BlogJava-Noah-文章分类-Puppet

编写第一个Puppet Module(puppet code)

眼镜蛇 — Mon, 16 Jan 2017 08:25:00 GMT

当你试着写这个小例子的时候，那你肯定已经把Puppet Server 和 Agent的环境都搭建好了。

所以这里我们直接进入主题
Puppet 默认写Module的路径是这里，所以请直接进入这个目录下

cd /etc/puppetlabs/code/environments/production/modules

接下来建立以下目录结构

└── helloworld
└── manifests
├── init.pp

然后，用vi 命令，打开init.pp文件，写入如下内容

class helloworld {
notify { 'hello, world! installed by puppet': }
}

按ESC，再按":wq",退出编辑器。

然后，后退。或直接进入到下面的目录

cd /etc/puppetlabs/code/environments/production/manifests

新建或打开site.pp文件，写入如下内容。

node default{
  class { 'helloworld': }
  #class { 'helloworld::motd': }
  #class { 'tomcat8': }
  #class { 'puppetlabs-apache':  }
}

其实，就是前两行启作用，后面的可以忽略。这也意味着，以后会写一下怎么写安装tomcat 和部署应用的例子。
写完这些后，到Agent端执行 sudo puppet agent -t. 如果没有错误的话，屏幕上会出现，之前写的那句话。

眼镜蛇 2017-01-16 16:25 发表评论

Puppet的server端与agent端的通信建立

眼镜蛇 — Fri, 16 Dec 2016 09:09:00 GMT

puppet 的安装与配置，请看上一篇文章。
这里默认你已经把它安装好了。

想让两台(或N台)机器相互通信，先要设置它们之间的Host文件。
每一台机器分别执行如下命令

sudo vi /etc/hosts

把要相互通信的所有机器的IP 和别名添加进来。比如先以server端为例

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.23.10.237 puppet-server.noah.blogjava.net
#上面可能是打开这个文件里默认的，不用管，直接在下面加agent的ip就可以了,有多少加多少。
10.52.27.71 agent001.noah-test.net
10.52.27.72 agent002.noah-test.net
10.52.27.73 agent003.noah-test.net

接下来把上面的都复制，然后，分别考到其它的机器里面。

接下来回到agent端，配置puppet 的配置文件，执行如下命令

sudo vi /etc/puppetlabs/puppet/puppet.conf

在打开的文件里面填写如下信息

[main]
#这个certname就是上面host里面的名字
certname = agent001.noah-test.net
#server 就是puppet的server的地址
server = puppet-server.noah.blogjava.net
environment = production
runinterval = 1h

然后在agent端，执行如下命令，向server端申请证书

sudo /opt/puppetlabs/bin/puppet agent --test

然后，会出现这样的信息
Info: Creating a new SSL key for agent01.noah-test
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml
Exiting; no certificate found and waitforcert is disabled

证明，申请成功，等待server端同意。这时可以转到server端，执行如下命令查看如些机器要申请证书

sudo /opt/puppetlabs/bin/puppet cert list --all

这里会显示出所有申请过的和正在等待审批的agent的certname 的名字。审批通过的前面有个“+”。
接下来执行如下命令进行单独审批

sudo /opt/puppetlabs/bin/puppet cert sign agent001.noah-test.net

也可以直接在sgin 后面加 "--all",进行全部审批。

审批完成后，再回到agent端，执行同样的命令

sudo /opt/puppetlabs/bin/puppet agent --test

如下显示的全是类似如下绿色的信息，证明它们之间的通信已经建立成功

Info: Using configured environment 'production'

Info: Retrieving pluginfacts

Info: Retrieving plugin

Info: Caching catalog for agent001.noah-test.net

Info: Applying configuration version '1481877703'

问题汇总：

cloud@cdt-dev-cafews-yabinx:/etc/puppetlabs/puppet> sudo puppet agent -t

Warning: Setting 'pluginsync' is deprecated.

(at /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/defaults.rb:1713:in `block in ')

Warning: Unable to fetch my node definition, but the agent run will continue:

Warning: getaddrinfo: Name or service not known

Info: Retrieving pluginfacts

Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': getaddrinfo: Name or service not known

Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: getaddrinfo: Name or service not known

Info: Retrieving plugin

Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': getaddrinfo: Name or service not known

Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: getaddrinfo: Name or service not known

Info: Loading facts

Error: Could not retrieve catalog from remote server: getaddrinfo: Name or service not known

Warning: Not using cache on failed catalog

Error: Could not retrieve catalog; skipping run

Error: Could not send report: getaddrinfo: Name or service not known

用的命令不对，改用这个

sudo /opt/puppetlabs/bin/puppet agent --test

sudo/opt/puppetlabs/bin/puppet agent --test

Warning: Unable to fetch my node definition, but the agent run will continue:

Warning: Server hostname 'cdt-dev-cafews-yabinx' did not match server certificate; expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

Info: Retrieving pluginfacts

Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': Server hostname 'cdt-dev-cafews-yabinx' did not match server certificate; expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: Server hostname 'cdt-dev-cafews-yabinx' did not match server certificate; expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

Info: Retrieving plugin

Error: /File[/opt/puppetlabs/puppet/cache/lib]: Failed to generate additional resources using 'eval_generate': Server hostname 'cdt-dev-cafews-yabinx' did not match server certificate; expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: Server hostname 'cdt-dev-cafews-yabinx' did not match server certificate; expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

Error: Could not retrieve catalog from remote server: Server hostname 'cdt-dev-cafews-yabinx' did not match server certificate; expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

