共计 14385 个字符，预计需要花费 36 分钟才能阅读完成。
OS:CentOS-6.5-x86_64
Puppet 3.7.3
Puppet master: master.fisteam2.com
Puppet clients:node1-5.fisteam2.com
Puppet 要求所有机器有完整的域名（FQDN），如果没有 DNS 服务器提供域名的话，可以在两台机器上设置主机名（注意要先设置主机名再安装 Puppet，因为安装 Puppet 时会把主机名写入证书，客户端和服务端通信需要这个证书）, 因为我配置了 DNS，所以就不用改 hosts 了，如果没有就需要改 hosts 文件指定。
1. 关闭 selinux，iptables，并设置 ntp
采用 CentOS-6.5-x86_64.iso 进行 minimal 最小化安装
关闭 selinux
[root@master ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
# targeted – Targeted processes are protected,
# mls – Multi Level Security protection.
SELINUXTYPE=targeted
[root@master ~]# sed -i ‘/SELINUX/ s/enforcing/disabled/g’ /etc/selinux/config
[root@master ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted – Targeted processes are protected,
# mls – Multi Level Security protection.
SELINUXTYPE=targeted
[root@master ~]# setenforce 0
停止 iptables
[root@node1 ~]# chkconfig –list |grep tables
ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@node1 ~]# chkconfig ip6tables off
[root@node1 ~]# chkconfig iptables off
[root@node1 ~]# service ip6tables stop
ip6tables: Setting chains to policy ACCEPT: filter [OK]
ip6tables: Flushing firewall rules: [OK]
ip6tables: Unloading modules: [OK]
[root@node1 ~]# service iptables stop
iptables: Setting chains to policy ACCEPT: filter [OK]
iptables: Flushing firewall rules: [OK]
iptables: Unloading modules: [OK]
[root@node1 ~]#
设置 ntp
[root@master ~]# ntpdate pool.ntp.org
[root@master ~]# chkconfig –list|grep ntp
ntpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off
ntpdate 0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@master ~]# chkconfig ntpd on
[root@master ~]# service ntpd start
Starting ntpd: [OK]
[root@master ~]#
2. 安装 puppet 服务
puppet 不在 CentOS 的基本源中，需要加入 PuppetLabs 提供的官方源：
[root@master ~]# wget http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-7.noarch.rpm
[root@master ~]# rpm -ivh puppetlabs-release-6-7.noarch.rpm
[root@master ~]#yum update
在 master 上安装和启用 puppet 服务：
[root@master ~]# yum install puppet-server
[root@master ~]# chkconfig –list |grep puppet
puppet 0:off 1:off 2:off 3:off 4:off 5:off 6:off
puppetmaster 0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@master ~]# chkconfig puppet on
[root@master ~]# service puppetmaster start
Starting puppetmaster: [OK]
[root@master ~]#
在 clients 上安装 puppet 客户端
[root@node1 ~]# yum install puppet
[root@node1 ~]# chkconfig –list |grep puppet
puppet 0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@node1 ~]# chkconfig puppet on
[root@node1 ~]# chkconfig –list |grep puppet
puppet 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@node1 ~]# service puppet start
Starting puppet agent: [OK]
[root@node1 ~]#
3. 配置 puppet
对于 puppet 客户端，修改 /etc/puppet/puppet.conf，指定 master 服务器
[main]
# The Puppet log directory.
# The default value is ‘$vardir/log’.
logdir = /var/log/puppet
# Where Puppet PID files are kept.
# The default value is ‘$vardir/run’.
rundir = /var/run/puppet
# Where SSL certificates are kept.
# The default value is ‘$confdir/ssl’.
ssldir = $vardir/ssl
[agent]
# The file in which puppetd stores a list of the classes
# associated with the retrieved configuratiion. Can be loaded in# the separate “puppet“ executable using the “–loadclasses“
