Puppet Automation Management

Puppet
I. Prerequisite work
1. Information
Ali, Flying 5k
Http://puppet.wikidoc.com
Front-end management system
Keepcache=1 Save Package
2. Environment
redhat6.4
Host: 192.168.2.100 server100.example.com server
Host: 192.168.2.103 server103.example.com client
Host: 192.168.2.113 server113.example.com client
Each host resolves to each other
* Iptables-f
* Getenforce is Disabled
* Date
* Yum Source configuration (network installation, OK to surf the internet) 100,103,113 host Yum as follows
*vim/etc/yum.repos.d/rhel-source.repo
[Rhel-source]
name=red Hat Enterprise Linux $releasever-$basearch-source
baseurl=ftp://192.168.2.251/pub/rhel6.5
Enabled=1
Gpgcheck=1
Gpgkey=file:///etc/pki/rpm-gpg/rpm-gpg-key-redhat-release
[Puppet]
Name=puppet
baseurl=http://yum.puppetlabs.com/el/6server/products/x86_64/
Gpgcheck=0
[Ruby]
Name=ruby
baseurl=http://yum.puppetlabs.com/el/6server/dependencies/x86_64/
Gpgcheck=0
3. Installation
On the 100 host server
* Yum Install-y Puppet-server
Error:package:rubygem-json-1.5.5-1.el6.x86_64 (Ruby)
Requires:rubygems
Here's how to resolve the error and dependencies:
Download rubygems-1.8.16-1.el6.noarch.rpm
* Yum Localinstall-y rubygems-1.8.16-1.el6.noarch.rpm
Client on 103 and 113 hosts
* Yum install-y Puppet
Troubleshoot error and dependencies below download rubygems-1.8.16-1.el6.noarch.rpm
* Yum Localinstall-y rubygems-1.8.16-1.el6.noarch.rpm
4. Turn on the puppet service on the 100 host
* TOUCH/ETC/PUPPET/MANIFESTS/SITE.PP
Note: Create a file site.pp to open the service puppetmaster
*/etc/init.d/puppetmaster Start
You can use the command to see if Port 8140 is turned on: Netstat-antlpe

Two. Manual signature and automatic signature
1. Manual signature (client side issue request, Server manual visa)
* 103 Client-side request: Puppet agent--server server100.example.com--no-daemonize--verbose
Info:caching Certificate for CA
Info:csr_attributes File Loading From/etc/puppet/csr_attributes.yaml
Info:creating a new SSL certificate request for Server103.example.com
Info:certificate Request Fingerprint (SHA256):
54:d4:a2:ad:44:95:57:b0:f7:5e:74:8b:5b:9e:5b:e2:91:95:75:a7:b8:78:0e:c8:63:87:ac:d0:c
f:98:71:2c
After this information must be present: The visa is not allowed on the 100 host
* listed on the 100 Host: Puppet cert list
"Server103.example.com" (SHA256)
54:d4:a2:ad:44:95:57:b0:f7:5e:74:8b:5b:9e:5b:e2:91:95:75:a7:b8:78:0e:c8:63:87:ac:d0:c
f:98:71:2c
* Visa on 100 Host: Puppet cert sign server103.example.com
* Wait for a while on the 103 host, results: Notice:finished catalog run in 0.10 seconds
After: Ctrl + C
2. Automatic signature (client side makes the request, the server side automatically carries out the visa)
* vim/etc/puppet/puppet.conf on the 100 host
Note Write under Main
[Main]
Autosign = True
* vim/etc/puppet/autosign.conf on the 100 host
*.example.com
*/etc/init.d/puppetmaster on the 100 host reload
* Verify the Automatic visa on the 113 host (no action is required on server side) puppet Agent--server
Server100.example.com--no-daemonize--verbose
Three. Resource definition
Note: Resources are defined in the/etc/puppet/manifest/site.pp file
1. File definition
* On the 100 host: vim/etc/puppet/manifests/site.pp
file {"/tmp/test.file":
Content = "www.westos.org", note: If you have more than one parameter, use "," to separate
mode = 600
}
Test on a 103 host
* on 103 host: Puppet agent--server server100.example.com--no-daemonize--verbose
