自动化运维工具之Puppet基础入门

　　一、简介

　　puppet是什么？它能做什么？

　　puppet是一个IT基础设施自动化运维工具，它能够帮助系统管理员管理基础设施的整个生命周期；比如，安装服务，提供配置文件，启动服务等等一系列操作；基于puppet，可实现自动化重复任务、快速部署关键性应用以及在本地或云端完成主动变更和快速扩展架构规模等；它遵循GPL协议（2.7.0以前），基于ruby语言开发，2.7.0以后使用apache 2.0协议；

　　puppet架构

　　提示：puppet是master/agent架构，master和agent使用https通信；puppet有两种工作方式，第一种是standalone模式，这种方式通常运行在单机之上；另一种则是master/agent模式，这种模式master和agent运行在不同的服务器之上；

　　puppet工作流程

　　提示：puppet工作流程分4个步骤，第一个步骤是定义manifast，这个步骤由管理员完成，主要通过过puppet的声明性配置语言定义基础设施配置的目标状态；第二个步骤是模拟，所谓模拟就是把我们定义的manifest，在目标主机上试着运行一遍，但不真正的应用（不改变目标主机的状态）；这一步主要用来检查我们定义的manifest是否有语法错误等等；第三步是强制，所谓强制就是把目标主机状态强制改变为我们在manifest中定义的状态；最后一步就是报告，报告就是指我们当前目标主机的状态和manifest中定义的状态的不同，以及达成目标状态所进行的改变信息；

　　puppet standalone模式工作过程

　　提示：在单机模式下，puppet的执行过程如上图；首先puppet会把我们写的manifest文件进行编译，编译成为代码这个为代码有点类似java中的字节码；然后puppet把编译的结果应用到对应的目标主机上；在应用之前它首先要对比目标主机当前状态和我们定义的目标状态是否一样，如果一样则跳过不更改其状态，如果不一样则强制让目标主机当前状态和我们定义的目标状态一样，最后将执行的过程报告给管理员；这里值得注意的是，在单机模型下，puppet应用manifest时，是我们人工手动指定来应用；

　　puppet master/agent模式工作过程

　　提示：master/agent模型，总的流程和单机模型类似，都是先编译然后再到应用；不同的是master/agent模型管理员可以不用手动应用manifest，默认情况下agent会每隔30分钟就到master拉取和自己相关的配置，如果对应master端有和自己相关的新配置，它会将其拉取到本地，然后强制执行，也就是说每隔30分钟各个agent会来master同步配置，如果对应目标主机当前状态和我们定义的目标状态不一样，最迟30分钟会自动修复；

　　二、puppet单机模型的安装和使用

　　安装puppet

[root@node12 ~]# yum install -y puppet

　　提示：单机模型我们只需要安装puppet即可；这个包来源epel仓库，安装之前，请确保epel仓库配置正常；另外在epel仓库中这个包的版本稍微有点低，如果要使用最新版本可以到https://yum.puppet.com这个仓库中下载对应版本的包进行安装即可；

　　puppet的基础使用

　　查看puppet工具帮助

[root@node12 ~]# puppet help

Usage: puppet <subcommand> [options] <action> [options]

Available subcommands:
    
  agent             The puppet agent daemon
  apply             Apply Puppet manifests locally
  ca                Local Puppet Certificate Authority management.
  catalog           Compile, save, view, and convert catalogs.
  cert              Manage certificates and requests
  certificate       Provide access to the CA for certificate management.
  certificate_request  Manage certificate requests.
  certificate_revocation_list  Manage the list of revoked certificates.
  config            Interact with Puppet's settings.
  describe          Display help about resource types
  device            Manage remote network devices
  doc               Generate Puppet documentation and references
  facts             Retrieve and store facts.
  file              Retrieve and store files in a filebucket
  filebucket        Store and retrieve files in a filebucket
  help              Display Puppet help.
  inspect           Send an inspection report
  instrumentation_data  Manage instrumentation listener accumulated data.
  instrumentation_listener  Manage instrumentation listeners.
  instrumentation_probe  Manage instrumentation probes.
  key               Create, save, and remove certificate keys.
  kick              Remotely control puppet agent
  man               Display Puppet manual pages.
  master            The puppet master daemon
  module            Creates, installs and searches for modules on the Puppet Forge.
  node              View and manage node definitions.
  parser            Interact directly with the parser.
  plugin            Interact with the Puppet plugin system.
  queue             Deprecated queuing daemon for asynchronous storeconfigs
  report            Create, display, and submit reports.
  resource          The resource abstraction layer shell
  resource_type     View classes, defined resource types, and nodes from all manifests.
  secret_agent      Mimics puppet agent.
  status            View puppet server status.

