首页 > 代码库 > Puppet 安装与应用

Puppet 安装与应用

Centos 6.4 安装Puppet

 

Puppet要求所有机器有完整的域名(FQDN),如果没有 DNS 服务器提供域名的话,可以在两台机器上设置主机名(注意要先设置主机名再安装 Puppet,因为安装 Puppet 时会把主机名写入证书,客户端和服务端通信需要这个证书),因为我配置了DNS,所以就不用改hosts了,如果没有就需要改hosts文件指定。


环境:

采用CentOS-6.4-x64系统,IP地址如下:

Master: 192.168.239.128

Client: 192.168.239.130

 

操作说明:

红色代码命令蓝色代表说明紫色代表操作主机

 

Master,client:

 

1.关闭selinuxiptables,并设置ntp

安装ntpwget等常用工具

安装ntp wget

yum install -y wget ntp

关闭selinux

 

sed -i ‘/SELINUX/s/enforcing/disabled/g‘ /etc/selinux/config

setenforce 0

停止iptables

 

chkconfig ip6tables off

chkconfig iptables off

/etc/init.d/ip6tablesstop

/etc/init.d/iptables stop

设置ntp

 

ntpdate pool.ntp.org

chkconfig ntpd on

service ntpd start


2.安装puppet服务的官方源

puppet不在CentOS的基本源中,需要加入PuppetLabs 提供的官方源:

 

wgethttp://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-7.noarch.rpm

rpm -ivhpuppetlabs-release-6-7.noarch.rpm

 

master

vi /etc/hosts

末尾添加一条记录

192.168.239.130  ns2.centos.com

测试主机名是否Ping

ping ns2.centos.com

 

安装和启用 puppet 服务:

yum install puppet-server

chkconfig puppet on

service puppetmasterstart

 

client:

vi /etc/hosts

末尾添加一条记录

192.168.239.128  ns1.centos.com

测试主机名是否Ping

ping ns1.centos.com

 

安装puppet客户端

 

yum install puppet

chkconfig puppet on

service puppet start

3.配置puppet

对于puppet 客户端,修改配置文件,指定master服务器

 

vi/etc/puppet/puppet.conf

 

[main]

# The Puppet log directory.

# The default value is ‘$vardir/log‘.

logdir = /var/log/puppet

 

# Where Puppet PID files are kept.

# The default value is ‘$vardir/run‘.

rundir = /var/run/puppet

 

# Where SSL certificates are kept.

# The default value is ‘$confdir/ssl‘.

ssldir = $vardir/ssl

 

[agent]

# The file in which puppetd stores a listof the classes

# associated with the retrievedconfiguratiion. Can be loaded in

# the separate ``puppet`` executable usingthe ``--loadclasses``

# option.

# The default value is‘$confdir/classes.txt‘.

classfile = $vardir/classes.txt

 

# Where puppetd caches the localconfiguration. An

# extension indicating the cache format isadded automatically.

# The default value is ‘$confdir/localconfig‘.

localconfig = $vardir/localconfig

server =ns1.centos.com

并重启puppet服务

 

service puppetrestart

4.Client申请证书

Master

 

服务端自动签发证书设置

设置master自动签发所有的证书,我们只需要在/etc/puppet 目录下创建 autosign.conf 文件。(不需要修改 /etc/puppet/puppet.conf文件,因为我默认的autosign.conf文件的位置没有修改)

 

cat >/etc/puppet/autosign.conf <<EOF

*.centos.com

EOF

service puppetmasterrestart

这样就会对所有来自canghai.com的机器的请求,都自动签名。

client需要向服务器端发出请求, 让服务器对客户端进行管理.这其实是一个证书签发的过程. 第一次运行 puppet 客户端的时候会生成一个 SSL 证书并指定发给 Puppet 服务端, 服务器端如果同意管理客户端,就会对这个证书进行签发,可以用这个命令来签发证书,由于我们已经在客户端设置了server地址,因此不需要跟服务端地址

 

client

 

puppet agent

为了详细了解注册的过程和日后排错,可以增加参数,因为配置文件里

no-daemonize 前台输出日志

verbose 输入更加详细的日志

debug 更加详细的日志,排错的时候使用

test 表示测试,就带一个–test参数就可以

 

puppet agent--no-daemonize --onetime --verbose --debug

就可以申请证书了,由于我配置的自动签发证书,所以直接就签发了,在服务端执行

 

Master:

 

puppet cert list--all

+ "ns1.centos.com"(SHA256)CA:50:6A:51:D5:AD:F0:73:BF:83:A0:4A:BF:1F:4E:F0:56:C9:4B:D8:4D:BB:62:10:EE:14:16:D5:96:D0:B6:F7(alt names: "DNS:ns1.centos.com", "DNS:puppet","DNS:puppet.canghai.com")

