<Puppet centralized Configuration Management System>

Puppet centralized Configuration Management System
Puppet is a configuration management tool. It is typical that puppet is a C/S structure. Of course, there can be a lot of C here, because
This can also be said to be a star structure. All puppet clients communicate with puppet on the same server. Each
The puppet client connects to the server every 30 minutes, downloads the latest configuration file, and strictly follows the configuration
After the configuration is complete, the puppet client can send a message to the server. If an error occurs,
A message is also sent to the server, showing the data flow of a typical puppet configuration.
Stability
The biggest difference between puppet and other manual operators is that the puppet configuration is stable, so you can
Run puppet. Once you update your configuration file, puppet will change the configuration of your machine according to the configuration file.
Check once every 30 minutes. Puppet will make your system status consistent with the State required by the configuration file. For example, if you configure
The SSH service must be enabled in the file. If the SSH service is disabled accidentally
Puppet will find this exception, and then enable the SSH service to keep the system status and configuration file one
As a result, puppet is like a magician who will converge your chaotic system to the desired state in the puppet configuration file.
You can use puppet to manage the entire lifecycle of the server, from initialization to retirement.
Jumpstart or RedHat KickStart, puppet can keep the server up to date for years.
You do not need to worry about them anymore. Usually puppet users only need to install puppet on the machine and
Run, and the rest of the work is done by puppet.
Details and principles of puppet
Puppet aims to focus on the goals you want to manage, while ignoring implementation details, such as command names, parameters, or files.
Format. Puppet regards users, software packages, and services in the system as "Resources". Puppet manages these resources.
And the interconnection between resources.
Puppet adopts a very simple C/S architecture. All data interaction is performed through SSL to ensure security. It works
Process
1. The client puppetd initiates an authentication request to the master or uses a signed certificate.
2. The master tells the client that you are legal.
3. The client puppetd calls facter. facter detects some host variables, such as host name, memory size, and IP address.
. Puppetd sends the information to the server through an SSL connection.
4. The puppet master on the server detects the host name of the client, finds the node configuration corresponding to the manifest, and
Some content is parsed. The information sent by facter can be used for variable processing, and the Code involved by node is parsed.
The Code not involved is not parsed. Parsing involves several phases. The first step is syntax check. If a syntax error occurs, an error is returned.
That's right. Let's continue parsing. The parsing result will generate an intermediate "pseudo code" (catelog), and then send the pseudo code to the customer.
User.
5. The client receives and runs the pseudo code.
6. The client determines whether a file exists during execution. If yes, it initiates a request to the fileserver.
7. The client determines whether a report is configured. If the report is configured, the execution result is sent to the server.
8. The server writes the execution result of the client to the log and sends it to the reporting system.
Http: // puppet. wikidot.com Chinese Wiki
System Environment: rhel6.3 SELinux and iptables disabled
Sever: 192.168.0.201 extends top1.example.com puppet master
Client: 192.168.0.202 extends top2.example.com puppet agent
Client: 192.168.0.203 paitop3.example.com puppet agent
Important: resolution and time synchronization are required between the server and all clients. Otherwise, verification fails.
Server:
# Yum localinstall-y rubygems-1.3.7-1.el6.noarch.rpm
Add the following entries to the yum Repository:
[Puppet]
Name = puppet
Base url = http://yum.puppetlabs.com/el/6Server/products/x86_64/
Gpgcheck = 0
[Ruby]
Name = Ruby
Base url = http://yum.puppetlabs.com/el/6Server/dependencies/x86_64/
Gpgcheck = 0
# Yum install puppet-server-y
/Etc/puppet configuration directory:
The organizational structure is as follows:
| -- Puppet. conf # Master configuration file. For details, run puppet -- genconfig.
| -- Fileserver. conf # file server configuration file
| -- Auth. conf # authentication configuration file
| -- Autosign. conf # automatically verify the configuration file
| -- Tagmail. conf # mail configuration file (send error messages)
| -- Manifests # file storage directory (puppet will first read the. PP file in this directory <site. PP>)
| -- Nodes
| Puppetclient. PP
| -- Site. PP # defines puppet-related variables and default configurations.
| -- Modules. PP # load the class module File (include syslog)
| -- Modules # definition module
| -- Syslog # syslog is used as an example.
| -- File
| -- Manifests
| -- Init. PP # class configuration
| -- Templates # module configuration directory
| -- Syslog. ERB # ERB Template
The first code executed by puppet is in/etc/puppet/manifest/site. pp. Therefore, this file must exist
Other code should also be called through this file.
# Touch/etc/puppet/manifest/site. PP # the Puppet Master cannot be started without this file. The configuration will be defined later.
