Puppet基础篇3-安装Puppet前期的准备工作

工欲善其事必先利其器

在安装Puppet之前是需要做很多预备工作的，比如网络地址规范、主机名、certname名、时间等等，也只有这些准备好了，才不至于在安装好puppet之后发现问题而后悔莫及。
说明：接下来的整套文档体系都是以本篇文档规范方案进行设计和扩充的，同样也是也是按照准生产的标准进行编写。

一、网络地址规范

  1. 【HOSTNAME】                        【IP】                     【certname】        【operatingsystem】 
  2. puppetmaster.kisspuppet.com  192.168.100.110/24   puppetmaster_cert.kisspuppet.com     RHEL6.4
  3. agent1.kisspuppet.com        192.168.100.111/24   agent1_cert.kisspuppet.com         RHEL5.7
  4. agent2.kisspuppet.com        192.168.100.112/24   agent2_cert.kisspuppet.com         RHEL5.8
  5. agent3.kisspuppet.com        192.168.100.123/24   agent3_cert.kisspuppet.com         RHEL6.4

注：192.168.100.*/24的网关为192.168.100.110 所有服务器的DNS1为192.168.100.110

1、设置主机名

  1. [root@puppetmaster ~]# vim /etc/sysconfig/network
  2. NETWORKING=yes
  3. HOSTNAME=puppetmaster.kisspuppet.com
  4. [root@agent1 ~]# vim /etc/sysconfig/network
  5. NETWORKING=yes
  6. NETWORKING_IPV6=no
  7. HOSTNAME=agent1.kisspuppet.com

注：agent2~agent3同上

2、设置IP地址

可通过system-config-network命令进行配置好后在进入配置文件进行修改

  1. [root@puppetmaster ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0 
  2. DEVICE=eth0
  3. TYPE=Ethernet
  4. ONBOOT=yes
  5. NM_CONTROLLED=yes
  6. BOOTPROTO=none
  7. IPADDR=192.168.100.110
  8. NETMASK=255.255.255.0
  9. GATEWAY=192.168.100.110
  10. DNS1=192.168.100.110
  11. IPV6INIT=no
  12. USERCTL=no

注：node1~node3同上

3、关闭NetworkManager服务

NetworkManager服务是RHEL图形界面管理网卡的服务，由于其开启会对网络造成影响，RHEL6默认是开启的，建议关闭。

  1. [root@puppetmaster ~]# /etc/init.d/NetworkManager stop
  2. Stopping NetworkManager daemon:                            [  OK  ]
  3. [root@puppetmaster ~]# chkconfig NetworkManager off

注：node1~node3同上

4、关闭防火墙

本实验主要是为了测试整个架构的功能，如果要测试防火墙，请另行解决。

  1. [root@puppetmaster ~]# /etc/init.d/iptables stop
  2. iptables: Flushing firewall rules:                         [  OK  ]
  3. iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
  4. iptables: Unloading modules:                               [  OK  ]
  5. [root@puppetmaster ~]# chkconfig iptables off

注：node1~node3同上

5、关闭selinux

  1. [root@puppetmaster ~]# sed -i 's/SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

注：node1~node3同上

6、设置key
为了操作方便，设置公钥私钥，可通过puppetmaster端统一部署

  1. [root@puppetmaster ~]# ssh-keygen 
  2. Generating public/private rsa key pair.
  3. Enter file in which to save the key (/root/.ssh/id_rsa): 
  4. Enter passphrase (empty for no passphrase): 
  5. Enter same passphrase again: 
  6. Your identification has been saved in /root/.ssh/id_rsa.
  7. Your public key has been saved in /root/.ssh/id_rsa.pub.
  8. The key fingerprint is:
  9. ff:55:8d:31:34:b4:b3:6a:70:3b:aa:09:76:12:5b:8d root@puppetmaster.kisspuppet.com
  10. The key's randomart image is:
  11. +--[ RSA 2048]----+
  12. |             .+  |
  13. |             . o |
  14. |              =  |
  15. |         o     *.|
  16. |      . E o . o o|
  17. |       + . o o . |
  18. |      = . . = .  |
  19. |     . + . + o   |
  20. |        o.. .    |
  21. +-----------------+
  22. [root@puppetmaster ~]# for i in {1..3}; do ssh-copy-id -i 192.168.100.11$i; done
  23. The authenticity of host '192.168.100.111 (192.168.100.111)' can't be established.
  24. RSA key fingerprint is ae:db:c5:0c:0e:3f:8c:62:ea:a1:26:e2:09:63:18:32.
  25. Are you sure you want to continue connecting (yes/no)? yes
  26. Warning: Permanently added '192.168.100.111' (RSA) to the list of known hosts.
  27. root@192.168.100.111's password: 
  28. Now try logging into the machine, with "ssh '192.168.100.111'", and check in:
  30.   .ssh/authorized_keys
  32. to make sure we haven't added extra keys that you weren't expecting.
  33. ...

