[root@master ~]# puppet describe -l These are the types known to puppet: augeas - Apply a change or an array of changes to the ... computer - Computer object management using DirectorySer ... cron - Installs and manages cron jobs exec - Executes external commands file - Manages files, including their content, owner ... filebucket - A repository for storing and retrieving file ... group - Manage groups ...(omitted)
[root@master manifest]# puppet apply -v test1.pp Notice: Compiled catalog for master in environment production in 3.86 seconds Info: Applying configuration version '1510488497' Notice: /Stage[main]/Main/Group[centos]/ensure: created Notice: /Stage[main]/Main/User[centos]/ensure: created Info: Creating state file /var/lib/puppet/state/state.yaml Notice: Finished catalog run in 19.48 seconds
[root@master manifest]# puppet apply test2.pp Notice: Compiled catalog for master in environment production in 0.29 seconds Notice: /Stage[main]/Main/File[/tmp/puppet.test]/ensure: defined content as '{md5}870d2a178ae85c5ea7732338c4863ef2' Notice: /Stage[main]/Main/File[/tmp/fstab]/ensure: defined content as '{md5}82b1f625714ceefc4886929b1f95a00b' Notice: /Stage[main]/Main/File[/tmp/testdir]/ensure: created Notice: /Stage[main]/Main/File[/tmp/testdir/puppet.link]/ensure: created Notice: Finished catalog run in 1.71 seconds
exec {'/bin/echo World > /tmp/test': user => root, group => root, unless => '/usr/bin/test -e /tmp/test', creates => '/tmp/test' }
其实这里的unless和creates有一个就可以了, 他们都可以确保幂等性.
执行之后的结果就是这样的:
1 2 3 4
[root@master manifest]# puppet apply -v test4.pp Notice: Compiled catalog for master in environment production in 0.07 seconds Info: Applying configuration version '1510886222' Notice: Finished catalog run in 0.08 seconds
根本就不会执行命令.
notify
这个资源可以说是最简单的一个资源了, 简单到只需要一行就可以定义结束, 他的参数一共其实就三个:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
[root@master manifest]# puppet describe notify
notify ====== Sends an arbitrary message to the agent run-time log.
Parameters ----------
- **message** The message to be sent to the log.
- **name** An arbitrary tag for your own reference; the name of the message.
- **withpath** Whether to show the full object path. Defaults to false. Valid values are `true`, `false`.
其中, message就是我们的nameVar, 这样的话我们定义一个资源就像这样:
1
notify {"Hello, there": }
执行的结果就像这样:
1 2 3 4 5
[root@master manifest]# puppet apply test5.pp Notice: Compiled catalog for master in environment production in 0.06 seconds Notice: Hello, there Notice: /Stage[main]/Main/Notify[Hello, there]/message: defined 'message' as 'Hello, there' Notice: Finished catalog run in 0.08 seconds
[root@master manifest]# crontab -l no crontab for root [root@master manifest]# puppet apply test6.pp Notice: Compiled catalog for master in environment production in 0.11 seconds Notice: /Stage[main]/Main/Cron[sync time]/ensure: created Notice: Finished catalog run in 0.73 seconds [root@master manifest]# crontab -l # HEADER: This file was autogenerated at Fri Nov 17 13:19:43 +0800 2017 by puppet. # HEADER: While it can still be managed manually, it is definitely not recommended. # HEADER: Note particularly that the comments starting with 'Puppet Name' should # HEADER: not be deleted, as doing so could cause duplicate cron jobs. # Puppet Name: sync time */10 * * * * /usr/sbin/ntpdate edu.ntp.org.cn > /dev/null 2>&1
[root@master manifest]# puppet apply -v test8.pp Notice: Compiled catalog for master in environment production in 8.88 seconds Info: Applying configuration version '1510989337' Notice: /Stage[main]/Main/Service[nginx]/ensure: ensure changed 'stopped' to 'running' Info: /Stage[main]/Main/Service[nginx]: Unscheduling refresh on Service[nginx] Notice: Finished catalog run in 30.72 seconds [root@master manifest]# rpm -q nginx nginx-1.10.2-1.el6.x86_64 [root@master manifest]# service nginx status nginx (pid 8002) is running...