Notice:/stage[main]/main/file[/tmp/test.file]/ensure:defined content as ' {md5d93485f9ba96d89495f1c3f6583ad624 '
notice:finished catalog run in 0.16 seconds
* Check results on 103 hosts: Cat/tmp/test.file
www.westos.org
Note 1:
On the 103 host;/tmp/test.file instead: server103.example.com,
Execute again: Puppet agent--server server100.example.com--no-daemonize--verbose
Result:/tmp/test.file content: www.westos.org
Conclusion: The/tmp/test.file content is subject to the server side
NOTE 2:
Whether the file was modified according to: MD5 d93485f9ba96d89495f1c3f6583ad624
Different files, MD5 encryption string
Md5sum/tmp/test.file//Use md5sum to view encrypted characters
2. Define package Service specify profile to open service on 100 host
Note: 1) It's OK to identify the client's Yum
2) content added in file fileserver.conf with content in site.pp file
* Cat fileserver.conf
[File configuration domain]
Path/etc/puppet/files
Allow *.example.com
* Cat SITE.PP
file {"/temp/vsftpd.conf":
Source = puppet:///file configuration domain/files
}
3) The order in the server-side site.pp file is: Install package, config file, open service
The order in which client side executes is: Install package, open Service, config file
The above is problematic because the configuration file is not in effect
* 192.168.2.2 copied to 100 host: SCP httpd.conf [Email protected]:/etc/puppet/files/
* vim/etc/puppet/files/httpd.conf
In order to test the modified file, see if the client is a modified
Order Allow,deny
Allow from 192.168.2.2
* Mkdir/etc/puppet/files
* vim/etc/puppet/fileserver.conf
[Httpdconf]
Path/etc/puppet/files
Allow *.example.com
* VIM/ETC/PUPPET/MANIFESTS/SITE.PP
Package {
"HTTPd":
ensure = installed,
Allow_virtual = False
}
File {
"/etc/httpd/conf/httpd.conf":
Source = "puppet:///httpdconf/httpd.conf" explanation "puppet://" means puppet server, quite "httpd://"
}
Service {
"HTTPd":
ensure = running}
*/etc/init.d/puppetmaster Reload
Test on the 103 host
* Puppet agent--server server100.example.com--no-daemonize--verbose//execute 2 times first will error,
But the installation httpd successful
* file is the same as server settings cat/etc/httpd/conf/httpd.conf
Order Allow,deny
Allow from 192.168.1.2
3. Define the user on the 100 host
* VIM/ETC/PUPPET/MANIFESTS/SITE.PP
User {
"user1": uid = 800,
Provider = Useradd,
Managehome = True,
ensure = present,
Password = Westos
}
Test on the 103 host
* Puppet agent--server server100.example.com--no-daemonize--verbose
* ID User1
* Ll/home/user1
* Vim/etc/shadow
User1:westos:16291:0:99999:7:::
4. Define file system mounts on 100 hosts
* VIM/ETC/PUPPET/MANIFESTS/SITE.PP
File {
"/public":
ensure = Directory
}
Mount {
"/public":
device = "192.168.2.251:/var/ftp/pub",
Fstype = "NFS",
options = "Defaults",
ensure = mounted
}
Test on the 103 host
* Determine the following before testing:
Install on 103 host: Mount.nfs (yum install-y mount.nfs or install nfs-utils)
On the 192.168.2.251 host: showmount-e Result:/var/ftp/pub/* (RO)
On the 192.168.2.251 host:/etc/init.d/nfs start
* Puppet agent--server server100.example.com--no-daemonize--verbose
5. Define the crontab task on the 100 host
* VIM/ETC/PUPPET/MANIFESTS/SITE.PP
Cron {
Echo
Command = "/bin/echo '/bin/date ' >>/tmp/echo",
user = root,
hour = [' 2-4 '],
minute = ' */10 '
Test on the 103 host
* Confirm before testing:
On the 103 host:/etc/init.d/crond start
* Puppet agent--server server100.example.com--no-daemonize--verbose
* Crontab-l results are as follows://can also be found in directory: Cat/var/spool/cron/root view
