Linux: 运维自运化之Puppet

puppet describe -l：例如puppet支持的所有资源类型及其描述信息；
puppet describe -s <TYPE>：列出指定资源的简要说明；
puppet describe <TYPE>：显示指定资源的详细说明；

# puppet describe group

puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
  [-e|--execute] [--detailed-exitcodes] [-L|--loadclasses]
  [-l|--logdest syslog|eventlog|<FILE>|console] [--noop]
  [--catalog <catalog>] [--write-catalog-summary] <file>

-v : 显示详细信息
-d: 显示debug信息
--catalog <catalog> ：指定catalog文件
--noop： 干跑一遍不执行
-e ：执行代码
--modulepath  ：模块路径

$ puppet apply --modulepath=/root/dev/modules -e "include ntpd::server"

[root@hd-test-all-01 manifests]# puppet apply -v test1.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01(主机名称) in environment production(生产环境做了编译) in 0.14 seconds #puppet可以同时支持不同环境，生产环境(默认)、测试环境等
Info: Applying configuration version '1495678678'
Notice: /Stage[main]/Main/Group[dsstro]/ensure: created
Notice: /Stage[main]/Main/User[centos]/ensure: created
Info: Creating state file /var/lib/puppet/state/state.yaml   #创建了状态文件/var/lib/puppet/state/state.yaml

Notice: Finished catalog run in 0.09 seconds

Notice: 通知
info：信息

#group组资源
[root@hd-test-all-01 manifests]# puppet describe group
[root@hd-test-all-01 learnpuppet]# mkdir manifests
[root@hd-test-all-01 learnpuppet]# cd manifests/

#定义资源清单
[root@hd-test-all-01 manifests]# vim test1.pp
group{'distro':
    gid    => 2000,
    ensure => present,
}

user{'centos':
    uid    => 2000,
    gid    => 2000,
    shell  => '/bin/bash',
    home   => '/home/centos',
    ensure => present
}

#应用
[root@hd-test-all-01 manifests]# puppet apply -v test1.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01(主机名称) in environment production(生产环境做了编译) in 0.14 seconds #puppet可以同时支持不同环境，生产环境(默认)、测试环境等
Info: Applying configuration version '1495678678'
Notice: /Stage[main]/Main/Group[distro]/ensure: created
Notice: /Stage[main]/Main/User[centos]/ensure: created
Info: Creating state file /var/lib/puppet/state/state.yaml   #创建了状态文件/var/lib/puppet/state/state.yaml
Notice: Finished catalog run in 0.09 seconds
Notice: 通知
info：信息

#删除用户和组
[root@hd-test-all-01 manifests]# cat test1.pp
user{'centos':
    ensure => absent,
}     
group{'dsstro':
    ensure => absent,
}
[root@hd-test-all-01 manifests]# puppet apply -v  test1.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.12 seconds
Info: Applying configuration version '1495769186'
Notice: /Stage[main]/Main/User[centos]/ensure: removed
Notice: /Stage[main]/Main/Group[dsstro]/ensure: removed
Notice: Finished catalog run in 0.10 seconds

[root@hd-test-all-01 manifests]# cat test2.pp
#创建目录
file{'/tmp/mydir':   #如果这给了绝对路径，path是可以省略的。相对路径就必需指明绝对路径
    ensure   => directory,
}
#创建普通文件
file{'/tmp/puppet.file':
    content   => 'puppet testing\nsecond line.',
    ensure    => file,
    owner     => 'centos',
    group     => 'distro',
    mode      => '0400',
}
#下载文件
file{'/tmp/fstab.puppet':
    source     => '/etc/fstab',
    ensure    => file,
}
#创建软连接文件
file{'/tmp/puppet.link':
    ensure    => link,
    target    => '/tmp/puppet.file',
}

#如果文件存在就先对文件进行备份然后覆盖
file {"/tmp/test1":
        source => "/etc/fstab",
        backup => ".bak_$uptime_seconds",
}

