52.puppet自動化運維工具

puppet自動化運維工具

Puppet是一款運維自動化工具，在一些大型的網際網路企業，它可以針對多台伺服器進行統一操作，如統一部署軟體，進行統一上線維護等，意思就是說在一台linux伺服器上所部署的操作，會通過puppet同步到其他linux伺服器的一款強大工具。

Puppet使用的端口是8139

搭建puppetmaster：

v 規劃伺服器主機名

# vim /etc/sysconfig/network

修改内容：

NETWORKING=yes

HOSTNAME=master.test.cn

# vim /etc/hosts

添加解析記錄：

1.1.1.128       master.test.cn

1.1.1.129       client.test.cn

# hostname master.test.cn

# bash

v 伺服器時間同步

#vim /etc/ntp.com

添加兩行：

server 127.127.1.0

fudge 127.127.1.0 stratum 8

# yum -y install ntpdate

#service ntpd restart

#chkconfig ntpd on

v 安裝ruby

# yum -y install ruby

#ruby -v

v 安裝puppet和facter

# useradd -s /sbin/nologin puppet

# tar xzvf facter-1.7.1.tar.gz

# cd facter-1.7.1

# ruby install.rb

# tar xzvf puppet-2.7.21.tar.gz

# cd puppet-2.7.21

# ruby install.rb

# cp conf/redhat/fileserver.conf   /etc/puppet/

# cp conf/redhat/puppet.conf  /etc/puppet/

# cp conf/redhat/server.init /etc/init.d/puppetmaster

# chmod +x /etc/init.d/puppetmaster

# mkdir /etc/puppet/manifests

# mkdir /etc/puppet/modules

v Puppet服務證書與簽名

# iptables -F

# vim /etc/puppet/puppet.conf

在main行添加：

ssldir = $vardir/ssl

modulepath = /etc/puppet/modules:/usr/share/puppet/modules

# /etc/init.d/puppetmaster start

搭建client用戶端：

HOSTNAME=client.test.cn

# hostname client.test.cn

v 同步服務時間

# ntpdate 1.1.1.128

v 安裝ruby安裝工具

# ruby -v

#useradd -s /sbin/nologin  puppet

# tar xzvf facter-1.7.1.tar.gz

# tar xzvf puppet-2.7.2

# cp conf/redhat/puppet.conf /etc/puppet

# cp conf/redhat/client.init  /etc/init.d/puppetclient

# chmod +x /etc/init.d/puppetclient

在main項添加内容 ：

server = master.test.cn

v 在client端申請與注冊

# puppet agent --server=master.test.cn --no-daemonize --verbose

在master端送出注冊資訊

# puppet cert --list                     檢視申請清單

# puppet cert sign --all                  送出注冊資訊，會在下面目錄中建立證書

#ll /var/lib/puppet/ssl/ca/signed          檢視client端的注冊資訊檔案

案例需求：需要将ssh服務的端口統一更改為9922

節點入口存放目錄：/etc/puppet/manifests/nodes

子產品存放目錄：/etc/puppet/modules

Puppet分發部署:

v 建立必要目錄

#mkdir -p /etc/puppet/modules/ssh/{manifests,templates,files}

#mkdir  /etc/puppet/modules/ssh/files/ssh

#mkdir  /etc/puppet/manifests/nodes

#chown -R puppet /etc/puppet/modules/

#ll /etc/puppet/modules/ssh

注：ssh/manifests目錄是ssh子產品配置檔案目錄，ssh/files是ssh子產品的檔案釋出目錄

v 建立子產品配置檔案

# vim /etc/puppet/modules/ssh/manifests/install.pp     确定用戶端是否安裝ssh服務

class  ssh::install{

package{ "openssh":

         ensure => present,

  }

}

# vim /etc/puppet/modules/ssh/manifests/config.pp     配置需要同步的檔案

class ssh::config{                                  定義類

file { "/etc/ssh/sshd_config":                         檔案路徑

        ensure => present,                         确定用戶端此檔案存在

        owner =>"root",                           檔案所屬使用者

        group =>"root",                           檔案所屬組

        mode =>"0600",                           檔案屬性

        source =>"puppet://$puppetserver/modules/ssh/ssh/sshd_config",從伺服器同步檔案

        require => Class["ssh::install"],               調用ssh：：install類

        notify => Class["ssh::service"],              如果config.pp發生變化通知service.pp

   }

# vim /etc/puppet/modules/ssh/manifests/service.pp

class ssh::service {                              定義類

        service {"sshd":                        

        ensure=>running,                       确定ssh在運作

        hasstatus=>true,                        檢視ssh服務狀态

        hasrestart=>true,                       重新開機ssh服務

        enable=>ture,                          伺服器是否開機

        require=>Class["ssh::config"]              調用ssh：：config類

      }

# vim /etc/puppet/modules/ssh/manifests/init.pp    子產品主配置檔案

class ssh{

     include  ssh::install,ssh::config,ssh::service    調用上面三個類

v 複制已修改好的ssh的配置檔案到預設目錄

# cp /etc/ssh/sshd_config  /etc/puppet/modules/ssh/files/ssh/

#chown puppet /etc/puppet/modules/ssh/files/ssh/sshd_config

v 建立節點配置檔案

# vim /etc/puppet/manifests/nodes/ssh.pp        

node 'client.test.cn' {                            定義用戶端入口

     include ssh

# vim /etc/puppet/manifests/nodes/site.pp          配置節點位置

import "nodes/ssh.pp"

同步方法：

v 用戶端主動拉取

#puppet agent -t

v 伺服器推送同步

2 用戶端

# echo "listen = true" >> /etc/puppet/puppet.conf

# echo "allow *" >> /etc/puppet/auth.conf

#/etc/init.d/puppetclient restart

#vim /etc/ssh/sshd_config

#netstat -lnupt |grep ssh

2 服務端