jan 17:20:45 ntpdate [2720]: the NTP socket is in use, exiting

Disable the ntpd service of the host before synchronizing time.

/Etc/init. d/ntpd stop

3.2Modify host name

When puppet is installed, the host name is written into the certificate, and the certificate is required for communication between the client and the server. Therefore, you need to modify the Host Name of the server and client.

Modify the host name. As follows:

Hostname s.ilanni.com

Run this command to make the host name take effect immediately. However, after the server is restarted, the modification will become invalid.

If the host name takes effect permanently, modify the/etc/sysconfig/network file. As follows:

Cat/etc/sysconfig/network

In this experiment, we will not build a DNS server, but directly modify the hosts file of the server and client to resolve the domain name. As follows:

Cat/etc/hosts

192.168.199.247 s.ilanni.com

192.168.199.248 c.ilanni.com

3.3Disable iptables and selinux

All our current experiments are conducted under the disable iptables and selinux.

/Etc/init. d/iptables status

Cat/etc/selinux/config

IV,Environment preparation

Puppet installation can be divided into source code installation and RPM installation. However, no matter which installation method, we need to describe it before installation.

4.1 puppetInstallation instructions

1. Since puppet is developed using the ruby language, we must first install the ruby language environment whether it is source code or RPM installation.

2. puppet Versions later than version 2.7 require hiera support. Therefore, you must install hiera.

3. In the previous chapter, we explained that puppet is a configuration management system, and the resources managed are system entities. But how did these entities come from? In this case, we need to install another resource collection software-facter.

Facter is mainly used to collect host information, such as CPU and Host IP address. Facter sends the collected information to the puppet server. The server can generate different puppet configuration files for different nodes based on different conditions.

Facter is also developed in ruby. We can see this in the installation document of facter, as shown below:

Cat README. md

4.2Install ruby

Ruby is easy to install. Here we use yum for installation. As follows:

Yum-y install ruby

After ruby is installed, we can view the generated file. As follows:

Rpm-ql ruby

You can view the help information of ruby as follows:

Ruby-h

In addition, we also need to install the ruby-rdoc package. This software package is mainly used to view the help documentation of ruby. As follows:

Yum-y install ruby-rdoc

The above are ruby-related software packages. After installation, we will start to install facter.

4.3Install facter

We can download facter from puppet official website, as shown below:

Http://downloads.puppetlabs.com/facter/

Note: facter can also be installed through yum. Here we use the source code for installation.

Download the latest facter version as follows:

Wget http://downloads.puppetlabs.com/facter/facter-2.3.0.tar.gz

Decompress the facter package as follows:

Tar-xf facter-2.3.0.tar.gz

Start to install facter as follows:

Ruby install. rb or./install. rb

After the facter is installed, let's check the help of facter. As follows:

Facter-h

If you want to view the Detailed Help information of facter, you can also use man to describe facter. As follows:

Man facter

If the installation is correct, the information collected by the facter is displayed after the facter command is executed. As follows:

Facter

4.4Install hiera

Hiera is mainly used to control the changing values of some agents. It must be installed in Versions later than puppet2.7. If you do not install puppet, the following error is prompted:

Cocould not load hiera; cannot install

However, before installing hiera, We must install additional yum sources. Otherwise, the system will prompt that the software package cannot be found.

This yum source is available on the official puppet website. As follows:

Https://docs.puppetlabs.com/guides/puppetlabs_package_repositories.html#for-red-hat-enterprise-linux-and-derivatives

Install puppet on the official website. As follows:

Rpm-ivh http://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm

After yum source configuration is complete, we will install hiera now. As follows:

Yum-y install hiera

After the above installation is complete, we can officially install puppet.

V. Install puppet with source code

PuppetThe source code of the server and the client is installed using the same software package. The installation steps are the same, but there are slight differences in the configuration file.

Before downloading the puppet source code, we also need to create the puppet user for running puppet on the master and agent. If the master node is not created, the following error is reported when the master node is started:

Create a puppet user as follows:

Useradd-M-s/sbin/nologin puppet

Cat/etc/passwd | grep puppet

Note: The puppet server is run by the puppet user, while the puppet client is run by the root user.