# header:this file was autogenerated at Sat 14:47:13 +0800 by puppet.
# Header:while It can still be managed manually, it's definitely not recommended.
# Header:note particularly that the comments starting with ' Puppet Name ' should
# Header:not is deleted, as doing so could cause duplicate cron jobs.
# Puppet Name:echo
*/10 2-4 * * */bin/echo '/bin/date ' >>/tmp/echo
Four. Definition of different nodes
1. On the 100 host
* Mkdir/etc/puppet/manifests/nodes
* CP/ETC/PUPPET/MANIFESTS/SITE.PP/ETC/PUPPET/MANIFESTS/NODES/SERVER103.PP
* CP/ETC/PUPPET/MANIFESTS/SITE.PP/ETC/PUPPET/MANIFESTS/NODES/SERVER113.PP
* VIM/ETC/PUPPET/MANIFESTS/NODES/SERVER103.PP
Node ' server103.example.com ' {
Package {
"HTTPd":
ensure = installed,
Allow_virtual = False
}
File {
"/etc/httpd/conf/httpd.conf":
Source = "Puppet:///httpdconf/httpd.conf"
}
Service {
"HTTPd":
ensure = Running
}
User {
"user1": uid = 800,
Provider = Useradd,
Managehome = True,
ensure = present,
Password = Westos
}
}
* VIM/ETC/PUPPET/MANIFESTS/NODES/SERVER113.PP
Node ' server113.example.com ' {
Package {
"HTTPd":
ensure = installed,
Allow_virtual = False
}file {
"/etc/httpd/conf/httpd.conf":
Source = "Puppet:///httpdconf/httpd.conf"
}
Service {
"HTTPd":
ensure = Running
}
User {
"user1": uid = 800,
Provider = Useradd,
Managehome = True,
ensure = present,
Password = Westos
}
}
* VIM/ETC/PUPPET/MANIFESTS/SITE.PP
Import "NODES/SERVER103.PP"
Import "NODES/SERVER113.PP" or
Import "*.PP"
Test on 103 and 113 hosts
* on 103 host: Puppet agent--server server100.example.com--no-daemonize--verbose
* on 113 Host: Puppet agent--server server100.example.com--no-daemonize–verbose
Five. Module
On the 100 host
* Mkdir-p/etc/puppet/modules/vsftpd/{files,manifests,templates}
* VIM/ETC/PUPPET/MODULES/VSFTPD/MANIFESTS/INSTALL.PP
Class Vsftpd::install {
Package {"VSFTPD":
ensure = present,
Allow_virtual = False
}
}
* VIM/ETC/PUPPET/MODULES/VSFTPD/MANIFESTS/CONFIG.PP
Class Vsftpd::config {
file {"/etc/vsftpd/vsftpd.conf":
ensure = present,
Source = "Puppet:///modules/vsftpd/vsftpd.conf",
#source = "puppet:///file configuration domain/modules/vsftpd/files/vsftpd.conf",
mode = 0600,
Note: #实际路径在/etc/puppet/modules/vsftpd/files/vsftpd.conf
Note: The configuration in the/etc/puppet/fileserver.conf file is consistent with this block
#vim/etc/puppet/fileserver.conf
[File configuration domain]
path:/etc/puppet/
require = class["Vsftpd::install"],
notify = class["Vsftpd::service"]}
}
* VIM/ETC/PUPPET/MODULES/VSFTPD/MANIFESTS/SERVICE.PP
Class Vsftpd::service {
Service {"VSFTPD":
ensure = running,
require = class["Vsftpd::install", "Vsftpd::config"]
}
}
* VIM/ETC/PUPPET/MODULES/VSFTPD/MANIFESTS/INIT.PP
Class Vsftpd {
Include Vsftpd::install,vsftpd::config,vsftpd::service
}
* in 192.168.2.2 host copy to 100:scp/etc/vsftpd/vsftpd.conf
192.168.2.100:/etc/puppet/modules/vsftpd/files/
* chmod 644/etc/puppet/modules/vsftpd/files/vsftpd.conf//can enable puppet user to read (other with read
The permissions)
* vim/etc/puppet/modules/vsftpd/files/vsftpd.conf
Anonymous_enable=no
* VIM/ETC/PUPPET/MANIFESTS/NODES/SERVER113.PP
Node ' server113.example.com ' {
Include VSFTPD//Add VSFTPD module name
Test
* on 113 Host: Puppet agent--server server100.example.com--no-daemonize--verbose
* On 113 Host: lftp localhost//Unable to log in
LFTP localhost:~> ls
Interrupt
Lftp Localhost:~> quit
* On the 100 host: vim/etc/puppet/modules/vsftpd/files/vsftpd.conf
Anonymous_enable=yes
* on 113 Host: Puppet agent--server server100.example.com--no-daemonize--verbose
* On 113 Host: lftp localhost//Login Successful
LFTP localhost:~> ls
Drwxr-xr-x 2 0
0
4096 Feb Pub
Lftp Localhost:/> quit
Added: Configuring a virtual Host with template
Do the following in Puppet-server
[Email protected] manifests]# vim/etc/puppet/manifests/nodes.pp
Node ' server2.example.com ' {
Include httpd
httpd::vhost {' server2.example.com ':
DomainName = "Server2.example.com"