7、设置hosts文件

puppet通信的前提是agent和master必须能够互相解析主机名。
当然，也可以设置DNS，在第四部分搭建kermit架构的时候会搭建DNS服务，现在先暂时通过hosts文件进行解析，可先设置好puppetmaster后，统一copy到所有节点上

  1. [root@puppetmaster ~]# vim /etc/hosts
  2. 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
  3. ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
  4. 192.168.100.110 puppetmaster.kisspuppet.com  puppetmaster
  5. 192.168.100.111 agent1.kisspuppet.com  agent1
  6. 192.168.100.112 agent2.kisspuppet.com  agent2
  7. 192.168.100.113 agent3.kisspuppet.com  agent3
  8. [root@puppetmaster ~]# for i in {1..3}; do scp /etc/hosts 192.168.100.11$i:/etc/; done
  9. hosts                                                                                  100%  354     0.4KB/s   00:00    
  10. hosts                                                                                  100%  354     0.4KB/s   00:00    
  11. hosts                                                                                  100%  354     0.4KB/s   00:00  
  13. [root@agent1 ~]# ping puppetmaster.kisspuppet.com #设置完成之后记得测试下
  14. PING puppetmaster.kisspuppet.com (192.168.100.110) 56(84) bytes of data.
  15. 64 bytes from puppetmaster.kisspuppet.com (192.168.100.110): icmp_seq=1 ttl=64 time=0.327 ms
  16. 64 bytes from puppetmaster.kisspuppet.com (192.168.100.110): icmp_seq=2 ttl=64 time=0.996 ms
  17. 64 bytes from puppetmaster.kisspuppet.com (192.168.100.110): icmp_seq=3 ttl=64 time=1.00 ms
  19. --- puppetmaster.kisspuppet.com ping statistics ---
  20. 3 packets transmitted, 3 received, 0% packet loss, time 1999ms
  21. rtt min/avg/max/mdev = 0.327/0.774/1.000/0.317 ms

注意：设置完网络后，可以通过类似Xshell这样的工具进行登录，方便操作

二、配置本地光盘yum源

由于我这边是vmware虚拟机操作，所以光盘是可以直接挂载到某一个目录里面，如果是物理机，建议将光盘里的文件全部copy到指定的一个目录里面，然后beaeurl指向它既可。

  1. [root@puppetmaster ~]# mkdir /media/cdrom
  2. [root@puppetmaster ~]# mount /dev/cdrom  /media/cdrom/
  3. mount: block device /dev/sr0 is write-protected, mounting read-only
  5. [root@puppetmaster ~]# cp /etc/yum.repos.d/rhel-source.repo /etc/yum.repos.d/rhel-base.repo 
  6. [root@puppetmaster ~]# vim /etc/yum.repos.d/rhel-base.repo 
  7. [rhel-base]
  8. name=Red Hat Enterprise Linux $releasever - $basearch - Source
  9. baseurl=file:///media/cdrom
  10. enabled=1
  11. gpgcheck=0
  12. gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
  14. [root@puppetmaster ~]# yum clean all
  15. Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
  16. This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
  17. Cleaning repos: rhel-base
  18. Cleaning up Everything
  19. [root@puppetmaster ~]# yum install tree lrzsz   #测试
  20. Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
  21. This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
  22. rhel-base                                                                                         | 3.9 kB     00:00 ... 
  23. rhel-base/primary_db                                                                              | 3.1 MB     00:01 ... 
  24. Setting up Install Process
  25. Resolving Dependencies
  26. ...