See 'puppet help <subcommand> <action>' for help on a specific subcommand action.
See 'puppet help <subcommand>' for help on a specific subcommand.
Puppet v3.6.2
[root@node12 ~]# 

　　提示：puppet这个工具有很多子命令，对应不同的子命令有不同的选项，同时对应不同的子命令有着不同的操作命令，不同操作命令对应不同的选项；

　　查询对应子命令的帮助

　　查看describe子命令的帮助说明

[root@node12 ~]# puppet describe --help

puppet-describe(8) -- Display help about resource types
========

SYNOPSIS
--------
Prints help about Puppet resource types, providers, and metaparameters.


USAGE
-----
puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta]


OPTIONS
-------
* --help:
  Print this help text

* --providers:
  Describe providers in detail for each type

* --list:
  List all types

* --meta:
  List all metaparameters

* --short:
  List only parameters without detail


EXAMPLE
-------
    $ puppet describe --list
    $ puppet describe file --providers
    $ puppet describe user -s -m


AUTHOR
------
David Lutterkort


COPYRIGHT
---------
Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License

[root@node12 ~]# 

　　提示：describe这个子命令主要用来显示资源类型的帮助信息；在puppet中所谓资源指我们能够操作目标主机的对象，比如创建用户，那么这个用户资源就是我们操作的对象，创建用户组，对应组就是我们操作的对象；

　　查看puppet支持的资源类型列表

[root@node12 ~]# puppet describe --list
These are the types known to puppet:
augeas          - Apply a change or an array of changes to the  ...
computer        - Computer object management using DirectorySer ...
cron            - Installs and manages cron jobs
exec            - Executes external commands
file            - Manages files, including their content, owner ...
filebucket      - A repository for storing and retrieving file  ...
group           - Manage groups
host            - Installs and manages host entries
interface       - This represents a router or switch interface
k5login         - Manage the `.k5login` file for a user
macauthorization - Manage the Mac OS X authorization database
mailalias       - .. no documentation ..
maillist        - Manage email lists
mcx             - MCX object management using DirectoryService  ...
mount           - Manages mounted filesystems, including puttin ...
nagios_command  - The Nagios type command
nagios_contact  - The Nagios type contact
nagios_contactgroup - The Nagios type contactgroup
nagios_host     - The Nagios type host
nagios_hostdependency - The Nagios type hostdependency
nagios_hostescalation - The Nagios type hostescalation
nagios_hostextinfo - The Nagios type hostextinfo
nagios_hostgroup - The Nagios type hostgroup
nagios_service  - The Nagios type service
nagios_servicedependency - The Nagios type servicedependency
nagios_serviceescalation - The Nagios type serviceescalation
nagios_serviceextinfo - The Nagios type serviceextinfo
nagios_servicegroup - The Nagios type servicegroup
nagios_timeperiod - The Nagios type timeperiod
notify          - .. no documentation ..
package         - Manage packages
resources       - This is a metatype that can manage other reso ...
router          - .. no documentation ..
schedule        - Define schedules for Puppet
scheduled_task  - Installs and manages Windows Scheduled Tasks
selboolean      - Manages SELinux booleans on systems with SELi ...
selmodule       - Manages loading and unloading of SELinux poli ...
service         - Manage running services
ssh_authorized_key - Manages SSH authorized keys
sshkey          - Installs and manages ssh host keys
stage           - A resource type for creating new run stages
tidy            - Remove unwanted files based on specific crite ...
user            - Manage users
vlan            - .. no documentation ..
whit            - Whits are internal artifacts of Puppet's curr ...
yumrepo         - The client-side description of a yum reposito ...
zfs             - Manage zfs
zone            - Manages Solaris zones
zpool           - Manage zpools
[root@node12 ~]# 

　　查看对应资源类型的使用帮助

　　查看user资源类型的帮助

[root@node12 ~]# puppet describe user

user
====
Manage users.  This type is mostly built to manage system
users, so it is lacking some features useful for managing normal
users.
This resource type uses the prescribed native tools for creating
groups and generally uses POSIX APIs for retrieving information
about them.  It does not directly modify `/etc/passwd` or anything.
**Autorequires:** If Puppet is managing the user's primary group (as
provided in the `gid` attribute), the user resource will autorequire
that group. If Puppet is managing any role accounts corresponding to the
user's roles, the user resource will autorequire those role accounts.


Parameters
----------

- **allowdupe**
    Whether to allow duplicate UIDs. Defaults to `false`.
    Valid values are `true`, `false`, `yes`, `no`. 

- **attribute_membership**
    Whether specified attribute value pairs should be treated as the
    **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
    attribute/value pairs for the user. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **attributes**
    Specify AIX attributes for the user in an array of attribute = value
    pairs.
Requires features manages_aix_lam.