#应用
[root@hd-test-all-01 manifests]# puppet apply -v -d test2.pp

[root@node01 learnc]# ll /tmp/test1*
-rw-r--r-- 1 root root 465 Jun  9 16:19 /tmp/test1
-rw-r--r-- 1 root root 468 Jun  9 16:19 /tmp/test1.bak_26005

查看是否有ext4模块，并加载ext4，执行多次不会出问题
[root@hd-test-all-01 manifests]# lsmod |grep ext
ext4                  379559  4
jbd2                   93252  1 ext4
mbcache                 8193  1 ext4
[root@hd-test-all-01 manifests]# modprobe ext4
[root@hd-test-all-01 manifests]# cat test3.pp
exec{'/sbin/modprobe ext4':
    user    => root,
    group   => root,
    refresh => '/sbin/modprobe -r ext4 && /sbin/modprobe ext4',
    timeout =>5,
    tries   =>2,
}
[root@hd-test-all-01 manifests]# puppet apply -v  test3.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495784663'
Notice: /Stage[main]/Main/Exec[/sbin/modprobe ext4]/returns: executed successfully
Notice: Finished catalog run in 0.08 seconds

[root@hd-test-all-01 manifests]# cat test3.pp
exec{'/bin/echo hello > /tmp/hello.txt':
    user    => root,
    group    => root,
    creates    => '/tmp/hello.txt',
}
[root@hd-test-all-01 manifests]# puppet apply -v  test3.pp  #有creates
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495785443'
Notice: Finished catalog run in 0.02 seconds
[root@hd-test-all-01 manifests]# puppet apply -v  test3.pp #没有creates
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495785423'
Notice: /Stage[main]/Main/Exec[/bin/echo hello > /tmp/hello.txt]/returns: executed successfully
Notice: Finished catalog run in 0.08 seconds
如果没有creates就会重复执行，那么就不满足exec  幂等性

[root@hd-test-all-01 manifests]# vim test3.pp
exec{'/bin/echo hello > /tmp/hello2.txt':
    user     => root,
    group    => root,
    #creates    => '/tmp/hello.txt',
    unless   => '/usr/bin/test -e /tmp/hello2.txt'
}
#第一次执行， test命令测试文件不存在返回code 非0，则执行命令echo
[root@hd-test-all-01 manifests]# puppet apply -v  test3.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495785773'
Notice: /Stage[main]/Main/Exec[/bin/echo hello > /tmp/hello2.txt]/returns: executed successfully

Notice: Finished catalog run in 0.15 seconds
#第2次执行，test命令测试文件存在返回code为0，则不执行命令echo
[root@hd-test-all-01 manifests]# puppet apply -v  test3.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495785786'
Notice: Finished catalog run in 0.08 seconds

[root@hd-test-all-01 manifests]# vim test3.pp

exec{'echo hello > /tmp/hello2.txt':
    path     => ["/bin","/usr/bin","/usr/sbin"],
    user     => root,
    group    => root,
    #creates    => '/tmp/hello.txt',
    unless   => 'test -e /tmp/hello2.txt'
    #path     => ["/bin","/usr/bin","/usr/sbin"],
}
[root@hd-test-all-01 manifests]# puppet apply -v  test3.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495786330'
Notice: Finished catalog run in 0.08 seconds

[root@hd-test-all-01 manifests]# vim test4.pp
notify{'hello there':}

[root@hd-test-all-01 manifests]# puppet  apply -v test4.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495789024'
Notice: hello there
Notice: /Stage[main]/Main/Notify[hello there]/message: defined 'message' as 'hello there'
Notice: Finished catalog run in 0.01 seconds


