一、簡介
puppet是什么？它能做什么？
puppet是一個IT基礎設施自動化運維工具，它能夠幫助系統管理員管理基礎設施的整個生命周期；比如，安裝服務，提供組態檔，啟動服務等等一系列操作；基于puppet，可實作自動化重復任務、快速部署關鍵性應用以及在本地或云端完成主動變更和快速擴展架構規模等；它遵循GPL協議（2.7.0以前），基于ruby語言開發，2.7.0以后使用apache 2.0協議；
puppet架構
提示：puppet是master/agent架構，master和agent使用https通信；puppet有兩種作業方式，第一種是standalone模式，這種方式通常運行在單機之上；另一種則是master/agent模式，這種模式master和agent運行在不同的服務器之上；
puppet作業流程
提示：puppet作業流程分4個步驟，第一個步驟是定義manifast，這個步驟由管理員完成，主要通過過puppet的宣告性配置語言定義基礎設施配置的目標狀態；第二個步驟是模擬，所謂模擬就是把我們定義的manifest，在目標主機上試著運行一遍，但不真正的應用（不改變目標主機的狀態）；這一步主要用來檢查我們定義的manifest是否有語法錯誤等等；第三步是強制，所謂強制就是把目標主機狀態強制改變為我們在manifest中定義的狀態；最后一步就是報告，報告就是指我們當前目標主機的狀態和manifest中定義的狀態的不同，以及達成目標狀態所進行的改變資訊；
puppet standalone模式作業程序
提示：在單機模式下，puppet的執行程序如上圖；首先puppet會把我們寫的manifest檔案進行編譯，編譯成為代碼這個為代碼有點類似java中的位元組碼；然后puppet把編譯的結果應用到對應的目標主機上；在應用之前它首先要對比目標主機當前狀態和我們定義的目標狀態是否一樣，如果一樣則跳過不更改其狀態，如果不一樣則強制讓目標主機當前狀態和我們定義的目標狀態一樣，最后將執行的程序報告給管理員；這里值得注意的是，在單機模型下，puppet應用manifest時，是我們人工手動指定來應用；
puppet master/agent模式作業程序
提示：master/agent模型，總的流程和單機模型類似，都是先編譯然后再到應用；不同的是master/agent模型管理員可以不用手動應用manifest，默認情況下agent會每隔30分鐘就到master拉取和自己相關的配置，如果對應master端有和自己相關的新配置，它會將其拉取到本地，然后強制執行，也就是說每隔30分鐘各個agent會來master同步配置，如果對應目標主機當前狀態和我們定義的目標狀態不一樣，最遲30分鐘會自動修復；
二、puppet單機模型的安裝和使用
安裝puppet
[root@node12 ~]# yum install -y puppet
提示：單機模型我們只需要安裝puppet即可；這個包來源epel倉庫，安裝之前，請確保epel倉庫配置正常；另外在epel倉庫中這個包的版本稍微有點低，如果要使用最新版本可以到https://yum.puppet.com這個倉庫中下載對應版本的包進行安裝即可；
puppet的基礎使用
查看puppet工具幫助
[root@node12 ~]# puppet help
Usage: puppet <subcommand> [options] <action> [options]
Available subcommands:
agent The puppet agent daemon
apply Apply Puppet manifests locally
ca Local Puppet Certificate Authority management.
catalog Compile, save, view, and convert catalogs.
cert Manage certificates and requests
certificate Provide access to the CA for certificate management.
certificate_request Manage certificate requests.
certificate_revocation_list Manage the list of revoked certificates.
config Interact with Puppet's settings.
describe Display help about resource types
device Manage remote network devices
doc Generate Puppet documentation and references
facts Retrieve and store facts.
file Retrieve and store files in a filebucket
filebucket Store and retrieve files in a filebucket
help Display Puppet help.
inspect Send an inspection report
instrumentation_data Manage instrumentation listener accumulated data.
instrumentation_listener Manage instrumentation listeners.
instrumentation_probe Manage instrumentation probes.
key Create, save, and remove certificate keys.
kick Remotely control puppet agent
man Display Puppet manual pages.
master The puppet master daemon
module Creates, installs and searches for modules on the Puppet Forge.
node View and manage node definitions.
parser Interact directly with the parser.
plugin Interact with the Puppet plugin system.
queue Deprecated queuing daemon for asynchronous storeconfigs
report Create, display, and submit reports.
resource The resource abstraction layer shell
resource_type View classes, defined resource types, and nodes from all manifests.
secret_agent Mimics puppet agent.
status View puppet server status.