The purpose of this operation is: the master runs securely on the server as a normal user, while the agent runs as a root user on the client because the master creates users and modifies system files and other resources, you must have the highest permissions.

5.1 puppetSource code Installation

The puppet source code package can be downloaded from the puppet official website. The latest puppet version is 3.7.3:

Http://downloads.puppetlabs.com/puppet/

Download the puppet software package. As follows:

Wget http://downloads.puppetlabs.com/puppet/puppet-3.7.3.tar.gz

Decompress the puppet package as follows:

Tar-xf puppet-3.7.3.tar.gz

The Installation Method of puppet is the same as that of facter, as shown below:

Ruby install. rb or./install. rb

After puppet is installed, let's check its help information, as shown below:

Puppet help

Check the installation location of puppet as follows:

Ll/etc/puppet/

The above is the installation of puppet. Let's configure puppet now.

5.2 masterEnd Configuration

After puppet is installed, configure the master. Copy the puppet. conf file under the ext/redhat/directory of the puppet source package to the puppet installation directory/etc/puppet/, as shown below:

Cp ext/redhat/puppet. conf/etc/puppet/

Vi/etc/puppet. conf

Server = s.ilanni.com

Certname = s.ilanni.com

Pluginsync = false

S.ilanni.com indicates the Host Name of the puppet server.

Pluginsync = false indicates that the plug-in function in the module is disabled.

After the configuration file is modified, configure the master STARTUP script.

Copy the server. init file in the ext/redhat/directory of the puppet source package to/etc/init. d/and rename it puppetmaster. Then grant the puppetmaster executable permission. As follows:

Cp ext/redhat/server. init/etc/init. d/puppetmaster

Chmod u + x/etc/init. d/puppetmaster

Note: The master can also be started using the puppet master command. As follows:

Puppet master

Netstat-tunlp | grep "8140"

Ps aux | grep puppet

In fact, the puppetmaster STARTUP script is started using the puppet master Command, as follows:

Cat/etc/init. d/puppetmaster

Add puppetmaster to the startup Item. As follows:

Chkconfig -- add puppetmaster

Chkconfig puppetmaster on

Chkconfig | grep puppetmaster

After the above configurations are complete, we will start the puppet Service as follows:

/Etc/init. d/puppetmaster start

Ps aux | grep puppet

Netstat-tunlp

Through this, we can use port 8140 of the TCP protocol for the puppet service and use the puppet user during runtime.

After the puppet server is configured, We will configure the puppet client.

5.3 agentEnd Configuration

To configure the agent, you only need to copy the puppet. conf file to the puppet installation directory/etc/puppet/, as shown below :.

Cp ext/redhat/puppet. conf/etc/puppet/

Cat/etc/puppet. conf

Server = s.ilanni.com

Pluginsync = false

S.ilanni.com indicates the Host Name of the puppet server.

Pluginsync = false indicates that the plug-in function in the module is disabled.

Run the puppet agent Command to start the agent. As follows:

Puppet agent

Ps aux | grep puppet

We can also see that the user used for running the agent is root, rather than puppet.

Note: On the agent side, we use the puppet agent Command for various management operations, including certificate application and resource synchronization.

AgentYou can run the command in two ways: the first is to connect the command to the master, and the second is to run in the system background in the form of a daemon. By default, the master is connected every 30 minutes, however, this is not flexible. We generally use the first method and use it with crontab.

Vi. Installing puppet with RPM

The RPM installation of puppet is relatively simple. We only need to install puppet in yum. As follows:

6.1 puppetInstallation preparation

Before using RPM for installation, We need to configure an additional yum source. Otherwise, the system will prompt that the puppet software package cannot be found. As follows:

Yum-y install puppet-server

Install an additional yum source. We can find the yum source on puppet's official website. As follows:

Https://docs.puppetlabs.com/guides/puppetlabs_package_repositories.html#for-red-hat-enterprise-linux-and-derivatives

Install puppet on the official website. As follows:

Rpm-ivh http://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm

Note: The yum source must be configured on both the master side and the agent side.