[root@hd-test-all-01 manifests]# cat test4.pp
notify{'hello':
    message => 'welcome to puppet world',
}
[root@hd-test-all-01 manifests]# puppet  apply -v test4.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.03 seconds
Info: Applying configuration version '1495789916'
Notice: welcome to puppet world
Notice: /Stage[main]/Main/Notify[hello]/message: defined 'message' as 'welcome to puppet world'
Notice: Finished catalog run in 0.01 seconds

[root@hd-test-all-01 manifests]# vim test5.pp
cron{'sysnc time':
    command  => 'echo hello world.',
    minute   => '*/10',
    ensure   =>  present,
}
[root@hd-test-all-01 manifests]# puppet apply -v test5.pp
/usr/lib/ruby/site_ruby/1.8/puppet/defaults.rb:214: warning: Insecure world writable dir /opt/apache-maven/bin in PATH, mode 040777
Notice: Compiled catalog for hd-test-all-01 in environment production in 0.06 seconds
Info: Applying configuration version '1495790386'
Notice: /Stage[main]/Main/Cron[sysnc time]/ensure: created
Notice: Finished catalog run in 0.03 seconds

[root@hd-test-all-01 manifests]# crontab  -l
# Puppet Name: sysnc time
*/10 * * * * echo hello world.

[root@centos7-01 learnc]# cat  tesst6.pp
package{'zsh':
     ensure   => latest,
}
package{'jdk':
     ensure   => installed,
     source   => '/root/jdk_8u25-linux-x64.rpm',
     provider => rpm,
}

package{'nginx':
    ensure    => latest,
}
service{'nginx':
    ensure    => running,
    enable    => true,
    hasrestart => true,
    hasstatus => true,
    restart    => 'systemctl reload nginx.service',
}    

[root@centos7-01 learnc]# cat test7.pp
service{'nginx':
    ensure   => running,
    enable   => true,
    hasrestart => true,
    hasstatus  => true,
    restart   => 'systemctl reload nginx',

}

[root@centos7-01 learnc]# puppet  apply -v test7.pp
Notice: Compiled catalog for centos7-01 in environment production in 0.13 seconds
Info: Applying configuration version '1496032587'
Notice: /Stage[main]/Main/Service[nginx]/ensure: ensure changed 'stopped' to 'running'
Info: /Stage[main]/Main/Service[nginx]: Unscheduling refresh on Service[nginx]  #没有接受到资源通知，是因为此时还没有订阅

[root@centos7-01 learnc]# puppet apply -v test8.pp
group{'linux':
    gid    => 3000,
    ensure => present,
    #before => User['suse'],#确宝user suse被创建前使用
} ->     #链式依赖 ，上面的做完做下面的

user{'suse':
    uid    => 3000,
    gid    => 3000,
    shell  => '/bin/bash',
    home   => '/home/suse',
    ensure => present,
    #require => Group['linux'],#依赖group linux资源使用
}

[root@centos7-01 learnc]# puppet apply -v test8.pp
Notice: Compiled catalog for centos7-01 in environment production in 0.19 seconds
Info: Applying configuration version '1496033732'
Notice: /Stage[main]/Main/Group[linux]/ensure: created
Notice: /Stage[main]/Main/User[suse]/ensure: created
Notice: Finished catalog run in 0.08 seconds

[root@centos7-01 learnc]# #把Nginx配置文件 拷贝一份
[root@centos7-01 learnc]# mkdir /root/modules/nginx/files -pv
[root@centos7-01 learnc]# cp /etc/nginx/nginx.conf /root/modules/nginx/files/ -pv

#nginx配置文件发生改，重启nginx服务
[root@centos7-01 learnc]# vim test9.pp
package{'nginx':
    #ensure   => latest,
    ensure   => installed,
}

file{'/etc/nginx/nginx.conf':
    ensure   => file,
    source   => '/root/modules/nginx/files/nginx.conf',
    require  => Package['nginx'],
    notify   => Service['nginx'],
}

service{'nginx':
    ensure   => running,
    enable   => true,
    hasrestart => true,
    hasstatus  => true,
    #restart   => 'systemctl restart nginx',
    require   => [Package['nginx'],File['/etc/nginx/nginx.conf']], #require 定义不了重启关系的 restart