See 'puppet help <subcommand> <action>' for help on a specific subcommand action.
See 'puppet help <subcommand>' for help on a specific subcommand.
Puppet v3.6.2
[root@node12 ~]#
提示：puppet這個工具有很多子命令，對應不同的子命令有不同的選項，同時對應不同的子命令有著不同的操作命令，不同操作命令對應不同的選項；
查詢對應子命令的幫助
查看describe子命令的幫助說明
[root@node12 ~]# puppet describe --help
puppet-describe(8) -- Display help about resource types
========
SYNOPSIS
--------
Prints help about Puppet resource types, providers, and metaparameters.
USAGE
-----
puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta]
OPTIONS
-------
* --help:
Print this help text
* --providers:
Describe providers in detail for each type
* --list:
List all types
* --meta:
List all metaparameters
* --short:
List only parameters without detail
EXAMPLE
-------
$ puppet describe --list
$ puppet describe file --providers
$ puppet describe user -s -m
AUTHOR
------
David Lutterkort
COPYRIGHT
---------
Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
[root@node12 ~]#
提示：describe這個子命令主要用來顯示資源型別的幫助資訊；在puppet中所謂資源指我們能夠操作目標主機的物件，比如創建用戶，那么這個用戶資源就是我們操作的物件，創建用戶組，對應組就是我們操作的物件；
查看puppet支持的資源型別串列
[root@node12 ~]# puppet describe --list These are the types known to puppet: augeas - Apply a change or an array of changes to the ... computer - Computer object management using DirectorySer ... cron - Installs and manages cron jobs exec - Executes external commands file - Manages files, including their content, owner ... filebucket - A repository for storing and retrieving file ... group - Manage groups host - Installs and manages host entries interface - This represents a router or switch interface k5login - Manage the `.k5login` file for a user macauthorization - Manage the Mac OS X authorization database mailalias - .. no documentation .. maillist - Manage email lists mcx - MCX object management using DirectoryService ... mount - Manages mounted filesystems, including puttin ... nagios_command - The Nagios type command nagios_contact - The Nagios type contact nagios_contactgroup - The Nagios type contactgroup nagios_host - The Nagios type host nagios_hostdependency - The Nagios type hostdependency nagios_hostescalation - The Nagios type hostescalation nagios_hostextinfo - The Nagios type hostextinfo nagios_hostgroup - The Nagios type hostgroup nagios_service - The Nagios type service nagios_servicedependency - The Nagios type servicedependency nagios_serviceescalation - The Nagios type serviceescalation nagios_serviceextinfo - The Nagios type serviceextinfo nagios_servicegroup - The Nagios type servicegroup nagios_timeperiod - The Nagios type timeperiod notify - .. no documentation .. package - Manage packages resources - This is a metatype that can manage other reso ... router - .. no documentation .. schedule - Define schedules for Puppet scheduled_task - Installs and manages Windows Scheduled Tasks selboolean - Manages SELinux booleans on systems with SELi ... selmodule - Manages loading and unloading of SELinux poli ... service - Manage running services ssh_authorized_key - Manages SSH authorized keys sshkey - Installs and manages ssh host keys stage - A resource type for creating new run stages tidy - Remove unwanted files based on specific crite ... user - Manage users vlan - .. no documentation .. whit - Whits are internal artifacts of Puppet's curr ... yumrepo - The client-side description of a yum reposito ... zfs - Manage zfs zone - Manages Solaris zones zpool - Manage zpools [root@node12 ~]#
查看對應資源型別的使用幫助
查看user資源型別的幫助
[root@node12 ~]# puppet describe user
user
====
Manage users. This type is mostly built to manage system
users, so it is lacking some features useful for managing normal
users.
This resource type uses the prescribed native tools for creating
groups and generally uses POSIX APIs for retrieving information
about them. It does not directly modify `/etc/passwd` or anything.
**Autorequires:** If Puppet is managing the user's primary group (as
provided in the `gid` attribute), the user resource will autorequire
that group. If Puppet is managing any role accounts corresponding to the
user's roles, the user resource will autorequire those role accounts.
Parameters
----------
- **allowdupe**
Whether to allow duplicate UIDs. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **attribute_membership**
Whether specified attribute value pairs should be treated as the
**complete list** (`inclusive`) or the **minimum list** (`minimum`) of
attribute/value pairs for the user. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **attributes**
Specify AIX attributes for the user in an array of attribute = value
pairs.