# option.
# The default value is ‘$confdir/classes.txt’.
classfile = $vardir/classes.txt
# Where puppetd caches the local configuration. An
# extension indicating the cache format is added automatically.
# The default value is ‘$confdir/localconfig’.
localconfig = $vardir/localconfig
server = master.fisteam2.com
并重启 puppet 服务
[root@node1 ~]# service puppet restart
Stopping puppet agent: [OK]
Starting puppet agent: [OK]
[root@node1 ~]#
4.Client 申请证书
服务端自动签发证书设置
设置 master 自动签发所有的证书，我们只需要在 /etc/puppet 目录下创建 autosign.conf 文件。（不需要修改 /etc/puppet/puppet.conf 文件，因为我默认的 autosign.conf 文件的位置没有修改）
[root@master ~]# ll /etc/puppet/
total 28
-rw-r–r–. 1 root root 4178 Nov 4 06:24 auth.conf
drwxr-xr-x. 3 root root 4096 Dec 29 15:44 environments
-rw-r–r–. 1 root root 1462 Nov 4 06:23 fileserver.conf
drwxr-xr-x. 2 root root 4096 Nov 4 06:24 manifests
drwxr-xr-x. 2 root root 4096 Nov 4 06:24 modules
-rw-r–r–. 1 root root 853 Nov 4 06:23 puppet.conf
[root@master ~]# cat > /etc/puppet/autosign.conf <<EOF
> *.fisteam2.com
> EOF
[root@master ~]# service puppetmaster restart
Stopping puppetmaster: [OK]
Starting puppetmaster: [OK]
[root@master ~]#
这样就会对所有来自 fisteam2.com 的机器的请求，都自动签名。
client 需要向服务器端发出请求, 让服务器对客户端进行管理. 这其实是一个证书签发的过程. 第一次运行 puppet 客户端的时候会生成一个 SSL 证书并指定发给 Puppet 服务端, 服务器端如果同意管理客户端, 就会对这个证书进行签发，可以用这个命令来签发证书，由于我们已经在客户端设置了 server 地址，因此不需要跟服务端地址
[root@master ~]# puppet agent
为了详细了解注册的过程和日后排错, 可以增加参数，因为配置文件里
–no-daemonize 前台输出日志
–verbose 输入更加详细的日志
–debug 更加详细的日志，排错的时候使用
–test 表示测试，就带一个–test 参数就可以
[root@node1 ~]# puppet agent –no-daemonize –onetime –verbose –debug
就可以申请证书了，由于我配置的自动签发证书，所以直接就签发了，在服务端执行
[root@master ~]# puppet cert list –all
就可以看到所有客户端已经都已签发证书，前面带”+”号的就是签发成功的，如果没有签名的，可以用
[root@master ~]# puppet cert –sign node1.localdomain
即可看到证书已经签发。
Puppet 学习系列：
Puppet 学习一：安装及简单实例应用 http://www.linuxidc.com/Linux/2013-08/88710.htm
Puppet 学习二: 简单模块配置和应用 http://www.linuxidc.com/Linux/2013-08/88711.htm
相关阅读：
有关 Puppet agent 端三种备份恢复方案探讨研究 http://www.linuxidc.com/Linux/2013-07/87885.htm
选择更安全的方式注册你的 Puppet 节点 http://www.linuxidc.com/Linux/2013-07/87884.htm
通过配置 SSH 深刻理解 Puppet 的语法及工作机制 http://www.linuxidc.com/Linux/2013-07/87882.htm
Puppet 利用 Nginx 多端口实现负载均衡 http://www.linuxidc.com/Linux/2013-02/79794.htm
CentOS（5 和 6）下 Puppet 的 C / S 模式实例 http://www.linuxidc.com/Linux/2011-12/50502.htm
更多详情见请继续阅读下一页的精彩内容：http://www.linuxidc.com/Linux/2015-01/111922p2.htm
5. 在服务端安装 puppet 的 dashboard
安装 mysql
[root@master ~]# yum install -y mysql mysql-devel mysql-server
优化 mysql 设置
编辑 /etc/my.cnf, 在 [mysqld] 字段, 增加最后一行
[root@master ~]# vim /etc/my.cnf
启动 Mysql 服务
[root@master ~]# service mysqld start
[root@master ~]# chkconfig mysqld on
[root@master ~]# chkconfig --list |grep mysqld
mysqld 0:off 1:off 2:on 3:on 4:on 5:on 6:off
设置 mysql 密码，我这里使用是密码是 123456
[root@master ~]# mysqladmin -u root password ‘123456’
创建一个 dashboard 数据库
[root@master ~]# mysql -uroot -p123456 <<EOF
> CREATE DATABASE dashboard CHARACTER SET utf8;
> CREATE USER ‘dashboard’@’localhost’ IDENTIFIED BY ‘123456’;
> GRANT ALL PRIVILEGES ON dashboard.* TO ‘dashboard’@’localhost’;
> FLUSH PRIVILEGES;
> EOF
[root@master ~]
Passenger+Apache+Dashboard
这是让 Apache 支持 ruby, 由于 Passenger 不在 CentOS 官方源里，因此要添加 epel 的源