# Service puppetmaster start # Start puppet master
# Netstat-antlp | grep Ruby
TCP 0 0 0.0.0.0: 8140 0.0.0.0: * Listen 1596/Ruby
Client:
You only need to install puppet. The installation method is the same as that on the server side:
# Yum install puppet-y
Connect the puppet client to the puppet master:
# Puppet agent -- Server = puppet.example.com -- no-daemonize -- verbose
Info: creating a new SSL Key for topics top2.example.com
Info: caching certificate for CA
Info: creating a new SSL certificate request for topics top2.example.com
Info: certificate request fingerprint (sha256 ):
5C: 72: 77: D8: 27: DF: 5A: DF: 34: EF: 25: 97: 5A: Cf: 25: 29: 9f: 58: 83: A2: 61: 57: D9: 20: 7b: 1E: C0: 36: 75: 9d:
FB: FC
The client sends a certificate verification request to the master and waits for the master to sign and return the certificate.
Parameter -- server specifies the name or address of the puppet master to be connected. The default connection name is "puppet ".
To modify the default host connection, you can modify the puppet_server = puppet option in the/etc/sysconfig/puppet file.
The parameter -- no-daemonize is the puppet client running on the foreground
Parameter -- verbose enables the client to output detailed logs
On the master side:
# Puppet Cert list # display all certificates waiting for signature
"Maid" (sha256)
CD: BD: 13: D0: B8: 46: 07: F2: B7: AE: 00: C4: E6: E9: E1: A4: 92: F6: A4: F1: AB: F7: FF: 8d: Be: B0: B7: 90: E1:
7b: A8: C0
# Puppet Cert sign your top2.example.com # signature certificate
Signed certificate request for your top2.example.com
Removing file puppet: SSL: certificaterequest reply top2.example.com
'/Var/lib/puppet/SSL/CA/requests/shorttop2.example.com. pem'
To sign all certificates at the same time, run the following command:
# Puppet Cert sign -- all
# Puppet Cert clean topics top2.example.com # delete a signature certificate
Two minutes after the certificate is signed, the following output is displayed on the agent:
Info: caching certificate for topics top2.example.com
Starting puppet client version 3.0.0
Info: caching certificate_revocation_list for CA
Info: Retrieving plugin
Info: caching catalog for your top2.example.com
Info: Applying configuration version '20140901'
Finished catalog run in 0.13 seconds
Automatic Verification:
On the server side, edit the puppet. conf file:
[Main]
Autosign = true # Allow all clients to authenticate
Create the autosign. conf file in the/etc/puppet directory. The content is as follows:
* .Example.com # indicates that all hosts in the example.com domain are allowed.
# Service puppetmaster reload
On the client side, you only need to execute:
# Puppet agent
Or
# Server puppet start
In practice, sometimes the host name of the client is modified, so you need to regenerate the certificate:
1) run the following command on the server: puppet cert -- clean topics top2.example.com # The original client host name you want to delete
2) Run Rm-fr/var/lib/puppet/SSL/* on the client /*
Puppet agent -- Server = puppet.example.com
Puppet resource Definition
The following resources are defined in the/etc/puppet/manifest/site. PP file. If no node is specified
All verified clients take effect.
1. Create a file
File {"/var/www/html/index.html": content => "www.example.com "}
Mkdir/etc/puppet/Files
Echo www.redhat.org>/etc/puppet/files/index.html
VI/etc/puppet/fileserver. conf
[Files]
Path/etc/puppet/Files
Allow * .example.com
Service puppetmaster reload
File {"/var/www/html/index.html ":
Source => "puppet: // files/index.html ",
}
2. Software Package Definition
Package {"httpd": Ensure => present;
"Vsftpd": Ensure => absent
}
3. Service Definition
Service {"httpd": Ensure => running;
"Vsftpd": Ensure => stopped
}
4. Group Definition
Group {"WXH": gid => 600}
5. User Defined
User {"WXH ":
Uid = & gt; 600,
Gid = & gt; 600,
Home => "/home/WXH ",
Shell => "/bin/bash ",
Password => westos
}
File {"/home/WXH ":
Owner => WXH,
Group => WXH,
Mode = & gt; 700,
Ensure => directory
}
File {"/home/WXH/. bash_logout ":
Source => "/etc/skel/. bash_logout ",
Owner => WXH,
Group => WXH
}
File {"/home/WXH/. bash_profile ":
Source => "/etc/skel/. bash_profile ",
Owner => WXH,
Group => WXH
}
File {"/home/WXH/. bashrc ":
Source => "/etc/skel/. bashrc ",
Owner => WXH,
Group => WXH
}
User {"test": uid = & gt; 900,
Home => "/home/test ",
Shell => "/bin/bash ",
Provider => useradd,
Managehome => true,
Ensure => present
}
Exec {"Echo westos | passwd -- stdin test ":
Path => "/usr/bin:/usr/sbin:/bin ",
Onlyif => "id test"
}
6. Mount the File System
File {"/Public ":
Ensure => directory
}
Mount {"/Public ":
Device => "192.168.0.254:/var/FTP/pub ",
Fstype => "NFS ",
Options => "defaults ",
Ensure => mounted
}
Automatically mount the file system and synchronize the fstab file. If you need to unmount the file system, change it to absent.
