本文轉自cactifans
上篇說了下在ubuntu12.04上安裝puppet，安裝的版本爲puppet2.7.11版本，今天嘗試了下在CentOS6.4系統上安裝puppet 3.1.1版本,本文參考chenshake的文章
OS:centso 6.4 X64 Puppet 3.1.1 Puppet master: master.canghai.com Puppet clients:node1-5.canghai.com
Puppet 要求所有機器有完整的域名（FQDN），如果沒有 DNS 服務器提供域名的話，可以在兩臺機器上設置主機名（注意要先設置主機名再安裝 Puppet，因爲安裝 Puppet 時會把主機名寫入證書，客戶端和服務端通信需要這個證書）,因爲我配置了DNS，所以就不用改hosts了，如果沒有就需要改hosts文件指定。
1.關閉selinux，iptables，並設置ntp
採用CentOS-6.4-x86_64-minimal.iso最小化安裝，因此先要安裝ntp、wget等常用工具
安裝ntp wget
yum install wget ntp -y
關閉selinux
sed -i '/SELINUX/ s/enforcing/disabled/g' /etc/selinux/config setenforce 0
停止iptables
chkconfig ip6tables off chkconfig iptables off /etc/init.d/ip6tables stop /etc/init.d/iptables stop
設置ntp
ntpdate pool.ntp.org chkconfig ntp on service ntpd start
2.安裝puppet服務
puppet不在CentOS的基本源中，需要加入 PuppetLabs 提供的官方源：
wget http://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-7.noarch.rpm rpm -ivh puppetlabs-release-6-7.noarch.rpm yum update
在 master上安裝和啓用 puppet 服務：
yum install puppet-server chkconfig puppet on service puppetmaster start
在clients上安裝puppet客戶端
yum install puppet chkconfig puppet on service puppet start
3.配置puppet
對於puppet 客戶端，修改/etc/puppet/puppet.conf，指定master服務器
vi /etc/puppet/puppet.conf [main] # The Puppet log directory. # The default value is '$vardir/log'. logdir = /var/log/puppet # Where Puppet PID files are kept. # The default value is '$vardir/run'. rundir = /var/run/puppet # Where SSL certificates are kept. # The default value is '$confdir/ssl'. ssldir = $vardir/ssl [agent] # The file in which puppetd stores a list of the classes # associated with the retrieved configuratiion. Can be loaded in # the separate ``puppet`` executable using the ``--loadclasses`` # option. # The default value is '$confdir/classes.txt'. classfile = $vardir/classes.txt # Where puppetd caches the local configuration. An # extension indicating the cache format is added automatically. # The default value is '$confdir/localconfig'. localconfig = $vardir/localconfig server = master.canghai.com
並重啓puppet服務
service puppet restart
4.Client申請證書
服務端自動簽發證書設置
設置master自動簽發所有的證書，我們只需要在/etc/puppet 目錄下創建 autosign.conf 文件。（不需要修改 /etc/puppet/puppet.conf文件，因爲我默認的autosign.conf 文件的位置沒有修改）
cat > /etc/puppet/autosign.conf <<EOF *.canghai.com EOF service puppetmaster restart
這樣就會對所有來自canghai.com的機器的請求，都自動簽名。
client需要向服務器端發出請求, 讓服務器對客戶端進行管理. 這其實是一個證書籤發的過程. 第一次運行 puppet 客戶端的時候會生成一個 SSL 證書並指定發給 Puppet 服務端, 服務器端如果同意管理客戶端,就會對這個證書進行簽發，可以用這個命令來簽發證書，由於我們已經在客戶端設置了server地址，因此不需要跟服務端地址
puppet agent
爲了詳細瞭解註冊的過程和日後排錯,可以增加參數，因爲配置文件裏
–no-daemonize 前臺輸出日誌
–verbose 輸入更加詳細的日誌
–debug 更加詳細的日誌，排錯的時候使用
–test 表示測試，就帶一個–test參數就可以
puppet agent --no-daemonize --onetime --verbose --debug
就可以申請證書了，由於我配置的自動簽發證書，所以直接就簽發了，在服務端執行