[root@master manifest]# puppet apply test9.pp Notice: Compiled catalog for master in environment production in 0.55 seconds Notice: /Stage[main]/Main/File[/etc/nginx/nginx.conf]/content: content changed '{md5}1510a037b9fb468daa9fff6d3b5bdd90' to '{md5}9a182199db0446eadfd93810907bbf09' Notice: /Stage[main]/Main/Service[nginx]: Triggered 'refresh' from 1 events Notice: Finished catalog run in 6.94 seconds
可以清晰的看到说明, 文件的md5值发生了改变, 再次查看一下work_processes:
1 2 3 4 5 6 7
[root@master manifest]# ps aux | grep nginx root 8002 0.0 0.1 109620 4656 ? Ss 15:16 0:01 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf nginx 10602 0.0 0.0 110072 3400 ? S 23:33 0:00 nginx: worker process nginx 10603 0.0 0.0 110072 3400 ? S 23:33 0:00 nginx: worker process nginx 10604 0.0 0.0 110072 3400 ? S 23:33 0:00 nginx: worker process nginx 10605 0.0 0.0 110072 3400 ? S 23:33 0:00 nginx: worker process root 10607 0.0 0.0 103324 868 pts/0 S+ 23:34 0:00 grep nginx
case $operatingsystem { /(?i-mx:(redhat|ubuntu))/: { notice("welcome to $1") } "centos","CentOS","Centos": { notice("Centos") } default: { notice("I dont't know.") } }
结果也很明显:
1 2 3 4
[root@master manifest]# puppet apply test12.pp Notice: Scope(Class[main]): Centos Notice: Compiled catalog for master in environment production in 0.07 seconds Notice: Finished catalog run in 0.06 seconds
[root@master manifest]# puppet apply -v test13.pp Notice: Compiled catalog for master in environment production in 5.15 seconds Info: Applying configuration version '1511097112' Notice: /Stage[main]/Apache/Package[httpd]/ensure: created Notice: /Stage[main]/Apache/Service[httpd]/ensure: ensure changed 'stopped' to 'running' Info: /Stage[main]/Apache/Service[httpd]: Unscheduling refresh on Service[httpd] Notice: Finished catalog run in 188.24 seconds
Notice: Compiled catalog for master in environment production in 0.61 seconds Info: Applying configuration version '1511099152' Notice: /Stage[main]/Nginx/Package[nginx]/ensure: created Info: Computing checksum on file /etc/nginx/nginx.conf Info: FileBucket got a duplicate file {md5}1510a037b9fb468daa9fff6d3b5bdd90 Info: /Stage[main]/Nginx/File[/etc/nginx/nginx.conf]: Filebucketed /etc/nginx/nginx.conf to puppet with sum 1510a037b9fb468daa9fff6d3b5bdd90 Notice: /Stage[main]/Nginx/File[/etc/nginx/nginx.conf]/content: content changed '{md5}1510a037b9fb468daa9fff6d3b5bdd90' to '{md5}1cf93649e4d6f892a34c08cfb26d6d6e' Info: /Stage[main]/Nginx/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx] Notice: /Stage[main]/Nginx/Service[nginx]/ensure: ensure changed 'stopped' to 'running' Info: /Stage[main]/Nginx/Service[nginx]: Unscheduling refresh on Service[nginx] Notice: Finished catalog run in 14.77 seconds
otice: Compiled catalog for master in environment production in 0.58 seconds Info: Applying configuration version '1511163767' Error: Execution of '/usr/bin/yum -d 0 -e 0 -y list tengine' returned 1: Error: No matching Packages to list Error: /Stage[main]/Nginx/Package[nginx]/ensure: change from absent to present failed: Execution of '/usr/bin/yum -d 0 -e 0 -y list tengine' returned 1: Error: No matching Packages to list Notice: /Stage[main]/Nginx/Service[nginx]: Dependency Package[nginx] has failures: true Warning: /Stage[main]/Nginx/Service[nginx]: Skipping because of failed dependencies Notice: Finished catalog run in 77.87 seconds
# 循环 <%ifCONDTION-%> some text <%end%> <%ifCONDITION-%> some text <%else%> some text <%end%> # 迭代 <%@ArrayName.echo do | Var_name | -%> some text with <%=Var_name %> <%end%>
我们使用之前的Nginx配置文件来实践一下这个:
1 2