}
httpd::vhost {' virtual.example.com ':
Create a virtual host server2.example.com
Create a virtual host virtual.example.com if you want to create
Multiple virtual hosts, you can continue to add
DomainName = "Virtual.example.com"
}
}
[Email protected] manifests]# Vim/etc/puppet/modules/httpd/manifests/init.ppclass httpd {
Include Httpd::install,httpd::config,httpd::service
}
Define Httpd::vhost ($domainname) {
#file {"/etc/httpd/conf/httpd.conf":
#
Content = Template ("Httpd/httpd.conf.erb")
#}
file {"/etc/httpd/conf.d/${domainname}_vhost.conf":
#path = '/etc/httpd/conf/httpd_vhost.conf ',
Content = Template ("Httpd/httpd_vhost.conf.erb"),
require = class["Httpd::install"],
notify = class["Httpd::service"]
}
file {"/var/www/$domainname":
ensure = Directory
}
file {"/var/www/$domainname/index.html":
Content = $domainname
}
}
[Email protected] manifests]# vim/etc/puppet/modules/httpd/manifests/config.pp
Class Httpd::config {
file {"/etc/httpd/conf/httpd.conf":
ensure = present,
#source = "Puppet:///modules/httpd/httpd.conf",
Content = Template ("Httpd/httpd.conf.erb"),
require = class["Httpd::install"],
notify = class["Httpd::service"]
}
}
[Email protected] templates]# ls/etc/puppet/modules/httpd/templates
Httpd.conf.erb Httpd_vhost.conf.erb
Under the templates Template:
File Httpd.conf.erb is the httpd configuration file, add suffix Erb. Because it must be the end of the Erb.
The file Httpd_vhost.conf.erb is a virtual host configuration file that reads as follows
[Email protected] templates]# vim Httpd_vhost.conf.erb
<virtualhost *:80>
ServerName <%= DomainName%>
documentroot/var/www/<%= DomainName%>
errorlog logs/<%= DomainName%>_error.log
Customlog logs/<%= DomainName%>_access.log Common
</virtualhost>
Six. Managing puppet on a Web basis
Explanation: Use the web to make the client's information appear on the Web page
1.Puppet Dashboard installed on 100 host
* Yum Install Puppet-dashboard-y
Resolve dependencies:
Error:package:puppet-dashboard-1.2.23-1.el6.noarch (puppet) Requires:rubygem (rake)
Download rubygem-rake-0.9.2.2-40.el6sat.noarch.rpm
RPM-IVH rubygem-rake-0.9.2.2-40.el6sat.noarch.rpm
* Yum install-y mysql-server MySQL Puppet-dashboard
*/etc/init.d/mysqld Start
* Mysql_secure_installation
2. Dashboard about the configuration of the database
* VIM/USR/SHARE/PUPPET-DASHBOARD/CONFIG/DATABASE.YML
Production
Database:dashboard_production
Username:dashboard
Password:westos
Encoding:utf8
Adapter:mysql
The following removal
Libraries and tables required for 3.dashboard
* Vim/usr/share/puppet-dashboard/config/add.sql
CREATE DATABASE dashboard_production CHARACTER SET UTF8;
CREATE USER ' dashboard ' @ ' localhost ' identified by ' Westos ';
GRANT all privileges on dashboard_production.* to ' dashboard ' @ ' localhost ';
* Mysql-pwestos </usr/share/puppet-dashboard/config/add.sql
* Mysql-udashboard-pwestos//Check if there is a library: dashboard_production
mysql> show databases;
+----------------------+
| Database
|
+----------------------+
| Information_schema |
| dashboard_production |
+----------------------+
4. Time zone
* VIM/USR/SHARE/PUPPET-DASHBOARD/CONFIG/SETTINGS.YML
Time_zone: ' Beijing '
You can use the command: Rake time:zones:local view time zone
* UTC +08:00 *
Beijing
Chongqing
Hong Kong
5. Create the necessary libraries and tables for dashboard
* Rake rails_env=production Db:migrate Database Migration, the following information appears
= = Createnodeclassmemberships:migrating =====================================
--Create_table (: node_class_memberships)
0.0765s
= = createnodeclassmemberships:migrated (0.0769s) ============================
= = Createnodegroups:migrating
===============================================
--Create_table (: node_groups)
0.0759s
= = createnodegroups:migrated (0.0769s) ======================================
6. Turn on the service