- **auth_membership**
    Whether specified auths should be considered the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of auths the user
    has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`. 

- **auths**
    The auths the user has.  Multiple auths should be
    specified as an array.
Requires features manages_solaris_rbac.

- **comment**
    A description of the user.  Generally the user's full name.

- **ensure**
    The basic state that the object should be in.
    Valid values are `present`, `absent`, `role`. 

- **expiry**
    The expiry date for this user. Must be provided in
    a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
    If you want to make sure the user account does never
    expire, you can pass the special value `absent`.
    Valid values are `absent`. Values can match `/^\d{4}-\d{2}-\d{2}$/`.
    Requires features manages_expiry.

- **forcelocal**
    Forces the mangement of local accounts when accounts are also
    being managed by some other NSS
    Valid values are `true`, `false`, `yes`, `no`. 
    Requires features libuser.

- **gid**
    The user's primary group.  Can be specified numerically or by name.
    This attribute is not supported on Windows systems; use the `groups`
    attribute instead. (On Windows, designating a primary group is only
    meaningful for domain accounts, which Puppet does not currently manage.)

- **groups**
    The groups to which the user belongs.  The primary group should
    not be listed, and groups should be identified by name rather than by
    GID.  Multiple groups should be specified as an array.

- **home**
    The home directory of the user.  The directory must be created
    separately and is not currently checked for existence.

- **ia_load_module**
    The name of the I&A module to use to manage this user.
    Requires features manages_aix_lam.

- **iterations**
    This is the number of iterations of a chained computation of the
    password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter
    is used in OS X. This field is required for managing passwords on OS X
    >= 10.8.
Requires features manages_password_salt.

- **key_membership**
    Whether specified key/value pairs should be considered the
    **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
    the user's attributes. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **keys**
    Specify user attributes in an array of key = value pairs.
    Requires features manages_solaris_rbac.

- **managehome**
    Whether to manage the home directory when managing the user.
    This will create the home directory when `ensure => present`, and
    delete the home directory when `ensure => absent`. Defaults to `false`.
    Valid values are `true`, `false`, `yes`, `no`. 

- **membership**
    Whether specified groups should be considered the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of groups to which
    the user belongs. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **name**
    The user name. While naming limitations vary by operating system,
    it is advisable to restrict names to the lowest common denominator,
    which is a maximum of 8 characters beginning with a letter.
    Note that Puppet considers user names to be case-sensitive, regardless
    of the platform's own rules; be sure to always use the same case when
    referring to a given user.

- **password**
    The user's password, in whatever encrypted format the local
    system requires.
    * Most modern Unix-like systems use salted SHA1 password hashes. You can
    use
      Puppet's built-in `sha1` function to generate a hash from a password.
    * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
    * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs
    [stdlib][]
      module contains a `str2saltedsha512` function which can generate
    password
      hashes for Lion.
    * Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
      managing passwords on these systems the salt and iterations properties
      need to be specified as well as the password.
    * Windows passwords can only be managed in cleartext, as there is no
    Windows API
      for setting the password hash.
    [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
    Be sure to enclose any value that includes a dollar sign ($) in single
    quotes (') to avoid accidental variable interpolation.
    Requires features manages_passwords.

- **password_max_age**
    The maximum number of days a password may be used before it must be
    changed.
Requires features manages_password_age.

- **password_min_age**
    The minimum number of days a password must be used before it may be
    changed.
Requires features manages_password_age.

- **profile_membership**
    Whether specified roles should be treated as the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of roles
    of which the user is a member. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **profiles**
    The profiles the user has.  Multiple profiles should be
    specified as an array.
Requires features manages_solaris_rbac.

- **project**
    The name of the project associated with a user.
    Requires features manages_solaris_rbac.

- **purge_ssh_keys**
    Purge ssh keys authorized for the user
    if they are not managed via ssh_authorized_keys. When true,
    looks for keys in .ssh/authorized_keys in the user's home
    directory. Possible values are true, false, or an array of
    paths to file to search for authorized keys. If a path starts
    with ~ or %h, this token is replaced with the user's home directory.
    Valid values are `true`, `false`. 

- **role_membership**
    Whether specified roles should be considered the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of roles the user
    has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`. 

- **roles**
    The roles the user has.  Multiple roles should be
    specified as an array.
Requires features manages_solaris_rbac.

- **salt**
    This is the 32 byte salt used to generate the PBKDF2 password used in
    OS X. This field is required for managing passwords on OS X >= 10.8.
    Requires features manages_password_salt.

- **shell**
    The user's login shell.  The shell must exist and be
    executable.
    This attribute cannot be managed on Windows systems.
    Requires features manages_shell.