puppet cert list --all + "master.canghai.com" (SHA256) CA:50:6A:51:D5:AD:F0:73:BF:83:A0:4A:BF:1F:4E:F0:56:C9:4B:D8:4D:BB:62:10:EE:14:16:D5:96:D0:B6:F7 (alt names: "DNS:master.canghai.com", "DNS:puppet", "DNS:puppet.canghai.com") + "node1.canghai.com" (SHA256) B8:95:69:2B:7B:3E:F4:38:CA:63:BE:A0:ED:3C:E7:05:1F:93:53:2D:1C:60:67:E9:D8:20:99:90:B8:9B:D6:40 + "node2.canghai.com" (SHA256) 6C:65:34:9D:B1:82:35:24:EF:3F:10:2B:10:F0:0B:44:42:AB:84:42:29:B5:73:1A:A0:1D:D5:1E:9E:24:BC:E3 + "node3.canghai.com" (SHA256) 57:54:33:37:23:A7:CD:BE:F6:25:BD:6F:E3:DA:F9:57:48:50:C7:5E:36:8F:F4:BA:C8:27:DF:B0:A2:84:5F:AF + "node4.canghai.com" (SHA256) 65:2F:0E:E7:98:F5:05:40:31:2F:FF:36:A5:3E:DE:C1:91:E8:45:16:55:60:A1:82:74:BC:84:EC:BA:C0:62:F0 + "node5.canghai.com" (SHA256) 8C:1B:31:B6:C0:9C:A5:AF:89:6C:85:1B:BA:D0:03:63:07:4C:B1:89:D4:E6:B7:4E:CA:4A:23:C7:3C:5F:CA:3D
就可以看到所有客戶端已經都已簽發證書，前面帶"+"號的就是簽發成功的，擼過沒有簽名的，可以用
puppet cert --sign node1.canghai.com
進行簽發證書,簽發後在master，執行
puppet cert list --all
即可看到證書已經簽發
5.在服務端安裝puppet的dashboard
安裝mysql
yum install -y mysql mysql-devel mysql-server
優化mysql設置
編輯 /etc/my.cnf, 在[mysqld]字段,增加最後一行
cat /etc/my.cnf [mysqld] datadir=/var/lib/mysql socket=/var/lib/mysql/mysql.sock user=mysql # Disabling symbolic-links is recommended to prevent assorted security risks symbolic-links=0 max_allowed_packet = 32M [mysqld_safe] log-error=/var/log/mysqld.log pid-file=/var/run/mysqld/mysqld.pid
啓動服務
/etc/init.d/mysqld start chkconfig mysqld on
設置mysql密碼，我這裏使用是密碼是123456
mysqladmin -u root password '123456'
創建一個dashboard數據庫
mysql -uroot -p123456 <<EOF CREATE DATABASE dashboard CHARACTER SET utf8; CREATE USER 'dashboard'@'localhost' IDENTIFIED BY '123456'; GRANT ALL PRIVILEGES ON dashboard.* TO 'dashboard'@'localhost'; FLUSH PRIVILEGES; EOF
Passenger+Apache+Dashboard
這是讓Apache支持ruby,由於Passenger不在centos官方源裏，因此要添加epel的源
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm rpm -ivh epel-release-6-8.noarch.rpm yum install mod_passenger puppet-dashboard
配置Dashboard
vi /usr/share/puppet-dashboard/config/database.yml production: database: dashboard username: dashboard password: 123456 encoding: utf8 adapter: mysql
修改時區
vi /usr/share/puppet-dashboard/config/environment.rb #config.time_zone = 'UTC' config.time_zone = 'Beijing'
初始化數據庫
cd /usr/share/puppet-dashboard/ rake RAILS_ENV=production db:migrate
配置Apache
我們需要整合Passenger和apache
cat > /etc/httpd/conf.d/passenger.conf << EOF LoadModule passenger_module modules/mod_passenger.so PassengerRoot /usr/share/rubygems/gems/passenger-3.0.17 PassengerRuby /usr/bin/ruby PassengerHighPerformance on PassengerMaxPoolSize 12 PassengerPoolIdleTime 1500 PassengerStatThrottleRate 120 RailsAutoDetect On ServerName master.canghai.com DocumentRoot "/usr/share/puppet-dashboard/public/" <Directory "/usr/share/puppet-dashboard/public/"> Options None AllowOverride AuthConfig Order allow,deny allow from all ErrorLog /var/log/httpd/master.canghai.com_error.log LogLevel warn CustomLog /var/log/httpd/master.canghai.com_access.log combined ServerSignature On EOF
啓動服務
/etc/init.d/httpd start chkconfig httpd on
配置puppet
讓Dashboard使用Reports，現在默認agent是已經啓用Report的功能，所以你就不需要設置agent,你只需要設置Server端就可以
vi /etc/puppet/puppet.conf [master] reports = store, http reporturl = http://master.canghai.com:80/reports/upload
重啓puppetmaster 服務
/etc/init.d/puppetmaster restart
這時候就可以直接用 http://ip 訪問puppet Dashboard
導入報告
cd /usr/share/puppet-dashboard rake RAILS_ENV=production reports:import
這時候你訪問Dashboard,可以看到導入的任務.
4. 執行導入的reports
cd /usr/share/puppet-dashboard rake jobs:work RAILS_ENV="production"
