Puppet扩展篇2-如何使用虚拟资源解决puppet冲突问题

虚拟资源是一种用来管理多种配置共同依赖同一资源的方法。如果多个类依赖同一个资源时则可避免写多个资源，也可以解决资源重定义的错误。
虚拟资源经常用于用户管理中，虚拟资源只会被声明一次，但可以运用一次或多次。

要使用虚拟资源是需要在资源声明开头加上字符“@”来使资源虚拟化。然后再使用下面两种方法之一来实例化虚拟资源：

  • “飞船”语法<||>
  • realize函数

1. 定义两个用户，puppet和root，并将其虚拟化

注意定义虚拟资源必须在全局作用域或者节点作用域中定义，简单的理解，以下目录中site.pp就是全局作用域，包含nodes目录（site.pp中import了nodes目录），在节点node下定义的虚拟资源属于节点作用域，其他模块中的都属于局部作用域。

1.1 在全局作用域中创建对应的pp文件

  1. [root@linuxmaster1poc testing]# tree manifests/
  2. manifests/
  3. ├── nodes
  4. │   ├── puppetclient.pp
  5. │   ├── virtual_group.pp
  6. │   └── virtual_user.pp
  7. └── site.pp
  9. 1 directory, 4 files

1.2 创建虚拟用户puppet、root、xiaonuo

  1. [root@linuxmaster1poc testing]# vim manifests/nodes/virtual_user.pp 
  2. class alluser{
  3.   include alluser::puppet,alluser::root
  4. }
  6. class alluser::puppet{
  7.   @user { 'puppet':
  8.     ensure => present,
  9.     uid    => '52',
  10.     gid    => '52',
  11.     home   => '/var/lib/puppet',
  12.     shell  => '/sbin/nologin',
  13.   }
  14. }
  16. class alluser::root{
  17.   @user { 'root':
  18.     ensure => present,
  19.     uid    => '0',
  20.     gid    => '0',
  21.     home   => '/root',
  22.     shell  => '/bin/bash',
  23.   }
  24. }
  26. class alluser::xiaonuo{
  27.   @user { 'xiaonuo':
  28.     ensure => present,
  29.     uid    => '600',
  30.     gid    => '600',
  31.     home   => '/home/xiaonuo',
  32.     shell  => '/sbin/nologin',
  33.   }
  34. }

1.3 创建虚拟组puppet、root和xiaonuo

  1. [root@linuxmaster1poc testing]# vim manifests/nodes/virtual_group.pp 
  2. class allgroup{
  3.   include allgroup::puppet,allgroup::root
  4. }
  6. class allgroup::puppet{
  7.   @group { 'puppet':
  8.     ensure    => present,
  9.     name      => 'puppet',
  10.     gid       => '52',
  11.     allowdupe => false,
  12.     members   => 'puppet',
  13.   }
  14. }
  16. class allgroup::root{
  17.   @group { 'root':
  18.     ensure    => present,
  19.     name      => 'root',
  20.     gid       => '0',
  21.     allowdupe => false,
  22.     members   => 'root',
  23.   }
  24. }
  25. class allgroup::xiaonuo{
  26.   @group { 'xiaonuo':
  27.     ensure    => present,
  28.     name      => 'xiaonuo',
  29.     gid       => '600',
  30.     allowdupe => false,
  31.     members   => 'xiaonuo',
  32.   }
  33. }

2. 编写puppet模块，将虚拟资源用户puppet和组puppet实化

2.1 编写pupppet模块

  1. [root@linuxmaster1poc testing]# tree environment/modules/puppet
  2. environment/modules/puppet
  3. ├── files
  4. ├── manifests
  5. │   ├── config.pp
  6. │   ├── init.pp
  7. │   ├── install.pp
  8. │   ├── params.pp
  9. │   └── service.pp
  10. ├── README
  11. └── templates
  12.     ├── auth.conf.erb
  13.     ├── namespaceauth.conf.erb
  14.     └── puppet.conf.erb
  16. 3 directories, 9 files

2.2 编写puppet_linux57poc模块

  1. [root@linuxmaster1poc testing]# tree agents/modules/puppet_linux57poc/
  2. agents/modules/puppet_linux57poc/
  3. ├── files
  4. ├── manifests
  5. │   └── init.pp
  6. └── templates
  7.     ├── facts.txt.erb
  8.     └── motd.erb
  10. 3 directories, 3 files

2.3 实例化虚拟资源

2.3.1 在puppet模块中实例化

  1. [root@linuxmaster1poc testing]# vim environment/modules/puppet/manifests/config.pp 
  2. class puppet::config{
  3.   include puppet::params
  4.   include puppet::puppet_config,puppet::namespaceauth_config,puppet::auth_config,puppet::user,puppet::group
  5.   include alluser,allgroup #必须将节点作用域中的类包含进来
  6. }
  8. class puppet::puppet_config{
  9.   file { '/etc/puppet/puppet.conf':
  10.     ensure  => present,
  11.     content => template('puppet/puppet.conf.erb'),
  12.     owner   => 'puppet',
  13.     group   => 'puppet',
  14.     mode    => '0644',
  15.     backup  => main,
  16.     require => Class['puppet::install','puppet::user','puppet::group'],
  17.     notify  => Class['puppet::service'],
  18.   }
  19. }
  22. class puppet::auth_config{
  23.   file { '/etc/puppet/auth.conf':
  24.     ensure  => present,
  25.     content => template('puppet/auth.conf.erb'),
  26.     owner   => 'puppet',
  27.     group   => 'puppet',
  28.     mode    => '0644',
  29.     backup  => main,
  30.     require => Class['puppet::install','puppet::user','puppet::group'],
  31.     notify  => Class['puppet::service'],
  32.   }
  33. }
  35. class puppet::namespaceauth_config{
  36.   file { '/etc/puppet/namespaceauth.conf':
  37.     ensure  => present,
  38.     content => template('puppet/namespaceauth.conf.erb'),
  39.     owner   => 'puppet',
  40.     group   => 'puppet',
  41.     mode    => '0644',
  42.     backup  => main,
  43.     require => Class['puppet::install','puppet::user','puppet::group'],
  44.     notify  => Class['puppet::service'],
  45.   }
  46. }
  48. class puppet::user{ #使用飞船语法实化用户puppet资源
  49. #  realize User['puppet'] 
  50.   User <| title == 'puppet' |>
  51. }
  53. class puppet::group{ #使用realize函数实化组puppet资源
  54.   realize Group['puppet']
  55. #  Group <| title == 'puppet' |>
  56. }