[root@master ~]# wget http://dl.Fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
[root@master ~]# rpm -ivh epel-release-6-8.noarch.rpm
[root@master ~]# yum install mod_passenger puppet-dashboard
配置 Dashboard
[root@master ~]# vim /usr/share/puppet-dashboard/config/database.yml
修改时区
[root@master ~]# vim /usr/share/puppet-dashboard/config/environment.rb
初始化数据库
[root@master ~]# cd /usr/share/puppet-dashboard/
[root@master puppet-dashboard]# rake RAILS_ENV=production db:migrate
OS:CentOS-6.5-x86_64
Puppet 3.7.3
Puppet master: master.fisteam2.com
Puppet clients:node1-5.fisteam2.com
Puppet 要求所有机器有完整的域名（FQDN），如果没有 DNS 服务器提供域名的话，可以在两台机器上设置主机名（注意要先设置主机名再安装 Puppet，因为安装 Puppet 时会把主机名写入证书，客户端和服务端通信需要这个证书）, 因为我配置了 DNS，所以就不用改 hosts 了，如果没有就需要改 hosts 文件指定。
1. 关闭 selinux，iptables，并设置 ntp
采用 CentOS-6.5-x86_64.iso 进行 minimal 最小化安装
关闭 selinux
[root@master ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
# targeted – Targeted processes are protected,
# mls – Multi Level Security protection.
SELINUXTYPE=targeted
[root@master ~]# sed -i ‘/SELINUX/ s/enforcing/disabled/g’ /etc/selinux/config
[root@master ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
# targeted – Targeted processes are protected,
# mls – Multi Level Security protection.
SELINUXTYPE=targeted
[root@master ~]# setenforce 0
停止 iptables
[root@node1 ~]# chkconfig –list |grep tables
ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@node1 ~]# chkconfig ip6tables off
[root@node1 ~]# chkconfig iptables off
[root@node1 ~]# service ip6tables stop
ip6tables: Setting chains to policy ACCEPT: filter [OK]
ip6tables: Flushing firewall rules: [OK]
ip6tables: Unloading modules: [OK]
[root@node1 ~]# service iptables stop
iptables: Setting chains to policy ACCEPT: filter [OK]
iptables: Flushing firewall rules: [OK]
iptables: Unloading modules: [OK]
[root@node1 ~]#
设置 ntp
[root@master ~]# ntpdate pool.ntp.org
[root@master ~]# chkconfig –list|grep ntp
ntpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off
ntpdate 0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@master ~]# chkconfig ntpd on
[root@master ~]# service ntpd start
Starting ntpd: [OK]
[root@master ~]#
2. 安装 puppet 服务
puppet 不在 CentOS 的基本源中，需要加入 PuppetLabs 提供的官方源：
[root@master ~]# wget http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-7.noarch.rpm
[root@master ~]# rpm -ivh puppetlabs-release-6-7.noarch.rpm
[root@master ~]#yum update
在 master 上安装和启用 puppet 服务：
[root@master ~]# yum install puppet-server
[root@master ~]# chkconfig –list |grep puppet
puppet 0:off 1:off 2:off 3:off 4:off 5:off 6:off
puppetmaster 0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@master ~]# chkconfig puppet on
[root@master ~]# service puppetmaster start
Starting puppetmaster: [OK]
[root@master ~]#
在 clients 上安装 puppet 客户端
[root@node1 ~]# yum install puppet
[root@node1 ~]# chkconfig –list |grep puppet
puppet 0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@node1 ~]# chkconfig puppet on
[root@node1 ~]# chkconfig –list |grep puppet
puppet 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@node1 ~]# service puppet start
Starting puppet agent: [OK]
[root@node1 ~]#
3. 配置 puppet
对于 puppet 客户端，修改 /etc/puppet/puppet.conf，指定 master 服务器
[main]