user nginx; worker_processes <% @processorcount %>;
Notice: Compiled catalog for master in environment production in 0.60 seconds Info: Applying configuration version '1511166414' Info: Computing checksum on file /etc/nginx/nginx.conf Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Filebucketed /etc/nginx/nginx.conf to puppet with sum 90cc6772f4dd26a421ce78358801ec95 Notice: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]/content: content changed '{md5}90cc6772f4dd26a421ce78358801ec95' to '{md5}9d140bc8d6be6be51c471322210b9393' Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx] Notice: /Stage[main]/Nginx/Service[nginx]/ensure: ensure changed 'stopped' to 'running' Info: /Stage[main]/Nginx/Service[nginx]: Unscheduling refresh on Service[nginx] Notice: Finished catalog run in 5.16 seconds [root@master manifest]# head /etc/nginx/nginx.conf # For more information on configuration, see: # * Official English Documentation: http://nginx.org/en/docs/ # * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx; worker_processes 2; error_log /var/log/nginx/error.log; pid /var/run/nginx.pid;
# Load dynamic modules. See /usr/share/nginx/README.dynamic.
USAGE: puppet module <action> [--environment production ] [--modulepath $basemodulepath ]
This subcommand can find, install, and manage modules from the Puppet Forge, a repository of user-contributed Puppet code. It can also generate empty modules, and prepare locally developed modules for release on the Forge.
他自己还有一个Forge, 这意味着我们可以上传自己模块和下载别人写好的模块.
创建一个模块是十分容易的:
1 2 3 4 5 6 7 8 9 10 11 12
[root@master manifest]# mkdir -pv /etc/puppet/modules/nginx/{manifests,files,templates,tests,lib,spec} mkdir: created directory `/etc/puppet/modules/nginx' mkdir: created directory `/etc/puppet/modules/nginx/manifests' mkdir: created directory `/etc/puppet/modules/nginx/files' mkdir: created directory `/etc/puppet/modules/nginx/templates' mkdir: created directory `/etc/puppet/modules/nginx/tests' mkdir: created directory `/etc/puppet/modules/nginx/lib' mkdir: created directory `/etc/puppet/modules/nginx/spec' [root@master manifest]# puppet module list /etc/puppet/modules └── nginx (???) /usr/share/puppet/modules (no modules installed)
[root@master manifests]# puppet apply --noop -v -e "include nginx::proxy" Notice: Compiled catalog for master in environment production in 0.59 seconds Info: Applying configuration version '1511167958' Notice: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]/ensure: current_value absent, should be file (noop) Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx] Notice: Class[Nginx::Proxy]: Would have triggered 'refresh' from 1 events Notice: /Stage[main]/Nginx/Package[nginx]/ensure: current_value absent, should be present (noop) Notice: /Stage[main]/Nginx/Service[nginx]/ensure: current_value stopped, should be running (noop) Info: /Stage[main]/Nginx/Service[nginx]: Unscheduling refresh on Service[nginx] Notice: Class[Nginx]: Would have triggered 'refresh' from 2 events Notice: Stage[main]: Would have triggered 'refresh' from 2 events Notice: Finished catalog run in 1.32 seconds
[main] # The Puppet log directory. # The default value is '$vardir/log'. logdir = /var/log/puppet
# Where Puppet PID files are kept. # The default value is '$vardir/run'. rundir = /var/run/puppet
# Where SSL certificates are kept. # The default value is '$confdir/ssl'. ssldir = $vardir/ssl
[agent] # The file in which puppetd stores a list of the classes # associated with the retrieved configuratiion. Can be loaded in # the separate ``puppet`` executable using the ``--loadclasses`` # option. # The default value is '$confdir/classes.txt'. classfile = $vardir/classes.txt