}

#应用
[root@centos7-01 learnc]# puppet apply -v test9.pp
Notice: Compiled catalog for centos7-01 in environment production in 0.54 seconds
Info: Applying configuration version '1496136073'
Info: Computing checksum on file /etc/nginx/nginx.conf
Info: FileBucket got a duplicate file {md5}93bc8e01bfd45e7e18b23acc178ae25b
Info: /Stage[main]/Main/File[/etc/nginx/nginx.conf]: Filebucketed /etc/nginx/nginx.conf to puppet with sum 93bc8e01bfd45e7e18b23acc178ae25b
Notice: /Stage[main]/Main/File[/etc/nginx/nginx.conf]/content: content changed '{md5}93bc8e01bfd45e7e18b23acc178ae25b' to '{md5}4f1310fac32a5117d734745100ba52a4'
Info: /Stage[main]/Main/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx]
Notice: /Stage[main]/Main/Service[nginx]: Triggered 'refresh' from 1 events
Notice: Finished catalog run in 0.41 seconds

测试service{'nginx':} 为空也会refresh 重启服务

#facter变量 安装puppet时已经安装
[root@centos7-01 learnc]# rpm -qi facter
Name        : facter
Epoch       : 1
Version     : 2.4.4
Release     : 1.el7
Architecture: x86_64
Install Date: Wed 24 May 2017 05:26:17 PM CST
Group       : System Environment/Base
Size        : 279399
License     : ASL 2.0
Signature   : RSA/SHA512, Thu 21 May 2015 04:07:16 AM CST, Key ID 1054b7a24bd6ec30
Source RPM  : facter-2.4.4-1.el7.src.rpm
Build Date  : Wed 20 May 2015 12:42:31 AM CST
Build Host  : fontana.delivery.puppetlabs.net
Relocations : (not relocatable)
Vendor      : Puppet Labs
URL         : http://www.puppetlabs.com/puppet/related-projects/facter
Summary     : Ruby module for collecting simple facts about a host operating system
Description :
Ruby module for collecting simple facts about a host Operating
system. Some of the facts are preconfigured, such as the hostname and the
operating system. Additional facts can be added through simple Ruby scripts

[root@centos7-01 learnc]# facter  -p

$packages = $operatingsystem ? {
    /(?i-mx:ubuntu|debian)/        => 'apache2',
    /(?i-mx:centos|fedora|redhat)/ => 'httpd',
    }

[root@centos7-01 learnc]# vim test11.pp
if $processorcount>1 {   #比较表达式
    notice("SMP Host.")  #调用内置函数notice(显示输出)  显示对称多处理器
} else {
    notice("Poor Guy.")
}
[root@centos7-01 learnc]# puppet apply -v test11.pp
Notice: Scope(Class[main]): SMP Host.
Notice: Compiled catalog for centos7-01 in environment production in 0.02 seconds
Info: Applying configuration version '1496242369'
Notice: Finished catalog run in 0.01 seconds

注意
变量声明了为真，不声明为假
对于一个整形变量0值表示为假，非0为真
对于一个字符串空字符串为假

[root@centos7-01 learnc]# vim test12.pp
if $operatingsystem =~ /^(?i-mx:(centos|ubuntu|redhat|fedora))/ {
   notice("Welcome to $1 distribution linux.")
}

#应用
[root@centos7-01 learnc]# puppet apply -v test12.pp
Notice: Scope(Class[main]): Welcome to CentOS distribution linux.
Notice: Compiled catalog for centos7-01 in environment production in 0.02 seconds
Info: Applying configuration version '1496243551'
Notice: Finished catalog run in 0.01 seconds

case $operatingsystem {
        'Solaris': { notice("Welcom to Solaris") }
        'Redhat', 'CentOS': { notice("Welcom to RedHat OSFamily") }
        /^(Debian|Ubuntu)$/: { notice("Welcom to $1 linux") }
        default: { notice("Welcom, alien *_*") }
        }