+"ns2.centos.com" (SHA256)B8:95:69:2B:7B:3E:F4:38:CA:63:BE:A0:ED:3C:E7:05:1F:93:53:2D:1C:60:67:E9:D8:20:99:90:B8:9B:D6:40

 

就可以看到所有客户端已经都已签发证书,前面带”+”号的就是签发成功的,撸过没有签名的,可以用

 

puppet cert --signns2.centos.com

进行签发证书,签发后在master,执行

 

puppet cert list--all

即可看到证书已经签发

5.在服务端安装puppetdashboard

安装mysql

 

yum install -y mysqlmysql-devel mysql-server

优化mysql设置

编辑 /etc/my.cnf, [mysqld]字段,增加最后一行

 

vi /etc/my.cnf

 

[mysqld]

datadir=/var/lib/mysql

socket=/var/lib/mysql/mysql.sock

user=mysql

# Disabling symbolic-links is recommendedto prevent assorted security risks

symbolic-links=0

max_allowed_packet =32M

[mysqld_safe]

log-error=/var/log/mysqld.log

pid-file=/var/run/mysqld/mysqld.pid

启动服务

 

/etc/init.d/mysqldstart

chkconfig mysqld on

设置mysql密码,我这里使用是密码是123456

 

mysqladmin -u rootpassword ‘123456‘

创建一个dashboard数据库

 

mysql -uroot -p123456<<EOF

CREATE DATABASEdashboard CHARACTER SET utf8;

CREATE USER‘dashboard‘@‘localhost‘ IDENTIFIED BY ‘123456‘;

GRANT ALL PRIVILEGESON dashboard.* TO ‘dashboard‘@‘localhost‘;

FLUSH PRIVILEGES;

EOF

 

Passenger+Apache+Dashboard

这是让Apache支持ruby,由于Passenger不在centos官方源里,因此要添加epel的源

 

wgethttp://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

rpm -ivhepel-release-6-8.noarch.rpm

yum installmod_passenger puppet-dashboard

配置Dashboard

 

vi/usr/share/puppet-dashboard/config/database.yml

production:

  database: dashboard

  username: dashboard

  password: 123456

  encoding: utf8

  adapter: mysql

修改时区

 

vi/usr/share/puppet-dashboard/config/environment.rb

 

  #config.time_zone = ‘UTC‘

  config.time_zone = ‘Beijing‘

初始化数据库

 

cd/usr/share/puppet-dashboard/

rakeRAILS_ENV=production db:migrate

配置Apache

我们需要整合Passengerapache

 

cat >/etc/httpd/conf.d/passenger.conf << EOF

LoadModule passenger_modulemodules/mod_passenger.so

 

PassengerRoot/usr/share/rubygems/gems/passenger-3.0.17

PassengerRuby/usr/bin/ruby

PassengerHighPerformanceon

PassengerMaxPoolSize12

PassengerPoolIdleTime1500

PassengerStatThrottleRate120

RailsAutoDetect On

 

ServerNamens1.centos.com

DocumentRoot"/usr/share/puppet-dashboard/public/"

<Directory"/usr/share/puppet-dashboard/public/>;

Options None

AllowOverrideAuthConfig

Order allow,deny

allow from all

</Directory>

 

ErrorLog/var/log/httpd/ns1.centos.com_error.log

LogLevel warn

CustomLog/var/log/httpd/ns1.centos.com_access.log combined

ServerSignature On

 

EOF

启动服务

 

/etc/init.d/httpdstart

chkconfig httpd on

配置puppet

Dashboard使用Reports,现在默认agent是已经启用Report的功能,所以你就不需要设置agent,你只需要设置Server端就可以

 

vi /etc/puppet/puppet.conf

[master]

reports = store, http

reporturl =http://ns1.centos.com:80/reports/upload

重启puppetmaster 服务

 

/etc/init.d/puppetmasterrestart

这时候就可以直接用 http://ip 访问puppet Dashboard

2013-05-05_210851

导入报告

 

cd/usr/share/puppet-dashboard

rake RAILS_ENV=productionreports:import

这时候你访问Dashboard,可以看到导入的任务.

2013-05-05_220858

4. 执行导入的reports

 

cd/usr/share/puppet-dashboard

rake jobs:workRAILS_ENV="production"


注明:本文参考过 http://www.cactifans.org/linux/994.html

 

注意事项:

如果web页面打开时Apache 2 Test Page 页面,无法进入puppet管理页面时

 

需要修改httpd 配置文件

把根目录/var/www/html/ 改成/usr/share/puppet-dashboard/public/

重启httpd服务


本文出自 “Linux学习者” 博客,请务必保留此出处http://haowen.blog.51cto.com/3486731/1575680

Puppet 安装与应用