Warning: Not using cache on failed catalog

Error: Could not retrieve catalog; skipping run

Error: Could not send report: Server hostname 'cdt-dev-cafews-yabinx' did not match server certificate; expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

其实它已经告诉你了，改一下/etc/hosts就可以了，改成下面的其中一个

expected one of cdt-dev-cafews-yabinx.emea1.cis.trcloud, DNS:puppet, DNS:cdt-dev-cafews-yabinx.emea1.cis.trcloud

sudo /opt/puppetlabs/bin/puppet agent --test

Warning: Unable to fetch my node definition, but the agent run will continue:

Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=cdt-dev-cafews-yabinx2.emea1.cis.trcloud]

Info: Retrieving pluginfacts

Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=cdt-dev-cafews-yabinx2.emea1.cis.trcloud]

Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=cdt-dev-cafews-yabinx2.emea1.cis.trcloud]

Info: Retrieving plugin

Error: /File[/opt/puppetlabs/puppet/cache/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=cdt-dev-cafews-yabinx2.emea1.cis.trcloud]

Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=cdt-dev-cafews-yabinx2.emea1.cis.trcloud]

Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=cdt-dev-cafews-yabinx2.emea1.cis.trcloud]

Warning: Not using cache on failed catalog

Error: Could not retrieve catalog; skipping run

Error: Could not send report: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=cdt-dev-cafews-yabinx2.emea1.cis.trcloud]

一般这种情况就是由于某种原因没有认证没有成功，但它又不会重新认证了，所以就报这个错误，解决办法是到这个目录下/etc/puppetlabs/puppet，把生成的ssl文件夹给删除，让它重新生成一次key。如果生成一次还没有成功的话，你要看一下是不是其它地方的问题，然后，要重新重复上面的步骤，重新生成密钥。

眼镜蛇 2016-12-16 17:09 发表评论

Puppet的安装与配置

眼镜蛇 — Thu, 15 Dec 2016 09:04:00 GMT

在安装之前，先简单说一下Puppet的构成。Puppet分为两部分，一部分叫Puppet Server 也叫 Puppet Master，新版本好像开始叫Server了。另一部分，叫Agent。为什么叫做一部分，而不叫一个，道理很简单，就是可以有多台。好了费话不多说正式开始
先确定一下自己的系统版本，可以通过执行下面的命令查看：

cat /etc/redhat-release

如果是Enterprise Linux 7就执行这句

sudo rpm -Uvh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-7.noarch.rpm

Enterprise Linux 6

sudo rpm -Uvh https://yum.puppetlabs.com/puppetlabs-release-pc1-el-6.noarch.rpm

Ubuntu 16.04 Xenial Xerus

wget https://apt.puppetlabs.com/puppetlabs-release-pc1-xenial.deb
sudo dpkg -i puppetlabs-release-pc1-xenial.deb
sudo apt update

Ubuntu 15.10 Wily Werewolf

wget https://apt.puppetlabs.com/puppetlabs-release-pc1-wily.deb
sudo dpkg -i puppetlabs-release-pc1-wily.deb
sudo apt update

Ubuntu 14.04 Trusty Tahr

wget https://apt.puppetlabs.com/puppetlabs-release-pc1-trusty.deb
sudo dpkg -i puppetlabs-release-pc1-trusty.deb
sudo apt-get update

Ubuntu 12.04 Precise Pangolin

wget https://apt.puppetlabs.com/puppetlabs-release-pc1-precise.deb
sudo dpkg -i puppetlabs-release-pc1-precise.deb
sudo apt-get update

Debian 8 Jessie

wget https://apt.puppetlabs.com/puppetlabs-release-pc1-jessie.deb
sudo dpkg -i puppetlabs-release-pc1-jessie.deb
sudo apt-get update

Debian 7 Wheezy

wget https://apt.puppetlabs.com/puppetlabs-release-pc1-wheezy.deb
sudo dpkg -i puppetlabs-release-pc1-wheezy.deb
sudo apt-get update

如果遇到这个错误，应该是你的rpm没有设置代理，请看文章结尾错误汇总
curl: (7) couldn't connect to host

接下来用YUM安装

sudo yum install puppetserver

或

apt-get install puppetserver

遇到这个错误是YUM没有设置代理，文章结尾问题汇总

28, 'connect() timed out!'

接下来就可以正常启动了
sudo service puppetserver start

可以通过如下命令查看是否启动成功
sudo service puppetserver status

默认它会分配2G内存，需要调整的话，可以在这里
/etc/sysconfig/puppetserver -- RedHeat
/etc/default/puppetserver  -- Debian


接下来在另外一台器上安装agent
用相同的方法先下载资源包，sudo rpm xxxx,等 。
然后，安装agent
sudo yum install puppet
通过如下命令启动agent
sudo service puppet start
通过如下命令查看是否启动成功
service puppet status

https://yum.puppetlabs.com/puppetlabs-release-pc1-el-6.noarch.rpm

Retrieving https://yum.puppetlabs.com/puppetlabs-release-pc1-el-6.noarch.rpm

curl: (7) couldn't connect to host

error: skipping https://yum.puppetlabs.com/puppetlabs-release-pc1-el-6.noarch.rpm - transfer failed

sudo rpm -Uvh --httpproxy http://webproxy.lon.corp.services --httpport 80 https://yum.puppetlabs.com/puppetlabs-release-pc1-el-6.noarch.rpm

在安装过程中，如果Yum不能下载的话，可能没有设置代理，

执行 sudo vi /etc/yum.conf 然后加上代理

proxy=http://xxxxxxxxxx:80

puppet 默认使用8140，查看产端口占用情况
sudo netstat -nlatp | grep 8140

眼镜蛇 2016-12-15 17:04 发表评论