- **system**
    Whether the user is a system user, according to the OS's criteria;
    on most platforms, a UID less than or equal to 500 indicates a system
    user. Defaults to `false`.
    Valid values are `true`, `false`, `yes`, `no`. 

- **uid**
    The user ID; must be specified numerically. If no user ID is
    specified when creating a new user, then one will be chosen
    automatically. This will likely result in the same user having
    different UIDs on different systems, which is not recommended. This is
    especially noteworthy when managing the same user on both Darwin and
    other platforms, since Puppet does UID generation on Darwin, but
    the underlying tools do so on other platforms.
    On Windows, this property is read-only and will return the user's
    security identifier (SID).

Providers
---------
    aix, directoryservice, hpuxuseradd, ldap, pw, user_role_add, useradd,
    windows_adsi
[root@node12 ~]# 

　　提示：以上从以上帮助信息可以看到，我们定义在目标主机上创建用户可以使用user这个资源类型，其中对应有很多属性，这些属性主要用来描述对应资源该有的属性，比如uid用来描述用户的id，gid用于描述组id；

　　定义资源清单语法

type {'title':
    attribute1 	=> value1,
    atrribute2	=> value2,
    ……
}

　　提示：type指资源类型，type必须使用小写字符；title是一个字符串，在同一类型中必须惟一；

　　资源属性中的三个特殊属性：

　　　　Namevar， 可简称为name；
　　　　ensure：资源的目标状态；
　　　　Provider：指明资源的管理接口；

　　示例：定义manifest，创建用户

[root@node12 ~]# cat user.pp
user{'tom':
        ensure  => present,
        uid     => 5000,
        home    => '/home/tom',
        shell   => '/bin/bash',
        comment => 'this is test user',
}
[root@node12 ~]#

　　提示：上述资源清单中，没有用name指定对应资源类型的名称，如果没有指定默认使用title的值作为其资源类型的名称；资源清单使用.pp为后缀，意思就是puppet的简写；

　　应用资源清单

[root@node12 ~]# puppet apply -v --noop user.pp
Notice: Compiled catalog for node12.test.org in environment production in 0.07 seconds
Info: Applying configuration version '1606542594'
Notice: /Stage[main]/Main/User[tom]/ensure: current_value absent, should be present (noop)
Notice: Class[Main]: Would have triggered 'refresh' from 1 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Info: Creating state file /var/lib/puppet/state/state.yaml
Notice: Finished catalog run in 0.02 seconds
[root@node12 ~]# 

　　提示：应用资源清单使用puppet apply命令，其中-v用于指定显示执行输出过程；--noop用于指定干跑，不应用，主要检测对应的manifast文件是否有语法错误；如果没有语法错误，我们就可以把对应noop选项取消，然后真正应用其资源清单到本地；

[root@node12 ~]# puppet apply -v  user.pp      
Notice: Compiled catalog for node12.test.org in environment production in 0.06 seconds
Info: Applying configuration version '1606542785'
Notice: /Stage[main]/Main/User[tom]/ensure: created
Notice: Finished catalog run in 0.05 seconds
[root@node12 ~]#

　　验证：查看tom用户是否创建呢？

[root@node12 ~]# getent passwd tom
tom:x:5000:5000:this is test user:/home/tom:/bin/bash
[root@node12 ~]# 

　　提示：可以看到对应tom用户已经创建成功，并且uid，注释信息和家目录，shell等信息都是我们指定的内容；

　　示例：删除tom用户

[root@node12 ~]# cat user.pp
user{'tom':
        ensure  => absent,
        uid     => 5000,
        home    => '/home/tom',
        shell   => '/bin/bash',
        comment => 'this is test user',
}
[root@node12 ~]#

　　提示：ensure这个属性主要指定对应资源类型在目标主机上的状态，absent表示缺席之意，如果对应主机上有tom用户就删除；

　　验证：应用资源清单，看看tom用户是否被删除？

[root@node12 ~]# puppet apply -v user.pp
Notice: Compiled catalog for node12.test.org in environment production in 0.25 seconds
Info: Applying configuration version '1606574872'
Notice: /Stage[main]/Main/User[tom]/ensure: removed
Notice: Finished catalog run in 0.11 seconds
[root@node12 ~]# getent passwd tom      
[root@node12 ~]# id tom
id: tom: no such user
[root@node12 ~]# 

　　提示：可以看到应用了资源清单以后，本机的tom用户就被删除了；

　　以上就是puppet的基础使用方式，在使用puppet我们最核心的就是要写manifest（资源清单），就是我们要让某资源处于什么状态，就用puppet的配置语言描述，然后使用puppet apply命令应用对应的资源清单即可；