2.3.2 在puppet_linux57poc模块中实例化

  1. [root@linuxmaster1poc testing]# cat agents/modules/puppet_linux57poc/manifests/init.pp 
  2. class puppet_linux57poc{
  3.   include puppet_linux57poc::motd_install,puppet_linux57poc::motd_config,puppet_linux57poc::facts,puppet_linux57poc::user,puppet_linux57poc::group
  4.   include alluser,allgroup #必须将节点作用域中的类包含进来
  5. }
  7. class puppet_linux57poc::motd_install{
  8.   package{ setup:
  9.     ensure => present,
  10.   }
  11. }
  12. class puppet_linux57poc::motd_config{
  13.   file{ "/etc/motd":
  14.     owner   => "xiaonuo",
  15.     group   => "root",
  16.     mode    => 0440,
  17.     content => template("puppet_linux57poc/motd.erb"),
  18.     backup  => 'main',
  19.     require => Class['puppet_linux57poc::motd_install','puppet_linux57poc::user','puppet_linux57poc::group']
  20.   }
  21. }
  22. class puppet_linux57poc::facts{
  23.   file{ "/etc/mcollective/facts.txt":
  24.     owner   => "root",
  25.     group   => "root",
  26.     mode    => 0400,
  27.     content => template("puppet_linux57poc/facts.txt.erb"),
  28.     backup  => 'main',
  29.     require => Class['puppet_linux57poc::motd_install','puppet_linux57poc::user','puppet_linux57poc::group']
  30.   }
  31. }
  33. class puppet_linux57poc::user{  #使用realize函数实化用户xiaonuo和root资源
  34.   realize( User['xiaonuo'], 
  35.            User['root'] )
  36. }
  38. class puppet_linux57poc::group{ #使用realize函数实化组xiaonuo和root资源
  39.   realize( Group['xiaonuo'],
  40.            Group['root'] )
  41. }

3. 测试

3.1 测试puppet模块（略）

3.2 测试puppet_linux57poc模块

3.2.1 查看当前系统是否有xiaonuo用户和组

  1. [root@linux57poc puppet]# id xiaonuo
  2. id: xiaonuo: No such user
  3. [root@linux57poc puppet]# cat /etc/group | grep xiaonuo
  4. [root@linux57poc puppet]# 
  5. [root@linux57poc puppet]# ll /etc/motd 
  6. -rwxrwxrwx 1 puppet puppet 313 Jan  2 06:17 /etc/motd

3.2.2 同步puppetmaster

  1. [root@linux57poc puppet]# puppet agent -t --environment=testing
  2. info: Retrieving plugin
  3. info: Loading facts in /var/lib/puppet/lib/facter/fact_apply.rb
  4. info: Caching catalog for puppet_linux57poc.dev.shanghaigm.com
  5. info: Applying configuration version '1389555288'
  6. notice: /Stage[main]/Allservice::Lm_sensors_service/Service[lm_sensors]/ensure: ensure changed 'running' to 'stopped'
  7. notice: /Group[xiaonuo]/ensure: created
  8. notice: /Stage[main]/Alluser::Xiaonuo/User[xiaonuo]/ensure: created
  9. ...
  10. info: FileBucket adding {md5}b2090646c444c5ddf1533749743ebd71
  11. info: /Stage[main]/Mcollective::Facter/File[/etc/mcollective/facts.yaml]: Filebucketed /etc/mcollective/facts.yaml to main with sum b2090646c444c5ddf1533749743ebd71
  12. notice: /Stage[main]/Sysctl::Exec/Exec[sysctl -p >/dev/null &]/returns: executed successfully
  13. notice: /Stage[main]/Puppet_linux57poc::Motd_config/File[/etc/motd]/owner: owner changed 'puppet' to 'xiaonuo'
  14. notice: /Stage[main]/Puppet_linux57poc::Motd_config/File[/etc/motd]/group: group changed 'puppet' to 'root'
  15. notice: /Stage[main]/Puppet_linux57poc::Motd_config/File[/etc/motd]/mode: mode changed '0777' to '0440'
  16. notice: /Stage[main]/Allservice::Bluetooth_service/Service[bluetooth]/ensure: ensure changed 'running' to 'stopped'
  17. notice: Finished catalog run in 4.54 seconds

3.2.3 验证结果是否正确

  1. [root@linux57poc puppet]# id xiaonuo
  2. uid=600(xiaonuo) gid=600(xiaonuo) groups=600(xiaonuo)
  3. [root@linux57poc puppet]# cat /etc/group | grep xiaonuo
  4. xiaonuo:x:600:
  5. [root@linux57poc puppet]# ll /etc/motd 
  6. -r--r----- 1 xiaonuo root 313 Jan  2 06:17 /etc/motd
  7. [root@linux57poc puppet]#