6.2 masterTerminal installation and configuration

Now yum is used to install the master, as follows:

Yum-y install puppet-server

We can see that the installation of puppet-server depends on three software packages: facter, hiera, and puppet.

Now let's check the new users created during puppet-server installation and the users used during puppet service running, as shown below:

Cat/etc/passwd

Ps aux | grep puppet

Through this, we can see that the puppet-server did create a user puppet during installation, and the puppet users used during running.

View the port used by the puppet Service as follows:

/Etc/init. d/puppetmaster start

Netstat-tunlp

After the master is installed, We will configure the puppet service configuration file, which is the same as the source code installation method. As follows:

Vi/etc/puppet. conf

Server = s.ilanni.com

Certname = s.ilanni.com

Pluginsync = false

6.3 agentTerminal installation and configuration

After the master is installed, We will install the agent as follows:

Yum-y install puppet

The puppet client installed by RPM is installed in the same way as the source code. Now let's start the puppet client. As follows:

We can see that the puppet user is also created during agent installation, but the root user is used instead of the user when puppet is running. This corresponds to the source code installation.

After the agent is installed, configure the agent configuration file, which is the same as the source code installation method. As follows:

Vi/etc/puppet. conf

Server = s.ilanni.com

Pluginsync = false

VII. puppet certificate authorization

We know that puppet uses ssl tunnel communication for security purposes. Therefore, you need to apply for a certificate for verification.

7.1 masterClient certificate Initialization

When the master is started for the first time, you can view the following information in the/var/log/message log file:

Tail-f/var/log/messages

Jan 23 06:39:03 localhost puppet-master [1622]: Signed certificate request for ca

Jan 23 06:39:04 localhost puppet-master [1622]: s.ilanni.com has a waiting certificate request

Jan 23 06:39:04 localhost puppet-master [1622]: Signed certificate request for s.ilanni.com

Jan 23 06:39:04 localhost puppet-master [1622]: Removing file Puppet: SSL: CertificateRequest s.ilanni.com at '/var/lib/puppet/ssl/ca/requests/s.ilanni.com. pem'

Jan 23 06:39:04 localhost puppet-master [1622]: Removing file Puppet: SSL: CertificateRequest s.ilanni.com '/var/lib/puppet/ssl/certificate_requests/s.ilanni.com. pem'

Jan 23 06:39:04 localhost puppet-master [1634]: Reopening log files

Jan 23 06:39:04 localhost puppet-master [1634]: Starting Puppet master version 3.7.3

From the log, we can see that when the master is started for the first time, the puppet service will create an authentication center in the Local Machine to grant the certificate and key to itself, we can see the certificates and keys in/var/lib/puppet/ssl. As follows:

Ll/var/lib/puppet/ssl

This directory is related to the ssldir path configured in the/etc/puppet. conf file.

You can also view the certificate files authorized by the master, as shown below:

Ll/var/lib/puppet/ssl/ca/signed

7.2 agentClient Certificate Application

When the agent connects to the master for the first time, it will apply for a certificate from the master. If the master side does not grant an agent certificate, the connection between the agent side and the master side will not be established successfully.

At this time, the agent will continue to wait for the master to authorize the certificate, and will check whether the master side issues the certificate every 2 minutes.

We now use puppet agent -- server s.ilanni.com to connect to the master, as shown below:

Puppet agent -- server s.ilanni.com

7.3 masterClient Authorization Certificate

After applying for a certificate on the agent end, we need to switch to the master end and use the puppet cert command to authorize the certificate on the agent end.

For the usage of puppet cert, we can view the help information of puppet cert. As follows:

Pupper cert

In, puppet cert has provided an example of how to grant an authorization certificate to an agent.

Now let's check which hosts on the master side are applying for certificates, as shown below:

Puppet cert list

We can see that the c.ilanni.com client is applying for a certificate.

