Puppet安装以及集成Dashboard手册
Puppet安装以及集成Dashboard手册
Puppet简介
puppet是一种Linux、Unix、windows平台的集中配置管理系统，使用自有的puppet描述语言，可管理配置文件、用户、cron任务、软件包、系统服务等。puppet把这些系统实体称之为资源，puppet的设计目标是简化对这些资源的管理以及妥善处理资源间的依赖关系。
puppet采用C/S星状的结构，所有的客户端和一个或几个服务器交互。每个客户端周期的（默认半个小时）向服务器发送请求，获得其最新的配置信息，保证和该配置信息同步。每个puppet客户端每半小时(可以设置)连接一次服务器端,
下载最新的配置文件,并且严格按照配置文件来配置服务器.
配置完成以后,puppet客户端可以反馈给服务器端一个消息.
如果出错,也会给服务器端反馈一个消息.
安装前准备
测试机环境
系统
角色
IP
主机名
CentOS 6.5/CentOS 5.5
都是相同步骤
Master
10.2.180.183
app180-183.test.com
CentOS 5.5
Client
10.2.180.181
app180-181.test.com
CentOS 6.4
Client
10.2.180.184
app180-184.test.com
1.
关闭selinux
sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config;setenforce 0
2.
关闭iptable
chkconfigiptables off;service iptables stop
3.
时间同步
ntpdatetime.nist.gov;echo '*/10 * * * * ntpdate time.nist.gov' >>/var/spool/cron/root
4.
配置域名解析，或直接在hosts里配置主机名
5.
配置epol及puppet源
Enterprise Linux 6
rpm -ivhhttp://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm
rpm -ivhhttp://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
Enterprise Linux 5
rpm -ivhhttp://yum.puppetlabs.com/puppetlabs-release-el-5.noarch.rpm
rpm -ivhhttp://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm
保留yum下载的rpm包
sed -i s/keepcache=.*/keepcache=1/g /etc/yum.conf
安装master和agent
Master
Puppet Master Server安装,安装时最新版服务端为3.6.1-1
yum-y install puppet-server
更新
puppet resource package puppet-server ensure=latest
配置
chkconfigpuppetmaster on;service puppetmaster start
启动后会自动在/var/lib/puppet/ssl下生成主机名.pem的ca文件。
Nodes
Puppet Agent Nodes 安装,安装时最新版客户端为3.6.1-1
yum-y install puppet
更新
puppet resource package puppet ensure=latest
node配置连接到puppet-master
sed -i 's/#PUPPET_SERVER=puppet/PUPPET_SERVER=app180-183.test.com/g' /etc/sysconfig/puppet
sed -i 's/#PUPPET_PORT=8140/PUPPET_PORT=8140/g' /etc/sysconfig/puppet
sed -i 's/#PUPPET_LOG=\/var\/log\/puppet\/puppet.log/PUPPET_LOG=\/var\/log\/puppet\/puppet.log/g' /etc/sysconfig/puppet
#runinterval = 60//代表60秒跟服务器同步一次
echo " report = true" >> /etc/puppet/puppet.conf
echo " runinterval = 60" >> /etc/puppet/puppet.conf
chkconfig puppet on;service puppet start
还有一种同步方式节省内存，直接cron方式，定时调用。使用下面语句增加crontab任务
puppet resource cron puppet-agent ensure=present user=root minute=30 command='/usr/bin/puppet agent --onetime --no-daemonize --splay'
crontab -l
启动后会自动在/var/lib/puppet/ssl下生成主机名.pem的ca文件。
CA认证
node
启动agent后会生成主机名.pem的证书文件，自动向master要求签名的。
如果node主机名改变了需要删除原证书文件，并在master上clean原客户端名字，然后重新生成证书并要求签名。
删除证书文件
rm -rf/var/lib/puppet/ssl/*
可以使用调试模式生成证书。
puppet agent --no-daemonize --debug --onetime --verbose --server=app180-183.test.com
master端
列出需要签发的客户端
puppet cert list
签发指定客户端
puppet cert sign app180-181.test.com
签发所有客户端请求
puppet cert sign --all
注销客户端证书
puppet cert revoke app180-181.test.com
清除客户端证书
puppet cert clean app180-181.test.com
master自动签名配置
在服务器端的puppet.conf配置文件里面加上
autosign = true
或直接建立文件
echo "*.test.com" >> /etc/puppet/autosign.conf
puppet报告系统Dashboard部署