# The Puppet log directory.
# The default value is ‘$vardir/log’.
logdir = /var/log/puppet
# Where Puppet PID files are kept.
# The default value is ‘$vardir/run’.
rundir = /var/run/puppet
# Where SSL certificates are kept.
# The default value is ‘$confdir/ssl’.
ssldir = $vardir/ssl
[agent]
# The file in which puppetd stores a list of the classes
# associated with the retrieved configuratiion. Can be loaded in# the separate “puppet“ executable using the “–loadclasses“
# option.
# The default value is ‘$confdir/classes.txt’.
classfile = $vardir/classes.txt
# Where puppetd caches the local configuration. An
# extension indicating the cache format is added automatically.
# The default value is ‘$confdir/localconfig’.
localconfig = $vardir/localconfig
server = master.fisteam2.com
并重启 puppet 服务
[root@node1 ~]# service puppet restart
Stopping puppet agent: [OK]
Starting puppet agent: [OK]
[root@node1 ~]#
4.Client 申请证书
服务端自动签发证书设置
设置 master 自动签发所有的证书，我们只需要在 /etc/puppet 目录下创建 autosign.conf 文件。（不需要修改 /etc/puppet/puppet.conf 文件，因为我默认的 autosign.conf 文件的位置没有修改）
[root@master ~]# ll /etc/puppet/
total 28
-rw-r–r–. 1 root root 4178 Nov 4 06:24 auth.conf
drwxr-xr-x. 3 root root 4096 Dec 29 15:44 environments
-rw-r–r–. 1 root root 1462 Nov 4 06:23 fileserver.conf
drwxr-xr-x. 2 root root 4096 Nov 4 06:24 manifests
drwxr-xr-x. 2 root root 4096 Nov 4 06:24 modules
-rw-r–r–. 1 root root 853 Nov 4 06:23 puppet.conf
[root@master ~]# cat > /etc/puppet/autosign.conf <<EOF
> *.fisteam2.com
> EOF
[root@master ~]# service puppetmaster restart
Stopping puppetmaster: [OK]
Starting puppetmaster: [OK]
[root@master ~]#
这样就会对所有来自 fisteam2.com 的机器的请求，都自动签名。
client 需要向服务器端发出请求, 让服务器对客户端进行管理. 这其实是一个证书签发的过程. 第一次运行 puppet 客户端的时候会生成一个 SSL 证书并指定发给 Puppet 服务端, 服务器端如果同意管理客户端, 就会对这个证书进行签发，可以用这个命令来签发证书，由于我们已经在客户端设置了 server 地址，因此不需要跟服务端地址
[root@master ~]# puppet agent
为了详细了解注册的过程和日后排错, 可以增加参数，因为配置文件里
–no-daemonize 前台输出日志
–verbose 输入更加详细的日志
–debug 更加详细的日志，排错的时候使用
–test 表示测试，就带一个–test 参数就可以
[root@node1 ~]# puppet agent –no-daemonize –onetime –verbose –debug
就可以申请证书了，由于我配置的自动签发证书，所以直接就签发了，在服务端执行
[root@master ~]# puppet cert list –all
就可以看到所有客户端已经都已签发证书，前面带”+”号的就是签发成功的，如果没有签名的，可以用
[root@master ~]# puppet cert –sign node1.localdomain
即可看到证书已经签发。
Puppet 学习系列：
Puppet 学习一：安装及简单实例应用 http://www.linuxidc.com/Linux/2013-08/88710.htm
Puppet 学习二: 简单模块配置和应用 http://www.linuxidc.com/Linux/2013-08/88711.htm
相关阅读：
有关 Puppet agent 端三种备份恢复方案探讨研究 http://www.linuxidc.com/Linux/2013-07/87885.htm
选择更安全的方式注册你的 Puppet 节点 http://www.linuxidc.com/Linux/2013-07/87884.htm
通过配置 SSH 深刻理解 Puppet 的语法及工作机制 http://www.linuxidc.com/Linux/2013-07/87882.htm
Puppet 利用 Nginx 多端口实现负载均衡 http://www.linuxidc.com/Linux/2013-02/79794.htm
