puppet安装以及遇到的问题

Puppet安装以及遇到的问题

主机名需要能够解析，相互之间能够解析。

1、puppet master的安装puppet

1)通过源代码安装

2)通过二进制的安装（yum apt-get...）

# wget -r ftp://192.168.0.254/notes/softwares/puppet

# tar xf puppet-2.7.23.tar.bz2

# cd puppet-2.7.23

# yum -y localinstall puppet-server-2.7.23-1.el6.noarch.rpm

puppet-2.7.23-1.el6.noarch.rpm facter-1.6.18-3.el6.x86_64.rpm

ruby-augeas-0.4.1-1.el6.x86_64.rpm ruby-shadow-1.4.1-13.el6.x86_64.rpm

2、在两个agnet上安装agent

# cd /root/puppet-2.7.23/

# yum -y localinstall puppet-2.7.23-1.el6.noarch.rpm facter-1.6.18-3.el6.x86_64.rpm ruby-augeas-0.4.1-1.el6.x86_64.rpm ruby-shadow-1.4.1-13.el6.x86_64.rpm

3、配置puppet master端

# rpm -ql puppet-server

/etc/puppet/fileserver.conf －－puppet内置的文件服务器

/etc/puppet/manifests －－全局的资源清单所在的目录

/etc/puppet/puppetmasterd.conf －－主配置文件

/etc/rc.d/init.d/puppetmaster －－启动脚本

/etc/sysconfig/puppetmaster

/usr/sbin/puppetmasterd

/usr/sbin/puppetqd

/usr/sbin/puppetrun

/usr/share/man/man8/filebucket.8.gz

/usr/share/man/man8/puppet-master.8.gz

/usr/share/man/man8/puppetmasterd.8.gz

/usr/share/man/man8/puppetqd.8.gz

/usr/share/man/man8/puppetrun.8.gz

获取帮助

# puppet help

# puppet xxx --help

获取master的配置文件列表

# puppet master --genconfig |grep -vE '(#)|^$' [master]

fileserverconfig = /etc/puppet/fileserver.conf manifest = /etc/puppet/manifests/site.pp

config = /etc/puppet/puppet.conf

rest_authconfig = /etc/puppet/auth.conf

yamldir = /var/lib/puppet/yaml

reportdir = /var/lib/puppet/reports

masterlog = /var/log/puppet/puppetmaster.log

modulepath = /etc/puppet/modules:/usr/share/puppet/modules server_datadir = /var/lib/puppet/server_data

pidfile = /var/run/puppet/master.pid

manifestdir = /etc/puppet/manifests

masterhttplog = /var/log/puppet/masterhttp.log

bucketdir = /var/lib/puppet/bucket

hostpubkey = /var/lib/puppet/ssl/public_keys/https://www.360docs.net/doc/3315047345.html,.pem inventory_terminus = yaml

publickeydir = /var/lib/puppet/ssl/public_keys

privatedir = /var/lib/puppet/ssl/private

statedir = /var/lib/puppet/state

factdest = /var/lib/puppet/facts/

hostcert = /var/lib/puppet/ssl/certs/https://www.360docs.net/doc/3315047345.html,.pem

route_file = /etc/puppet/routes.yaml

localcacert = /var/lib/puppet/ssl/certs/ca.pem

httplog = /var/log/puppet/http.log

certdir = /var/lib/puppet/ssl/certs

plugindest = /var/lib/puppet/lib

requestdir = /var/lib/puppet/ssl/certificate_requests

rundir = /var/run/puppet

passfile = /var/lib/puppet/ssl/private/password

factsource = puppet://puppet/facts/

hostprivkey = /var/lib/puppet/ssl/private_keys/https://www.360docs.net/doc/3315047345.html,.pem authconfig = /etc/puppet/namespaceauth.conf