Puppet Dasshboard是由支持Puppet开发的公司Puppetlabs创建的，是Ruby on Rails程序。可以作为一个ENC（外部节点分类器）以及一个报告工具，并且正在逐渐成为一个包含许多Puppet新功能的集成界面，例如审计和资源管理功能。 Puppet Dashboard是一个Ruby on Rails程序，用于显示Puppet master和agent的相关信息。它允许你查看从一个或多个Puppet master汇总的图形和报告数据。它同时从一个或者多个Puppet master上收集来自于Puppet agent的资产数据（主机的Fact和其他信息）。最后，它能作为一个ENC来配置Puppet节点，并指定这些节点上的类和参数。
安装软件包
yum install ruby-mysqlmysql-server puppet-dashboard
配置数据库
chkconfigmysqldon;servicemysqld start
mysqladmin -uroot password 123456
mysql建库脚本
CREATE DATABASE dashboard CHARACTER SET utf8;
CREATE USER 'dashboard'@'localhost' IDENTIFIED BY '123456';
GRANT ALL PRIVILEGES ON dashboard.* TO 'dashboard'@'localhost';
flush privileges;
优化数据库
# Allowing 32MB allows an occasional 17MB row with plenty of spare room
max_allowed_packet = 32M
然后重启mysqld
修改dashboard链接数据库配置
vi /usr/share/puppet-dashboard/config/database.yml
把production段改为如下内容，其它段可不用改
建立 Schema
cd /usr/share/puppet-dashboard/
rake gems:refresh_specs#修复什么东西
rake RAILS_ENV=production db:migrate
没有报错的话,数据库就建立完成了。
查看数据库
mysql> show tables;
+------------------------------+
| Tables_in_dashboard |
+------------------------------+
| delayed_job_failures |
| delayed_jobs |
| metrics |
| node_class_memberships |
| node_classes |
| node_group_class_memberships |
| node_group_edges |
| node_group_memberships |
| node_groups |
| nodes |
| old_reports |
| parameters |
| report_logs |
| reports |
| resource_events |
| resource_statuses |
| schema_migrations |
| timeline_events |
+------------------------------+
18 rows in set (0.00 sec)
测试DashBoard是否工作
cd /usr/share/puppet-dashboard/
./script/server -e production
你可以直接使用http://dashboardserver:3000访问.
运行Dashboard（WEBrick方式）
/etc/init.d/puppet-dashboard start
访问http://dashboardserver:3000
这种方式只是测试运行的时候使用，官方不推荐，不支持并发，只适合少量客户端。
安装配置Passenger方式
yum install openssl-develzlib-devel curl-develgcc-c++httpdhttpd-develmod_ssl ruby-develrubygemsgcc
安装Rack/Passenger
Passenger是Apache 2.x的一个扩展，用来在Apache中运行Rails或Rack应用。puppetmaster默认使用WEBrick提供文件服务，如果你的puppet客户端很多，puppetmaster的文件服务性能会很差，为了使puppetmaster更健壮，所以使用Apache提供文件服务。
gem install rack passenger#这个可以本地安装的
通过下面脚本下载
for i in daemon_controller-1.2.0 json-1.5.5 passenger-4.0.43 rack-1.5.2 rake-0.8.7
do
wget http://rubygems.org/downloads/$i.gem
done
然后
gem install --local *.gem
passenger-install-apache2-module
安装Puppet Master Rack Application
mkdir -p /usr/share/puppet/rack/puppetmasterd
mkdir/usr/share/puppet/rack/puppetmasterd/public /usr/share/puppet/rack/puppetmasterd/tmp
cp /usr/share/puppet/ext/rack/config.ru /usr/share/puppet/rack/puppetmasterd/
chownpuppet:puppet /usr/share/puppet/rack/puppetmasterd/config.ru
创建启用Puppet Master Vhost
配置passenger模块
vi /etc/httpd/conf.d/passenger.conf
LoadModulepassenger_module /usr/lib/ruby/gems/1.8/gems/passenger-4.0.42/buildout/apache2/mod_passenger.so
<IfModulemod_passenger.c>
PassengerRoot /usr/lib/ruby/gems/1.8/gems/passenger-4.0.42
PassengerDefaultRuby /usr/bin/ruby
</IfModule>
配置vhost
cp /usr/share/puppet/ext/rack/example-passenger-vhost.conf /etc/httpd/conf.d/passenger-vhost.conf