*/etc/init.d/puppet-dashboard start*/etc/init.d/puppet-dashboard-workers start
Attention:
* chmod 666/usr/share/puppet-dashboard/log/production.log
Need to use this directory log file, then modify permissions so that puppet can write, with the log file:/var/log/messages can also
7. Test access: 192.168.2.100:3000
8.client synchronization results are returned to the Web page (client requires: manual sync)
On the 100 host
* vim/etc/puppet/puppet.conf
[Main]
Autosign = True
Reports = http
Reporturl = Http://192.168.2.100:3000/reports
*/etc/init.d/puppetmaster Reload
On the 103 and 113 hosts
* vim/etc/puppet/puppet.conf
[Agent]
Report = True
* Puppet agent--server server100.example.com--no-daemonize--verbose
Test access: 192.168.2.100:3000 Refresh
9.client sync results return to Web page
Note: The client does not need to sync manually, and every 5 minutes is automatically synchronized
On the 103 and 113 hosts
* Vim/etc/sysconfig/puppet
# The puppetmaster server
Puppet_server=server100.example.com
/etc/init.d/puppet start
* vim/etc/puppet/puppet.conf
[Agent]
Report = True
Runinterval = 300
Synchronize with server side every 5 minutes, by default: half an hour
*/etc/init.d/puppet Reload
Test access: 192.168.2.100:3000
Click: Enable AutoRefresh
Click on the hostname to view the number of synchronizations
Solve
1. In practice, it is sometimes necessary to modify the host name on the client side, so that the certificate needs to be regenerated:
* On 100 Host: Puppet cert--clean server103.example.com
* On 103 host: rm-rf/var/lib/puppet/ssl/*
* on 103 host: Puppet agent--server server100.example.com--no-daemonize--verbose
2. On the 103 host: Puppet agent--server server100.example.com--no-daemonize--verbose
Error:could not set ' file ' on Ensure:cannot generate Tempfile '/etc/httpd/conf/httpd.conf20140809-
3221-1c8df00-9 ' at 10:/etc/puppet/manifests/site.pp
Error:could not set ' file ' on Ensure:cannot generate Tempfile '/etc/httpd/conf/httpd.conf20140809-
3221-1c8df00-9 ' at 10:/etc/puppet/manifests/site.pp
Wrapped exception:
Cannot generate Tempfile '/etc/httpd/conf/httpd.conf20140809-3221-1c8df00-9 '
Error:/stage[main]/main/file[/etc/httpd/conf/httpd.conf]/ensure:change from absent to File failed:
Could not set ' file ' on Ensure:cannot generate Tempfile '/etc/httpd/conf/httpd.conf20140809-3221-1c8df00-9 ' at 10:/etc/p Uppet/manifests/site.pp
Error:could not start service[httpd]: Execution of '/sbin/service httpd start ' returned 1:HTTPD:
Unrecognized service
Wrapped exception:
Execution of '/sbin/service httpd start ' returned 1:httpd:unrecognized service
Error:/stage[main]/main/service[httpd]/ensure:change from stopped to running Failed:could not
Start SERVICE[HTTPD]: Execution of '/sbin/service httpd start ' returned 1:httpd:unrecognized Service
Cause: The first error, because there is no file, but httpd installation success. Second run: On the premise of httpd installation, the files are
Yes
Workaround: Run again: Puppet agent--server server100.example.com--no-daemonize--verbose
Explain
1. What should I do if I want to save the package? For example: Save: Puppet-server bag puppet bag, etc.
* vim/etc/yum.conf
[Main]
cachedir=/var/cache/yum/$basearch/$releasever
Keepcache=1
* Path of puppet package:/var/cache/yum/x86_64/6server/
* chmod 666/usr/share/puppet-dashboard/log/production.log
Need to use this directory log file, then modify permissions so that puppet can write, with the log file:/var/log/messages can also
Attention:
#mysql 5.1 Packets encountered a large problem when importing data with the client, an error code was encountered: 1153-got a
Packet bigger than ' Max_allowed_packet ' bytes terminated the data import, which can be resolved using the following parameters:
(not encountered on rhel6.3)
# VI/ETC/MY.CNF
[Mysqld]
Max_allowed_packet = 32M
#添加此行

This article from "lyh1999" blog, reproduced please contact the author!

Puppet Automation Management