hostcrl = /var/lib/puppet/ssl/crl.pem

ssldir = /var/lib/puppet/ssl

pluginsource = puppet://puppet/plugins

logdir = /var/log/puppet

privatekeydir = /var/lib/puppet/ssl/private_keys

factpath = /var/lib/puppet/lib/facter:/var/lib/puppet/facts

libdir = /var/lib/puppet/lib

hostcsr = /var/lib/puppet/ssl/csr_https://www.360docs.net/doc/3315047345.html,.pem resourcefile = /var/lib/puppet/state/resources.txt

report_port = 8140

lastrunfile = /var/lib/puppet/state/last_run_summary.yaml

graphdir = /var/lib/puppet/state/graphs

localconfig = /var/lib/puppet/state/localconfig

client_datadir = /var/lib/puppet/client_data

reportserver = puppet

inventory_server = puppet

ca_server = puppet

lastrunreport = /var/lib/puppet/state/last_run_report.yaml node_name_value = https://www.360docs.net/doc/3315047345.html,

statefile = /var/lib/puppet/state/state.yaml puppetdlog = /var/log/puppet/puppetd.log clientbucketdir = /var/lib/puppet/clientbucket

classfile = /var/lib/puppet/state/classes.txt

report_server = puppet

inventory_port = 8140

ca_port = 8140

puppetdlockfile = /var/lib/puppet/state/puppetdlock splaylimit = 1800

clientyamldir = /var/lib/puppet/client_yaml

cacert = /var/lib/puppet/ssl/ca/ca_crt.pem

cacrl = /var/lib/puppet/ssl/ca/ca_crl.pem

serial = /var/lib/puppet/ssl/ca/serial

signeddir = /var/lib/puppet/ssl/ca/signed

cert_inventory = /var/lib/puppet/ssl/ca/inventory.txt

ca_name = Puppet CA: https://www.360docs.net/doc/3315047345.html,

cakey = /var/lib/puppet/ssl/ca/ca_key.pem caprivatedir = /var/lib/puppet/ssl/ca/private

capass = /var/lib/puppet/ssl/ca/private/ca.pass

cadir = /var/lib/puppet/ssl/ca

capub = /var/lib/puppet/ssl/ca/ca_pub.pem

csrdir = /var/lib/puppet/ssl/ca/requests

autosign = /etc/puppet/autosign.conf

templatedir = /var/lib/puppet/templates

tagmap = /etc/puppet/tagmail.conf

rrdinterval = 1800

rrddir = /var/lib/puppet/rrd

railslog = /var/log/puppet/rails.log

dblocation = /var/lib/puppet/state/clientconfigs.sqlite3

archive_file_server = puppet

deviceconfig = /etc/puppet/device.conf

devicedir = /var/lib/puppet/devices

module_working_dir = /var/lib/puppet/puppet-module

4、一个简单的文件应用

做好域名的解析工作，保证master和agent之间的域名解析是正常的，所以保证你3台机器的hosts文件都是以下的状态:

# vim /etc/hosts

127.0.0.1 localhost.localdomainlocalhost.localdomain localhost4

localhost4.localdomain4 localhost

::1localhost.localdomainlocalhost.localdomain localhost6 localhost6.localdomain6 localhost

192.168.5.245 master

192.168.5.225 agent1

192.168.5.226 agent2

服务端的配置：

# vim /etc/puppet/manifests/site.pp －－创建一个全局的资源清单

file { "/var/tmp/abc.txt":

ensure => present,

owner =>youboy,

group =>youboy,

mode => 0600,

content => "hello puppet agent";

}

有两种启动方式

# /etc/init.d/puppetmasterd start －－正常模式

# puppet master --verbose --debug --no-daemonize& －－调试模式

两个客户端的配置：

1）指定master是谁

# vim /etc/puppet/puppet.conf

[main]

logdir = /var/log/puppet

rundir = /var/run/puppet

ssldir = $vardir/ssl

server = master －－修改此行

[agent]

classfile = $vardir/classes.txt

localconfig = $vardir/localconfig

2）以调试模式启动agnet

# /etc/init.d/puppet start －－正常模式

# puppet agent --server=master --verbose --no-daemonize --onetime －－调试模式（此时agent会向master申请证书）

3)在master上颁发证书给两个agnet

# puppet cert --list －－查看当前master是否已经接受到两个agent的证书请求"agent1" (2B:C3:05:08:39:C7:7F:2D:68:9E:4F:73:D6:86:27:97)

"agent2" (86:26:3B:93:EC:F9:DD:ED:31:A0:76:F1:27:F6:81:99)