CentOS（5 和 6）下 Puppet 的 C / S 模式实例 http://www.linuxidc.com/Linux/2011-12/50502.htm
更多详情见请继续阅读下一页的精彩内容：http://www.linuxidc.com/Linux/2015-01/111922p2.htm
配置 Apache
我们需要整合 Passenger 和 apache
[root@master ~]# cat > /etc/httpd/conf.d/passenger.conf << EOF
> LoadModule passenger_module modules/mod_passenger.so
> <IfModule mod_passenger.c>
> PassengerRoot /usr/share/rubygems/gems/passenger-3.0.17
> PassengerRuby /usr/bin/ruby
> PassengerHighPerformance on
> PassengerMaxPoolSize 12
> PassengerPoolIdleTime 1500
> PassengerStatThrottleRate 120
> RailsAutoDetect On
> </IfModule>
> <VirtualHost *:80>
> ServerName master.fisteam2.com
> DocumentRoot “/usr/share/puppet-dashboard/public/”
> <Directory “/usr/share/puppet-dashboard/public/”>
> Options None
> AllowOverride AuthConfig
> Order allow,deny
> allow from all
> </Directory>
> ErrorLog /var/log/httpd/master.fisteam2.com_error.log
> LogLevel warn
> CustomLog /var/log/httpd/master.fisteam2.com_access.log combined
> ServerSignature On
> </VirtualHost>
> EOF
[root@master ~]#
启动服务
[root@master ~]# service httpd start
Starting httpd: httpd: Could not reliably determine the server’s fully qualified domain name, using master.fisteam2.com for ServerName[OK]
[root@master ~]# chkconfig httpd on
[root@master ~]# chkconfig –list | grep httpd
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
配置 puppet
让 Dashboard 使用 Reports，现在默认 agent 是已经启用 Report 的功能，所以你就不需要设置 agent, 你只需要设置 Server 端就可以
[root@master ~]# vim /etc/puppet/puppet.conf
[master]
reports = store,http
reporturl = http://master.fisteam2.com:80/reports/upload
重启 puppetmaster 服务
[root@master ~]# service puppetmaster restart
这时候就可以直接用 http://ip 访问 puppet Dashboard
导入报告
[root@master puppet-dashboard]# cd /usr/share/puppet-dashboard/
[root@master puppet-dashboard]# rake RAILS_ENV=production reports:import
这时候你访问 Dashboard, 可以看到导入的任务.
4. 执行导入的 reports
[root@master puppet-dashboard]# cd /usr/share/puppet-dashboard/
[root@master puppet-dashboard]# rake jobs:work RAILS_ENV=”production”
一个 Master, 五个 node 测试效果
文件同步测试
Puppet master:
[root@master ~]# vim /etc/puppet/fileserver.conf
[fisteam2filesync]
path /etc/puppet
allow *
在下面加一个配置域，名字叫做 fisteam2filesync, 路径是 /etc/puppet
[root@master ~]# vim /etc/puppet/manifests/site.pp
node default {
file {
“/tmp/fisteam2_puppet_testfile.txt”:
content=>”good,test pass!\nfisteam2_puppet_testing\n”;
}
}
上面的代码对默认连入的 puppet 客户端执行一个操作, 在 /tmp 目录生成一个 fisteam2_puppet_testfile.txt 文件, 内容是 good,test pass! 回车换行 fisteam2_puppet_testing 回车换行.
初次创建 pp 文件，需要重启 puppetmaster
[root@master ~]# service puppetmaster restart
Stopping puppetmaster: [OK]
Starting puppetmaster: [OK]
NODE1~5 测试
node1:
node2:
node3:
node4:
node5:
Puppet 的详细介绍：请点这里
Puppet 的下载地址：请点这里
更多 CentOS 相关信息见CentOS 专题页面 http://www.linuxidc.com/topicnews.aspx?tid=14
