在安装Puppet之前是需要做很多预备工作的，比如网络地址规范、主机名、certname名、时间等等，也只有这些准备好了，才不至于在安装好puppet之后发现问题而后悔莫及。
说明：接下来的整套文档体系都是以本篇文档规范方案进行设计和扩充的，同样也是也是按照准生产的标准进行编写。
一、网络地址规范
|
1
2
3
4
5
|
【HOSTNAME】 【IP】 【certname】 【operatingsystem】
puppetmaster.kisspuppet.com
192.168
.
100.110
/
24
puppetmaster_cert.kisspuppet.com RHEL6.
4
agent1.kisspuppet.com
192.168
.
100.111
/
24
agent1_cert.kisspuppet.com RHEL5.
7
agent2.kisspuppet.com
192.168
.
100.112
/
24
agent2_cert.kisspuppet.com RHEL5.
8
agent3.kisspuppet.com
192.168
.
100.123
/
24
agent3_cert.kisspuppet.com RHEL6.
4
|
注：192.168.100.*/24的网关为192.168.100.110 所有服务器的DNS1为192.168.100.110
1、设置主机名
|
1
2
3
4
5
6
7
|
[root@puppetmaster ~]# vim /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=puppetmaster.kisspuppet.com
[root@agent1 ~]# vim /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=agent1.kisspuppet.com
|
注：agent2~agent3同上
2、设置IP地址
可通过system-config-network命令进行配置好后在进入配置文件进行修改
|
1
2
3
4
5
6
7
8
9
10
11
12
|
[root@puppetmaster ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=yes
BOOTPROTO=none
IPADDR=
192.168
.
100.110
NETMASK=
255.255
.
255.0
GATEWAY=
192.168
.
100.110
DNS1=
192.168
.
100.110
IPV6INIT=no
USERCTL=no
|
注：node1~node3同上
3、关闭NetworkManager服务
NetworkManager服务是RHEL图形界面管理网卡的服务，由于其开启会对网络造成影响，RHEL6默认是开启的，建议关闭。
|
1
2
3
|
[root@puppetmaster ~]# /etc/init.d/NetworkManager stop
Stopping NetworkManager daemon: [ OK ]
[root@puppetmaster ~]# chkconfig NetworkManager off
|
注：node1~node3同上
4、关闭防火墙
本实验主要是为了测试整个架构的功能，如果要测试防火墙，请另行解决。
|
1
2
3
4
5
|
[root@puppetmaster ~]# /etc/init.d/iptables stop
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
[root@puppetmaster ~]# chkconfig iptables off
|
注：node1~node3同上
5、关闭selinux
|
1
|
[root@puppetmaster ~]# sed -i
's/SELINUX=.*/SELINUX=disabled/g'
/etc/selinux/config
|
注：node1~node3同上
6、设置key
为了操作方便，设置公钥私钥，可通过puppetmaster端统一部署
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
[root@puppetmaster ~]# ssh-keygen
Generating
public
/
private
rsa key pair.
Enter file
in
which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty
for
no passphrase):
Enter same passphrase again:
Your identification has been saved
in
/root/.ssh/id_rsa.
Your
public
key has been saved
in
/root/.ssh/id_rsa.pub.
The key fingerprint
is
:
ff:
55
:8d:
31
:
34
:b4:b3:6a:
70
:3b:aa:
09
:
76
:
12
:5b:8d root@puppetmaster.kisspuppet.com
The key's randomart image
is
:
+--[ RSA
2048
]----+
| .+ |
| . o |
| = |
| o *.|
| . E o . o o|
| + . o o . |
| = . . = . |
| . + . + o |
| o.. . |
+-----------------+
[root@puppetmaster ~]#
for
i
in
{
1
..
3
};
do
ssh-copy-id -i
192.168
.
100.11
$i; done
The authenticity of host
'192.168.100.111 (192.168.100.111)'
can't be established.
RSA key fingerprint
is
ae:db:c5:0c:0e:3f:8c:
62
:ea:a1:
26
:e2:
09
:
63
:
18
:
32
.