颁发证书

# puppet cert --sign agent1

notice: Signed certificate request for agent1

notice: Removing file Puppet::SSL::CertificateRequest agent1 at

'/var/lib/puppet/ssl/ca/requests/agent1.pem'

# puppet cert --sign agent2

notice: Signed certificate request for agent2

notice: Removing file Puppet::SSL::CertificateRequest agent2 at

'/var/lib/puppet/ssl/ca/requests/agent2.pem'

4)以调试模式在agent上执行puppet agent的服务

# puppet agent --server=master --verbose --no-daemonize --onetime info: Caching certificate for agent2

info: Caching certificate_revocation_list for ca

info: Caching catalog for agent2

info: Applying configuration version '1387097919'

notice: /Stage[main]//File[/var/tmp/abc.txt]/ensure: created

info: Creating state file /var/lib/puppet/state/state.yaml

notice: Finished catalog run in 0.04 seconds

5）查看结果是否是你定义的结果

# ll /var/tmp/

总用量4

-rw------- 1 u01 group 19 12月15 16:58 abc.txt

# cat /var/tmp/abc.txt

hello puppet agent

6）测试agent和master之间的同步（默认是30分钟）

为了测试把间隔改成5秒（在两个agenet上改，不需要到master上改）# vim /etc/puppet/puppet.conf

[main]

logdir = /var/log/puppet

rundir = /var/run/puppet

ssldir = $vardir/ssl

server = https://www.360docs.net/doc/3315047345.html,

runinterval = 5

[agent]

classfile = $vardir/classes.txt

localconfig = $vardir/localconfig

7）在master上配置文件服务器

# vim /etc/puppet/fileserver.conf

[share]

path /var/tmp/fileserver

allow 192.168.5.0/24

# mkdir /var/tmp/fileserver

# touch /var/tmp/fileserver/abc.txt

8）使用共享服务器发布配置文件

# vim /etc/puppet/manifests/site.pp file {

"/var/tmp/abc.txt":

ensure => present,

owner =>youboy,

group =>youboy,

mode => 0600,

source => "puppet:///share/abc.txt";

}

9)如何让不同的客户加载不同资源（在服务的资源清单上写如下内容：）# vim /etc/puppet/manifests/site.pp

node 'agent1' {

file { "/var/tmp/abc.txt":

ensure => present,

owner =>youboy,

group =>youboy,

mode => 0600,

content => "hello puppet agent1\nhaha\nhehe\n";

}

}

node 'agent2' {

file { "/var/tmp/bcd.txt":

ensure => present,

owner =>youboy,

group =>youboy,

mode => 0600,

content => "hello puppet agent2\n";

}

}

1、客户端想服务端发出证书申请无效，报错：

# puppet agent --server=master --verbose --no-daemonize --onetime Exiting; no certificate found and waitforcert is disabled

处理方法：

在agent端：mv /var/lib/puppet /tmp/

2、自己指定的hosts是无效的，解析不了

err: Could not retrieve catalog from remote server: Server hostname 'master' did not match server certificate; expected one of 132.bogon, DNS:132.bogon, DNS:puppet, DNS:puppet.bogon

notice: Using cached catalog

err: Could not retrieve catalog; skipping run

err: Could not send report: Server hostname 'master' did not match server certificate; expected one of 132.bogon, DNS:132.bogon, DNS:puppet,

DNS:puppet.bogon

处理方法：

删掉/var/lib/puppet/重新来过