# Where puppetd caches the local configuration. An # extension indicating the cache format is added automatically. # The default value is '$confdir/localconfig'. localconfig = $vardir/localconfig
[root@agent ~]# puppet agent --verbose --noop --no-daemonize --test --server master Info: Creating a new SSL key for agent Info: Caching certificate for ca Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for agent Info: Certificate Request fingerprint (SHA256): 30:9E:60:EA:2B:71:9D:27:11:05:57:C0:37:5E:A4:90:C5:4F:BE:96:73:1F:2E:8A:1E:F2:2F:6B:0D:AA:89:99 Info: Caching certificate for ca Exiting; no certificate found and waitforcert is disabled
脱坑指南: 如果你的Puppet客户端出现No route to host - connect(2)之类的报错, 那么你可以先检查一下Puppet服务端的iptables是否打开了8140TCP的ACCEPT策略
[root@agent ~]# puppet agent --verbose --no-daemonize --server master --noop Notice: Starting Puppet client version 3.8.7 Info: Retrieving pluginfacts Info: Retrieving plugin Info: Caching catalog for agent Info: Applying configuration version '1511265661' Notice: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]/ensure: current_value absent, should be file (noop) Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx] Notice: Class[Nginx::Proxy]: Would have triggered 'refresh' from 1 events Notice: /Stage[main]/Nginx/Package[nginx]/ensure: current_value absent, should be present (noop) Notice: /Stage[main]/Nginx/Service[nginx]/ensure: current_value stopped, should be running (noop) Info: /Stage[main]/Nginx/Service[nginx]: Unscheduling refresh on Service[nginx] Notice: Class[Nginx]: Would have triggered 'refresh' from 2 events Notice: Stage[main]: Would have triggered 'refresh' from 2 events Notice: Finished catalog run in 16.52 seconds
看, 已经起到效果了. 接下来我们就直接应用一下看看吧
1 2 3 4 5 6 7 8 9 10 11 12 13 14
[root@agent ~]# puppet agent --verbose --no-daemonize --server master Notice: Starting Puppet client version 3.8.7 Info: Retrieving pluginfacts Info: Retrieving plugin Info: Caching catalog for agent Info: Applying configuration version '1511266440' Notice: /Stage[main]/Nginx/Package[nginx]/ensure: created Info: Computing checksum on file /etc/nginx/nginx.conf Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Filebucketed /etc/nginx/nginx.conf to puppet with sum 1510a037b9fb468daa9fff6d3b5bdd90 Notice: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]/content: content changed '{md5}1510a037b9fb468daa9fff6d3b5bdd90' to '{md5}9d140bc8d6be6be51c471322210b9393' Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx] Notice: /Stage[main]/Nginx/Service[nginx]/ensure: ensure changed 'stopped' to 'running' Info: /Stage[main]/Nginx/Service[nginx]: Unscheduling refresh on Service[nginx] Notice: Finished catalog run in 146.49 seconds
[root@agent.newthread.com puppet]# netstat -antp Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:8139 0.0.0.0:* LISTEN 29464/ruby
就监听在8139了, 然后我们打开防火墙的8139入站访问.
接着在agent增加对其run的访问, 在auth.conf中增加:
1 2 3
path /run method save allow master.newthread.com
接着编辑或者新建namespaceauth.conf:
1 2
[puppetrunner] allow *.newthread.com
接着我们再master端执行:
1 2 3 4 5 6 7 8
root@master.newthread.com ~]# puppet kick agent.newthread.com Warning: Puppet kick is deprecated. See http://links.puppetlabs.com/puppet-kick-deprecation Warning: Failed to load ruby LDAP library. LDAP functionality will not be available Triggering agent.newthread.com Getting status status is success agent.newthread.com finished with exit code 0 Finished