Are you sure you want to
continue
connecting (yes/no)? yes
Warning: Permanently added
'192.168.100.111'
(RSA) to the list of known hosts.
root@
192.168
.
100.111
's password:
Now
try
logging into the machine,
with
"ssh '192.168.100.111'"
, and check
in
:
.ssh/authorized_keys
to make sure we haven
't added extra keys that you weren'
t expecting.
...
|
7、设置hosts文件
puppet通信的前提是agent和master必须能够互相解析主机名。
当然，也可以设置DNS，在第四部分搭建kermit架构的时候会搭建DNS服务，现在先暂时通过hosts文件进行解析，可先设置好puppetmaster后，统一copy到所有节点上
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
[root@puppetmaster ~]# vim /etc/hosts
127.0
.
0.1
localhost localhost.localdomain localhost4 localhost4.localdomain4
::
1
localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168
.
100.110
puppetmaster.kisspuppet.com puppetmaster
192.168
.
100.111
agent1.kisspuppet.com agent1
192.168
.
100.112
agent2.kisspuppet.com agent2
192.168
.
100.113
agent3.kisspuppet.com agent3
[root@puppetmaster ~]#
for
i
in
{
1
..
3
};
do
scp /etc/hosts
192.168
.
100.11
$i:/etc/; done
hosts
100
%
354
0
.4KB/s
00
:
00
hosts
100
%
354
0
.4KB/s
00
:
00
hosts
100
%
354
0
.4KB/s
00
:
00
[root@agent1 ~]# ping puppetmaster.kisspuppet.com #设置完成之后记得测试下
PING puppetmaster.kisspuppet.com (
192.168
.
100.110
)
56
(
84
) bytes of data.
64
bytes from puppetmaster.kisspuppet.com (
192.168
.
100.110
): icmp_seq=
1
ttl=
64
time=
0.327
ms
64
bytes from puppetmaster.kisspuppet.com (
192.168
.
100.110
): icmp_seq=
2
ttl=
64
time=
0.996
ms
64
bytes from puppetmaster.kisspuppet.com (
192.168
.
100.110
): icmp_seq=
3
ttl=
64
time=
1.00
ms
--- puppetmaster.kisspuppet.com ping statistics ---
3
packets transmitted,
3
received,
0
% packet loss, time 1999ms
rtt min/avg/max/mdev =
0.327
/
0.774
/
1.000
/
0.317
ms
|
注意：设置完网络后，可以通过类似Xshell这样的工具进行登录，方便操作
二、配置本地光盘yum源
由于我这边是vmware虚拟机操作，所以光盘是可以直接挂载到某一个目录里面，如果是物理机，建议将光盘里的文件全部copy到指定的一个目录里面，然后beaeurl指向它既可。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
[root@puppetmaster ~]# mkdir /media/cdrom
[root@puppetmaster ~]# mount /dev/cdrom /media/cdrom/
mount: block device /dev/sr0
is
write-
protected
, mounting read-only
[root@puppetmaster ~]# cp /etc/yum.repos.d/rhel-source.repo /etc/yum.repos.d/rhel-base.repo
[root@puppetmaster ~]# vim /etc/yum.repos.d/rhel-base.repo
[rhel-base]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=file:
///media/cdrom
enabled=
1
gpgcheck=
0
gpgkey=file:
///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
[root@puppetmaster ~]# yum clean all
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system
is
not registered to Red Hat Subscription Management. You can
use
subscription-manager to register.
Cleaning repos: rhel-base
Cleaning up Everything
[root@puppetmaster ~]# yum install tree lrzsz #测试
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system
is
not registered to Red Hat Subscription Management. You can
use
subscription-manager to register.
rhel-base |
3.9
kB
00
:
00
...
rhel-base/primary_db |
3.1
MB
00
:
01
...