Requires features manages_aix_lam.
- **auth_membership**
Whether specified auths should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of auths the user
has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **auths**
The auths the user has. Multiple auths should be
specified as an array.
Requires features manages_solaris_rbac.
- **comment**
A description of the user. Generally the user's full name.
- **ensure**
The basic state that the object should be in.
Valid values are `present`, `absent`, `role`.
- **expiry**
The expiry date for this user. Must be provided in
a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
If you want to make sure the user account does never
expire, you can pass the special value `absent`.
Valid values are `absent`. Values can match `/^\d{4}-\d{2}-\d{2}$/`.
Requires features manages_expiry.
- **forcelocal**
Forces the mangement of local accounts when accounts are also
being managed by some other NSS
Valid values are `true`, `false`, `yes`, `no`.
Requires features libuser.
- **gid**
The user's primary group. Can be specified numerically or by name.
This attribute is not supported on Windows systems; use the `groups`
attribute instead. (On Windows, designating a primary group is only
meaningful for domain accounts, which Puppet does not currently manage.)
- **groups**
The groups to which the user belongs. The primary group should
not be listed, and groups should be identified by name rather than by
GID. Multiple groups should be specified as an array.
- **home**
The home directory of the user. The directory must be created
separately and is not currently checked for existence.
- **ia_load_module**
The name of the I&A module to use to manage this user.
Requires features manages_aix_lam.
- **iterations**
This is the number of iterations of a chained computation of the
password hash (http://en.wikipedia.org/wiki/PBKDF2). This parameter
is used in OS X. This field is required for managing passwords on OS X
>= 10.8.
Requires features manages_password_salt.
- **key_membership**
Whether specified key/value pairs should be considered the
**complete list** (`inclusive`) or the **minimum list** (`minimum`) of
the user's attributes. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **keys**
Specify user attributes in an array of key = value pairs.
Requires features manages_solaris_rbac.
- **managehome**
Whether to manage the home directory when managing the user.
This will create the home directory when `ensure => present`, and
delete the home directory when `ensure => absent`. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **membership**
Whether specified groups should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of groups to which
the user belongs. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **name**
The user name. While naming limitations vary by operating system,
it is advisable to restrict names to the lowest common denominator,
which is a maximum of 8 characters beginning with a letter.
Note that Puppet considers user names to be case-sensitive, regardless
of the platform's own rules; be sure to always use the same case when
referring to a given user.
- **password**
The user's password, in whatever encrypted format the local
system requires.
* Most modern Unix-like systems use salted SHA1 password hashes. You can
use
Puppet's built-in `sha1` function to generate a hash from a password.
* Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
* Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs
[stdlib][]
module contains a `str2saltedsha512` function which can generate
password
hashes for Lion.
* Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
managing passwords on these systems the salt and iterations properties
need to be specified as well as the password.
* Windows passwords can only be managed in cleartext, as there is no
Windows API
for setting the password hash.
[stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
Be sure to enclose any value that includes a dollar sign ($) in single
quotes (') to avoid accidental variable interpolation.
Requires features manages_passwords.
- **password_max_age**
The maximum number of days a password may be used before it must be
changed.
Requires features manages_password_age.
- **password_min_age**
The minimum number of days a password must be used before it may be
changed.
Requires features manages_password_age.
- **profile_membership**
Whether specified roles should be treated as the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of roles
of which the user is a member. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **profiles**
The profiles the user has. Multiple profiles should be
specified as an array.
Requires features manages_solaris_rbac.
- **project**
The name of the project associated with a user.
Requires features manages_solaris_rbac.
- **purge_ssh_keys**
Purge ssh keys authorized for the user
if they are not managed via ssh_authorized_keys. When true,
looks for keys in .ssh/authorized_keys in the user's home
directory. Possible values are true, false, or an array of
paths to file to search for authorized keys. If a path starts
with ~ or %h, this token is replaced with the user's home directory.
Valid values are `true`, `false`.
- **role_membership**
Whether specified roles should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of roles the user
has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **roles**
The roles the user has. Multiple roles should be
specified as an array.
Requires features manages_solaris_rbac.
- **salt**
This is the 32 byte salt used to generate the PBKDF2 password used in
OS X. This field is required for managing passwords on OS X >= 10.8.
Requires features manages_password_salt.
- **shell**
The user's login shell. The shell must exist and be
executable.
This attribute cannot be managed on Windows systems.
Requires features manages_shell.