# vi passenger-vhost.conf
# This Apache 2 virtual host config shows how to use Puppet as a Rack
# application via Passenger. See
# http://docs.puppetlabs.com/guides/passenger.html for more information.
# You can also use the included config.ru file to run Puppet with other Rack
# servers instead of Passenger.
# you probably want to tune these settings
PassengerHighPerformance on
PassengerMaxPoolSize 12
PassengerPoolIdleTime 1500
# PassengerMaxRequests 1000
PassengerStatThrottleRate 120
#RackAutoDetect Off
#RailsAutoDetect Off
Listen 8140
<VirtualHost *:8140>
SSLEngine on
SSLProtocol ALL -SSLv2
SSLCipherSuite ALL:!aNULL:!eNULL:!DES:!3DES:!IDEA:!SEED:!DSS:!PSK:!RC4:!MD5:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP
SSLHonorCipherOrder on
SSLCertificateFile /var/lib/puppet/ssl/ca/signed/app180-183.test.com.pem
SSLCertificateKeyFile /var/lib/puppet/ssl/private_keys/app180-183.test.com.pem
SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCACertificateFile /var/lib/puppet/ssl/ca/ca_crt.pem
# If Apache complains about invalid signatures on the CRL, you can try disabling
# CRL checking by commenting the next line, but this is not recommended.
SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem
SSLVerifyClient optional
SSLVerifyDepth1
# The `ExportCertData` option is needed for agent certificate expiration warnings
SSLOptions +StdEnvVars +ExportCertData
# This header needs to be set if using a loadbalancer or proxy
RequestHeader unset X-Forwarded-For
RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
DocumentRoot /usr/share/puppet-dashboard/public
RackBaseURI /
PassengerAppRoot /usr/share/puppet/rack/puppetmasterd
<Directory /usr/share/puppet-dashboard/>
Options None
AllowOverride None
Order allow,deny
allow from all
</Directory>
</VirtualHost>
Listen 3001
NameVirtualHost *:3001
<VirtualHost *:3001>
DocumentRoot /usr/share/puppet-dashboard/public/
#ErrorLog /var/log/httpd/dashboard_error.log
#CustomLog /var/log/httpd/dashboard_access.log combined
#RailsAutoDetect On
AddDefaultCharset UTF-8
RailsEnv production
<Location "/">
Options None
AllowOverride None
Order allow,deny
allow from all
</Location>
</VirtualHost>
关闭WEBrick，的puppetmaset,并启用 apache替代puppetmaset
chkconfigpuppetmaster off ;service puppetmaster stop
chkconfigpuppet-dashboardoff;service puppet-dashboard stop
chkconfighttpdon;servicehttpd restart
导入报告(方式一)
cd /usr/share/puppet-dashboard/
rake RAILS_ENV=production reports:import#导入已经存在的报告
备注：默认节点报告会在/var/lib/puppet/reports/
产生，如果路径发生变化，导入报告时需要在后面加上“REPORT_DIR=report路径”，reports更改路径可在puppet.conf中设置参数“reportdir =
新路径”，这种方式不够实时。
配置自动导入汇总(方式二)
Node操作
vim/etc/puppet/puppet.conf
# In the section
server = puppet
#从2.7.0版本开始，报告系统会默认开启，不需要配置
report = true
pluginsync = true
Master操作
#定义为http报告处理器，除此之外还有store，log，tagmail，rrdgraph等报告处理器
reports = http
#http报告处理器将puppet报告发送到一个HTTP URL和端口（Dashboard位置）。Puppet报告以被转储为HTTP
Poort形式的YAML格式进行发送。
reporturl = http://10.2.180.183:3001/reports/upload
开启后台处理报告进程
cd /usr/share/puppet-dashboard/ && rake RAILS_ENV=production jobs:work&
把这条加入/etc/rc.local
修改dashboard时区
Dashboard默认时区为UTC格式，我们这里需要更改为CST（Asia/Shanghai）格式
vim /usr/share/puppet-dashboard/config/settings.yml
time_zone: 'Asia/Shanghai'
**备注**：设置的settings.yml会覆盖掉config/environment.rb中对应的配置项（config.time_zone
= 'UTC'）
关于puppet3.6.1的备注：
http://roidelapluie.be/tag/automation.html
Puppet 3.6.1 depreciation warning
Dear puppet users using a yum-based distribution1,
once you will upgrade topuppet 3.6.1, you will notice the following warning message each time
you use a package type:
Warning: The package type's allow_virtual parameter will be changing its
default value from false to true in a future release. If you do not want to
allow virtual packages, please explicitly set allow_virtual to false.
(at /usr/lib/ruby/site_ruby/1.8/puppet/type.rb:816:in `set_default')
There is nothing you can do with that except setting a global parameter in your puppet tree, as stated in the release
notes:
Package{
allow_virtual=>true,
}
I don't see any reason to have such a warning if enough information is given in the release
notes. This disturbing behaviour is discussed in issue PUP-2650 and
in the mailing list.
PUPPET bug列表
配置正确的情况下出现报错，可以到下面网址去搜索，就像上面的错误问百度找不到，开google打不开，在bing.com上翻了好多页才找到一条，到下面网址直接就出来了。
https://tickets.puppetlabs.com/browse/PUP
页:
[1]