注：node1~node3同上

说明：RHEL5的report在Server目录，所以在配置repo文件的时候参数 baseurl=file:///media/cdrom/Server

三、设置NTP服务器

1、配置NTP服务器
设置ntp服务器和本地进行同步，当然如果联网也可以和外部服务器同步，这里只需要保证所有服务器时间一致。
原因是因为，puppetmaster和agent之间时间相差不得超过10分钟（好像是），而后期配置的mcollecitve服务端和客户端之间不能相差60秒

  1. [root@puppetmaster ~]# rpm -qa | grep ntp
  2. fontpackages-filesystem-1.41-1.1.el6.noarch
  3. ntpdate-4.2.4p8-3.el6.x86_64  #默认已经安装
  4. ntp-4.2.4p8-3.el6.x86_64 #默认已经安装
  5. [root@puppetmaster ~]# cp /etc/ntp.conf{,.bak}
  7. [root@puppetmaster ~]# vim /etc/ntp.conf
  8. driftfile /var/lib/ntp/drift
  9. logfile /var/log/ntp.log
  10. Broadcastdelay 0.008
  11. restrict default kod nomodify notrap nopeer noquery
  12. restrict -6 default kod nomodify notrap nopeer noquery
  13. restrict default ignore
  14. restrict 127.0.0.1
  15. restrict -6 ::1
  16. restrict 192.168.100.0  mask 255.255.255.0 notrap nomodify
  17. server  127.127.1.0     # local clock
  18. fudge   127.127.1.0 stratum 10   refid NIST
  19. includefile /etc/ntp/crypto/pw
  20. keys /etc/ntp/keys
  22. [root@puppetmaster ~]# /etc/init.d/ntpd start
  23. Starting ntpd:                                             [  OK  ]
  24. [root@puppetmaster ~]# chkconfig ntpd on

2、节点测试并设置crontab

  1. [root@agent1 ~]# ntpdate puppetmaster.kisspuppet.com
  2.  7 Mar 06:08:30 ntpdate[16411]: adjust time server 192.168.100.110 offset 0.049448 sec
  4. [root@agent1 ~]# crontab -l #可通过croutab -e命令设置
  5. */30 * * * * /usr/sbin/ntpdate puppetmaster.kisspuppet.com >>/root/ntdate.log 2>&1 && /sbin/clock --systohc
  6. [root@agent1 ~]# /etc/init.d/crond reload
  7. Reloading cron daemon configuration:                       [  OK  ]

四、制作本地yum仓库

本实验大部分包来自于http://yum.puppetlabs.com，部分包来自于EPEL和Gems官网，rabbitmq官方等，关于如何制作yum仓库，之前有文章写道http://kisspuppet.com/2014/01/26/puppet_create_repo/，这里在简单操作一下

  1. [root@puppetmaster RHEL6U4]# yum install createrepo #安装制作软件包的软件
  2. [root@puppetmaster RHEL6U4]# createrepo . #将本目录以及子目录下所有rpm包生产repodata
  3. Spawning worker 0 with 105 pkgs
  4. Workers Finished
  5. Gathering worker results
  7. Saving Primary metadata
  8. Saving file lists metadata
  9. Saving other metadata
  10. Generating sqlite DBs
  11. Sqlite DBs complete

注：RHEL5的repodata必须在RHEL5环境下运行createrpo命令生成

五、配置FTP服务器

1、安装并配置FTP服务器

搭建FTP服务器的目的只要是为自定义yum仓库做准备

  1. [root@puppetmaster ~]# yum install vsftpd
  2. Loaded plugins: product-id, refresh-packagekit, security, subscription-manager
  3. This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
  4. rhel-base                                                                                         | 3.9 kB     00:00 ... 
  5. Setting up Install Process
  6. Resolving Dependencies
  7. --> Running transaction check
  8. ---> Package vsftpd.x86_64 0:2.2.2-11.el6 will be installed
  9. --> Finished Dependency Resolution
  10. ...
  12. [root@puppetmaster ~]# cp /etc/vsftpd/vsftpd.conf{,.bak}
  13. [root@puppetmaster ~]# vim /etc/vsftpd/vsftpd.conf
  14. anonymous_enable=YES
  15. local_enable=YES
  16. write_enable=YES
  17. local_umask=022
  18. anon_upload_enable=YES
  19. anon_root=/puppet   #匿名访问的目录
  20. anon_mkdir_write_enable=YES
  21. anon_other_write_enable=YES
  22. dirmessage_enable=YES
  23. xferlog_enable=YES
  24. connect_from_port_20=YES
  25. xferlog_file=/var/log/xferlog
  26. xferlog_std_format=YES
  27. listen=YES
  29. pam_service_name=vsftpd
  30. userlist_enable=YES
  31. tcp_wrappers=YES
  33. [root@puppetmaster ~]# /etc/init.d/vsftpd start
  34. Starting vsftpd for vsftpd:                                [  OK  ]
  35. [root@puppetmaster ~]# chkconfig vsftpd on