- **system**
Whether the user is a system user, according to the OS's criteria;
on most platforms, a UID less than or equal to 500 indicates a system
user. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **uid**
The user ID; must be specified numerically. If no user ID is
specified when creating a new user, then one will be chosen
automatically. This will likely result in the same user having
different UIDs on different systems, which is not recommended. This is
especially noteworthy when managing the same user on both Darwin and
other platforms, since Puppet does UID generation on Darwin, but
the underlying tools do so on other platforms.
On Windows, this property is read-only and will return the user's
security identifier (SID).
Providers
---------
aix, directoryservice, hpuxuseradd, ldap, pw, user_role_add, useradd,
windows_adsi
[root@node12 ~]#
提示：以上從以上幫助資訊可以看到，我們定義在目標主機上創建用戶可以使用user這個資源型別，其中對應有很多屬性，這些屬性主要用來描述對應資源該有的屬性，比如uid用來描述用戶的id，gid用于描述組id；
定義資源清單語法
type {'title':
attribute1 => value1,
atrribute2 => value2,
……
}
提示：type指資源型別，type必須使用小寫字符；title是一個字串，在同一型別中必須惟一；
資源屬性中的三個特殊屬性：
Namevar， 可簡稱為name；
ensure：資源的目標狀態；
Provider：指明資源的管理介面；
示例：定義manifest，創建用戶
[root@node12 ~]# cat user.pp
user{'tom':
ensure => present,
uid => 5000,
home => '/home/tom',
shell => '/bin/bash',
comment => 'this is test user',
}
[root@node12 ~]#
提示：上述資源清單中，沒有用name指定對應資源型別的名稱，如果沒有指定默認使用title的值作為其資源型別的名稱；資源清單使用.pp為后綴，意思就是puppet的簡寫；
應用資源清單
[root@node12 ~]# puppet apply -v --noop user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.07 seconds Info: Applying configuration version '1606542594' Notice: /Stage[main]/Main/User[tom]/ensure: current_value absent, should be present (noop) Notice: Class[Main]: Would have triggered 'refresh' from 1 events Notice: Stage[main]: Would have triggered 'refresh' from 1 events Info: Creating state file /var/lib/puppet/state/state.yaml Notice: Finished catalog run in 0.02 seconds [root@node12 ~]#
提示：應用資源清單使用puppet apply命令，其中-v用于指定顯示執行輸出程序；--noop用于指定干跑，不應用，主要檢測對應的manifast檔案是否有語法錯誤；如果沒有語法錯誤，我們就可以把對應noop選項取消，然后真正應用其資源清單到本地；
[root@node12 ~]# puppet apply -v user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.06 seconds Info: Applying configuration version '1606542785' Notice: /Stage[main]/Main/User[tom]/ensure: created Notice: Finished catalog run in 0.05 seconds [root@node12 ~]#
驗證：查看tom用戶是否創建呢？
[root@node12 ~]# getent passwd tom tom:x:5000:5000:this is test user:/home/tom:/bin/bash [root@node12 ~]#
提示：可以看到對應tom用戶已經創建成功，并且uid，注釋資訊和家目錄，shell等資訊都是我們指定的內容；
示例：洗掉tom用戶
[root@node12 ~]# cat user.pp
user{'tom':
ensure => absent,
uid => 5000,
home => '/home/tom',
shell => '/bin/bash',
comment => 'this is test user',
}
[root@node12 ~]#
提示：ensure這個屬性主要指定對應資源型別在目標主機上的狀態，absent表示缺席之意，如果對應主機上有tom用戶就洗掉；
驗證：應用資源清單，看看tom用戶是否被洗掉？
[root@node12 ~]# puppet apply -v user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.25 seconds Info: Applying configuration version '1606574872' Notice: /Stage[main]/Main/User[tom]/ensure: removed Notice: Finished catalog run in 0.11 seconds [root@node12 ~]# getent passwd tom [root@node12 ~]# id tom id: tom: no such user [root@node12 ~]#
提示：可以看到應用了資源清單以后，本機的tom用戶就被洗掉了；
以上就是puppet的基礎使用方式，在使用puppet我們最核心的就是要寫manifest（資源清單），就是我們要讓某資源處于什么狀態，就用puppet的配置語言描述，然后使用puppet apply命令應用對應的資源清單即可；
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/228088.html
標籤：Linux
上一篇：請教，xorg是否是ubuntu 18.04遠程桌面服務器的一種呢 ？
下一篇：QT