Setting up Install Process
Resolving Dependencies
...
|
注：node1~node3同上
说明：RHEL5的report在Server目录，所以在配置repo文件的时候参数 baseurl=file:///media/cdrom/Server
三、设置NTP服务器
1、配置NTP服务器
设置ntp服务器和本地进行同步，当然如果联网也可以和外部服务器同步，这里只需要保证所有服务器时间一致。
原因是因为，puppetmaster和agent之间时间相差不得超过10分钟（好像是），而后期配置的mcollecitve服务端和客户端之间不能相差60秒
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
[root@puppetmaster ~]# rpm -qa | grep ntp
fontpackages-filesystem-
1.41
-
1.1
.el6.noarch
ntpdate-
4.2
.4p8-
3
.el6.x86_64 #默认已经安装
ntp-
4.2
.4p8-
3
.el6.x86_64 #默认已经安装
[root@puppetmaster ~]# cp /etc/ntp.conf{,.bak}
[root@puppetmaster ~]# vim /etc/ntp.conf
driftfile /
var
/lib/ntp/drift
logfile /
var
/log/ntp.log
Broadcastdelay
0.008
restrict
default
kod nomodify notrap nopeer noquery
restrict -
6
default
kod nomodify notrap nopeer noquery
restrict
default
ignore
restrict
127.0
.
0.1
restrict -
6
::
1
restrict
192.168
.
100.0
mask
255.255
.
255.0
notrap nomodify
server
127.127
.
1.0
# local clock
fudge
127.127
.
1.0
stratum
10
refid NIST
includefile /etc/ntp/crypto/pw
keys /etc/ntp/keys
[root@puppetmaster ~]# /etc/init.d/ntpd start
Starting ntpd: [ OK ]
[root@puppetmaster ~]# chkconfig ntpd on
|
2、节点测试并设置crontab
|
1
2
3
4
5
6
|
[root@agent1 ~]# ntpdate puppetmaster.kisspuppet.com
7
Mar
06
:
08
:
30
ntpdate[
16411
]: adjust time server
192.168
.
100.110
offset
0.049448
sec
[root@agent1 ~]# crontab -l #可通过croutab -e命令设置
*/
30
* * * * /usr/sbin/ntpdate puppetmaster.kisspuppet.com >>/root/ntdate.log
2
>&
1
&& /sbin/clock --systohc
[root@agent1 ~]# /etc/init.d/crond reload
Reloading cron daemon configuration: [ OK ]
|
四、制作本地yum仓库
本实验大部分包来自于http://yum.puppetlabs.com，部分包来自于EPEL和Gems官网，rabbitmq官方等，关于如何制作yum仓库，之前有文章写道http://kisspuppet.com/2014/01/26/puppet_create_repo/，这里在简单操作一下
|
1
2
3
4
5
6
7
8
9
10
|
[root@puppetmaster RHEL6U4]# yum install createrepo #安装制作软件包的软件
[root@puppetmaster RHEL6U4]# createrepo . #将本目录以及子目录下所有rpm包生产repodata
Spawning worker
0
with
105
pkgs
Workers Finished
Gathering worker results
Saving Primary metadata
Saving file lists metadata
Saving other metadata
Generating sqlite DBs
Sqlite DBs complete
|
注：RHEL5的repodata必须在RHEL5环境下运行createrpo命令生成
五、配置FTP服务器
1、安装并配置FTP服务器
搭建FTP服务器的目的只要是为自定义yum仓库做准备
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
[root@puppetmaster ~]# yum install vsftpd
Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
This system
is
not registered to Red Hat Subscription Management. You can
use
subscription-manager to register.
rhel-base |
3.9
kB
00
:
00
...
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package vsftpd.x86_64
0
:
2.2
.
2
-
11
.el6 will be installed
--> Finished Dependency Resolution
...