2、在FTP共享目录里制作yum仓库

将生成好的yum源copy到FTP共享目录中

  1. [root@puppetmaster ~]# ll /puppet/
  2. total 12
  3. drwxr-xr-x 4 root root 4096 Mar  7 06:21 RHEL5U7
  4. drwxr-xr-x 4 root root 4096 Mar  7 06:21 RHEL5U8
  5. drwxr-xr-x 6 root root 4096 Mar  7 06:21 RHEL6U4
  7. [root@puppetmaster ~]# ll /puppet/RHEL6U4/
  8. total 16600
  9. -rw-r--r-- 1 root root   87643 Mar  7 06:21 facter-1.7.3-1.el5.x86_64.rpm
  10. -rw-r--r-- 1 root root   87440 Mar  7 06:21 facter-1.7.3-1.el6.x86_64.rpm
  11. drwxr-xr-x 2 root root    4096 Mar  7 06:21 gem
  12. -rw-r--r-- 1 root root  634944 Mar  7 06:21 GeoIP-1.4.8-1.el6.x86_64.rpm
  13. -rw-r--r-- 1 root root  151654 Mar  7 06:21 keepalived-1.2.7-1.1.x86_64.rpm
  14. -rw-r--r-- 1 root root   10924 Mar  7 06:21 mcollective-2.2.4-1.el6.noarch.rpm
  15. -rw-r--r-- 1 root root   24596 Mar  7 06:21 mcollective-client-2.2.4-1.el6.noarch.rpm
  16. -rw-r--r-- 1 root root  759300 Mar  7 06:21 mcollective-common-2.2.4-1.el6.noarch.rpm
  17. drwxr-xr-x 3 root root    4096 Mar  7 06:21 mcollective-plugins
  18. drwxr-xr-x 2 root root    4096 Mar  7 06:21 mq
  19. -rw-r--r-- 1 root root  406588 Mar  7 06:21 nginx-1.0.15-5.el6.x86_64.rpm
  20. -rw-r--r-- 1 root root 1128352 Mar  7 06:21 puppet-2.7.23-1.el6.noarch.rpm
  21. -rw-r--r-- 1 root root 4509032 Mar  7 06:21 puppet-dashboard-1.2.23-1.el6.noarch.rpm
  22. -rw-r--r-- 1 root root   25596 Mar  7 06:21 puppet-server-2.7.23-1.el6.noarch.rpm
  23. -rw-r--r-- 1 root root 3729988 Mar  7 06:21 rabbitmq-server-3.1.5-1.el6.noarch.rpm
  24. drwxr-xr-x 2 root root    4096 Mar  7 06:21 repodata
  25. ...

六、配置远程yum仓库

  1. [root@puppetmaster ~]# vim /etc/yum.repos.d/rhel-puppet.repo
  2. [rhel-puppet]
  3. name=puppetlabs epel gems for rhel
  4. baseurl=ftp://puppetmaster.kisspuppet.com/RHEL6U4 #指向FTP服务器地址
  5. enabled=1
  6. gpgcheck=0
  8. [root@puppetmaster ~]# yum list | grep puppet-server #测试
  9. puppet-server.noarch                   2.7.25-1.el6                  rhel-puppet

注：node1~node3同上

七、重要软件版本选型

目前puppet最成熟的版本为2.7.和3.3版本，两个版本都可以，本实验采用2.7版本。

  1. puppet-server 2.7.25-1 来自puppetlabs
  2. puppet 2.7.25-1 来自puppetlabs
  3. facter 1.7.5 来自puppetlabs
  4. puppet-dashboar 1.2.23 来自puppetlabs
  5. ruby 1.8.* 系统自带
  6. mcollective 2.2.4 来自puppetlabs
  7. activemq 5.5.0 来自puppetlabs
  8. rabbitmq-server 3.1.5 来自rabbitmq官网
  9. kermit-webui 1.2-1 来自kermit官网
  10. ...