7. crontab task
Cron {ECHO:
Command => "/bin/ECHO '/bin/date'>/tmp/echo ",
User => root,
Hour => ['2-4'],
Minute => '*/10'
}
# The task is generated in the/var/spool/cron directory on the client.
Definition of different nodes:
1. Edit site. PP on puppetmaster
# Vi/etc/puppet/manifests/site. PP
Import "nodes. PP"
2. Create a node File
# Vi/etc/puppet/manifests/nodes. PP
Node 'worker top2 .example.com '{
File {"/var/www/html/index.html ":
Content => "topics top2.example.com"
}
}
Node 'worker top3 .example.com '{
File {"/var/www/html/index.html ":
Content => "shorttop3.example.com"
}
}
Writing module:
Mkdir-P/etc/puppet/modules/httpd/{files, manifests, templates}
CD/etc/puppet/modules/httpd/manifests
VI install. PP
Class httpd: Install {
Package {"httpd ":
Ensure => present
}
}
VI config. PP
Class httpd: config {
File {"/etc/httpd/CONF/httpd. conf ":
Ensure => present,
Source => "puppet: // modules/httpd. conf ",
# The actual path is in/etc/puppet/modules/httpd/files/httpd. conf.
Require => class ["httpd: Install"],
Policy => class ["httpd: Service"]
}
}
VI Service. PP
Class httpd: Service {
Service {"httpd ":
Ensure => running,
Require => class ["httpd: Install", "httpd: config"]
}
}
VI init. PP
Class httpd {
Include httpd: Install, httpd: config, httpd: Service
}
VI nodes. PP
Node 'server90 .example.com '{
Include httpd
}
Service puppetmaster reload
Puppet dashboard installation (for managing puppet through web)
Dependency:
* Ruby 1.8.7
* Rubygems
* Rake> = 0.8.3
* MySQL Server 5.x
* Ruby-mysql bindings 2.7.x or 2.8.x
# Rpm-IVH rubygem-rake-0.8.7-2.1.el6.noarch.rpm
# Yum install puppet-Dashboard ruby-MySQL mysql-server-y
# MySQL 5.1 encounters an error code 1153-got a when importing data using the client because the information package is too large
Packet bigger than 'max _ allowed_packet 'bytes terminates the data import. You can use the following parameters to solve the problem:
(Not encountered on rhel6.3)
# Vi/etc/My. CNF
[Mysqld]
Max_allowed_packet = 32 m # Add this row
# Server mysqld start
Configure the MySQL database:
Mysql> Create Database dashboard_production Character Set utf8;
Query OK, 1 row affected (0.00 Sec)
Mysql> create user 'dashboard '@ 'localhost' identified by 'westos ';
Query OK, 0 rows affected (0.01 Sec)
Mysql> grant all privileges on dashboard_production. * To 'dashboard' @ 'localhost ';
Query OK, 0 rows affected (0.00 Sec)
Mysql>
# Cd/usr/share/puppet-dashboard/
# Vi config/database. yml # Only production environment configuration is left
Production:
Database: dashboard_production
Username: dashboard
Password: westos
Encoding: utf8
Adapter: MySQL
# Rake rails_env = production DB: migrate # databases and tables required for creating a dashboard
The Default Time Zone of puppet-dashboard is incorrect and needs to be modified:
# Vi/usr/share/puppet-dashboard/config/settings. yml
Time_zone: 'beijing'
Start the service:
# Service puppet-Dashboard start
Starting puppet dashboard: => booting webrick
=> Rails 2.3.14 application starting on http: // 0.0.0.0: 3000 [OK]
# Chmod 0666/usr/share/puppet-dashboard/log/production. Log
# Service puppet-dashboard-workers start
Real-time report summary:
Set the server:
# Vi/etc/puppet. conf
[Main] # Add the following two items
Reports = http
Reporturl = http: // 192.168.0.201: 3000/Reports
# Service puppetmaster reload
Set the client:
# Vi/etc/puppet. conf
[Agent] # Add the following lines
Report = true
# Service puppet reload
After the client has installed puppet and the authentication is complete, we can see the effect. How can we make it automatically synchronized with the server?
What about it? By default, how many minutes does it synchronize with the server? How can we modify the synchronization time? In this case, we need to configure the client:
(1) Configure puppet parameters and synchronization time:
# Vi/etc/sysconfig/puppet
Puppet_server = puppet.example.com # address of puppet master
Puppet_port = 8140 # puppet listening port
Puppet_log =/var/log/puppet. log # puppet local log
# Puppet_extra_opts = -- waitforcert = 500 [Default synchronization time. I will not modify this line of parameters here]
(2) After the default configuration is completed, the client will synchronize with the server half an hour. We can modify this time.
# Vi/etc/puppet. conf
[Agent]
Runinterval = 60 # synchronization with the server in 60 seconds
# Service puppet reload