Now let's authorize the certificate to the agent. Run the following command:

Puppet cert sign c.ilanni.com

Note: If the number of clients in the actual production environment is large, we can authorize all certificates at one time. As follows:

Puppet cert sign -- all

View All authenticated agents on the master side, as shown below:

Puppet cert-all

Now let's take a look at the certificate files authorized by the master to the agent, as shown below:

Ll/var/lib/puppet/ssl/ca/signed

We can see that the certificate file of the master-authorized client c.ilanni.com is c.ilanni.com. pem.

7.4View the agent certificate

After the master-side authorization is complete, we now switch to the agent side to view the authorization certificate file, as shown below:

Ll/var/lib/puppet/ssl/certs

We can see that the certificate file c.ilanni.com. pem on the agent side is the same as the certificate file on the master side.

7.5 puppetCertificate Problems

In the actual production environment, the host name of the agent that has passed the master authentication may be modified or some other misoperations may occur, resulting in the failure of the agent to communicate with the master.

In this case, the general solution is to first Delete the authentication files on the master and agent, and then apply for a new certificate on the agent.

The procedure is as follows:

On the agent side, delete the/var/lib/puppet/ssl directory as follows:

Rm-fr/var/lib/puppet/ssl

On the master side, delete the certificate files under the/var/lib/puppet/ssl/ca/signed directory, as shown below:

Rm-fr/var/lib/puppet/ssl/ca/signed/c.ilanni.com. pem

After the preceding operations, the agent can apply for a certificate again.

VIII. puppet Resources

After the puppet environment is set up, we will introduce the puppet resources.

8.1 puppetResource Type and help

Puppet resources. We can use related commands to view the types of resources supported by puppet.

Through the previous chapter, we know that puppet supports subcommands for queries. As follows:

Puppet help ca

View the types of resources supported by puppet. As follows:

Puppet describe -- list

You can also use the puppet resource -- type command to query, as shown below:

Puppet resource -- type

We can see that puppet supports most resources such as user, file, and crontab.

If you want to view user resources, we will continue to use the puppet describe user command to view them. As follows:

Puppet describe user

To view the usage of a user in the puppet site. pp file, run the following command:

Puppet resource user

We can see that puppet has provided an example of user usage. You only need to follow this example.

Note: If the puppet describe help does not show the usage details of this resource on the site. pp site, we can go to puppet resource to view it.

This example uses the user resource as an example. If you want to view the help of the host resource, you can also use a similar Command, as shown below:

Puppet resource host

If you do not want to view it on your local machine, you can also go to the puppet official website to view it, as shown below:

Https://docs.puppetlabs.com/references/latest/type.html

8.2 puppetResource Configuration File

The puppet resource configuration file is in the/etc/puppet/manifests directory of the server. We need to create a site file site. pp under this directory.

In this file, we create resources that need to be synchronized to the agent, as shown below:

Cat/etc/puppet/manifests/site. pp

Node default {

File {"/tmp/test.txt ":

Content => "Hello, ilanni, this is puppet test! \ N "}

}

The preceding command creates a default node in the puppet resource configuration file and uses the file resource to create test.txt in the/tmp/directory of the agent. The content is Hello, ilanni, this is puppet test! \ N

Note: \ n indicates a line break. If \ n is not added, the file content is displayed as follows:

At the same time, after the site. pp file is created, we need to restart the master, as shown below:

/Etc/init. d/puppetmaster restart

Switch to the agent to synchronize the resource as follows:

Puppet agent -- test -- server s.ilanni.com

We can see that the agent has synchronized the resources of the master to the local machine.

Now let's check that the agent/tmpdirectory contains the file test.txt. As follows:

Cat/tmp/test.txt

We can see that the agent has indeed synchronized resources to the master. The/tmpdirectory contains the file test.txt, And the content is indeed the same as that of the master.

Now we have finished the setup and configuration of puppet3.7. The next article will introduce the resources for puppet synchronization in the production environment.