[root@puppetmaster ~]# cp /etc/vsftpd/vsftpd.conf{,.bak}
[root@puppetmaster ~]# vim /etc/vsftpd/vsftpd.conf
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=
022
anon_upload_enable=YES
anon_root=/puppet #匿名访问的目录
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/
var
/log/xferlog
xferlog_std_format=YES
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
[root@puppetmaster ~]# /etc/init.d/vsftpd start
Starting vsftpd
for
vsftpd: [ OK ]
[root@puppetmaster ~]# chkconfig vsftpd on
|
2、在FTP共享目录里制作yum仓库
将生成好的yum源copy到FTP共享目录中
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
[root@puppetmaster ~]# ll /puppet/
total
12
drwxr-xr-x
4
root root
4096
Mar
7
06
:
21
RHEL5U7
drwxr-xr-x
4
root root
4096
Mar
7
06
:
21
RHEL5U8
drwxr-xr-x
6
root root
4096
Mar
7
06
:
21
RHEL6U4
[root@puppetmaster ~]# ll /puppet/RHEL6U4/
total
16600
-rw-r--r--
1
root root
87643
Mar
7
06
:
21
facter-
1.7
.
3
-
1
.el5.x86_64.rpm
-rw-r--r--
1
root root
87440
Mar
7
06
:
21
facter-
1.7
.
3
-
1
.el6.x86_64.rpm
drwxr-xr-x
2
root root
4096
Mar
7
06
:
21
gem
-rw-r--r--
1
root root
634944
Mar
7
06
:
21
GeoIP-
1.4
.
8
-
1
.el6.x86_64.rpm
-rw-r--r--
1
root root
151654
Mar
7
06
:
21
keepalived-
1.2
.
7
-
1.1
.x86_64.rpm
-rw-r--r--
1
root root
10924
Mar
7
06
:
21
mcollective-
2.2
.
4
-
1
.el6.noarch.rpm
-rw-r--r--
1
root root
24596
Mar
7
06
:
21
mcollective-client-
2.2
.
4
-
1
.el6.noarch.rpm
-rw-r--r--
1
root root
759300
Mar
7
06
:
21
mcollective-common-
2.2
.
4
-
1
.el6.noarch.rpm
drwxr-xr-x
3
root root
4096
Mar
7
06
:
21
mcollective-plugins
drwxr-xr-x
2
root root
4096
Mar
7
06
:
21
mq
-rw-r--r--
1
root root
406588
Mar
7
06
:
21
nginx-
1.0
.
15
-
5
.el6.x86_64.rpm
-rw-r--r--
1
root root
1128352
Mar
7
06
:
21
puppet-
2.7
.
23
-
1
.el6.noarch.rpm
-rw-r--r--
1
root root
4509032
Mar
7
06
:
21
puppet-dashboard-
1.2
.
23
-
1
.el6.noarch.rpm
-rw-r--r--
1
root root
25596
Mar
7
06
:
21
puppet-server-
2.7
.
23
-
1
.el6.noarch.rpm
-rw-r--r--
1
root root
3729988
Mar
7
06
:
21
rabbitmq-server-
3.1
.
5
-
1
.el6.noarch.rpm
drwxr-xr-x
2
root root
4096
Mar
7
06
:
21
repodata
...
|
六、配置远程yum仓库
|
1
2
3
4
5
6
7
8
|
[root@puppetmaster ~]# vim /etc/yum.repos.d/rhel-puppet.repo
[rhel-puppet]
name=puppetlabs epel gems
for
rhel
baseurl=ftp:
//puppetmaster.kisspuppet.com/RHEL6U4 #指向FTP服务器地址
enabled=
1
gpgcheck=
0
[root@puppetmaster ~]# yum list | grep puppet-server #测试
puppet-server.noarch
2.7
.
25
-
1
.el6 rhel-puppet
|
注：node1~node3同上
七、重要软件版本选型
目前puppet最成熟的版本为2.7.和3.3版本，两个版本都可以，本实验采用2.7版本。
|
1
2
3
4
5
6
7
8
9
10
|
puppet-server
2.7
.
25
-
1
来自puppetlabs
puppet
2.7
.
25
-
1
来自puppetlabs
facter
1.7
.
5
来自puppetlabs
puppet-dashboar
1.2
.
23
来自puppetlabs
ruby
1.8
.* 系统自带
mcollective
2.2
.
4
来自puppetlabs
activemq
5.5
.
0
来自puppetlabs
rabbitmq-server
3.1
.
5
来自rabbitmq官网
kermit-webui
1.2
-
1
来自kermit官网
...
|