[root@centos7-01 learnc]# vim test13.pp
$webserver = $operatingsystem ? {
   /(?i-mx:ubuntu|debian)/    => 'apache2',
   /(?i-mx:centos|fedora|redhat)/ => 'httpd',
}
if $processorcount>1 {
   notice("$webserver")
}

#应用
[root@centos7-01 learnc]# puppet apply -v test13.pp
Notice: Scope(Class[main]): httpd
Notice: Compiled catalog for centos7-01 in environment production in 0.02 seconds
Info: Applying configuration version '1496249025'
Notice: Finished catalog run in 0.01 seconds

示例2：
class dbserver($pkgname) {
        package{"$pkgname":
                ensure  => latest,
        }

        service{"$pkgname":
                ensure  => running,
                enable  => true,
        }
}

#include dbserver


if $operatingsystem == "CentOS" {
        $dbpkg = $operatingsystemmajrelease ? {
                7 => 'mariadb-server',
                default => 'mysqld-server',
        }
}

class{'dbserver':
        pkgname => $dbpkg,
}

[root@centos7-01 learnc]# tail test13.pp
class nginx {
... ...
}
include nginx
[root@centos7-01 learnc]# puppet apply -v test13.pp
Notice: Compiled catalog for centos7-01 in environment production in 0.70 seconds
Info: Applying configuration version '1496656907'
Notice: /Stage[main]/Nginx/Package[nginx]/ensure: created
Info: Computing checksum on file /etc/nginx/nginx.conf
Info: FileBucket got a duplicate file {md5}93bc8e01bfd45e7e18b23acc178ae25b
Info: /Stage[main]/Nginx/File[/etc/nginx/nginx.conf]: Filebucketed /etc/nginx/nginx.conf to puppet with sum 93bc8e01bfd45e7e18b23acc178ae25b
Notice: /Stage[main]/Nginx/File[/etc/nginx/nginx.conf]/content: content changed '{md5}93bc8e01bfd45e7e18b23acc178ae25b' to '{md5}9616c2f50cc51805decb6554ad3a97c5'
Info: /Stage[main]/Nginx/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx]
Notice: /Stage[main]/Nginx/Service[nginx]/ensure: ensure changed 'stopped' to 'running'
Info: /Stage[main]/Nginx/Service[nginx]: Unscheduling refresh on Service[nginx]

#定义基类
class base_class {
    ... puppet code ...
}
#再定义继承类
class base_class::class_name inherits base_class {
    ... puppet code ...
}

#定义父类
class nginx {
    package{'nginx':
        ensure    => latest,
        name => nginx,
    } ->
    service{'nginx':
        enable    => true,
        ensure    => running,
        hasrestart => true,
        hasstatus => true,
        restart => 'service nginx reload',
    }
}
#定义子类
class nginx::webserver inherits nginx {
    file{'/etc/nginx/nginx.conf':
        source => '/root/modules/nginx/files/nginx_web.conf',
        ensure    => file,
        notify     => Service['nginx'],
    }
}
class nginx::proxy inherits nginx {
    file{'/etc/nginx/nginx.conf':
        source => '/root/modules/nginx/files/nginx_proxy.conf',
        ensure    => file,
        notify     => Service['nginx'],
    }
}

#在子类中覆盖父类中已经定的资源的属性值：
class nginx::webserver2 inherits nginx {
        Package['nginx'] {
                name => tengine,
        }
        file{'/etc/nginx/nginx.conf':
                source => '/root/modules/nginx/files/nginx_web.conf',
                ensure  => file,
                notify  => Service['nginx'],
        }
}

file{'/etc/nginx/nginx.conf':
    content => template('/root/modules/nginx/files/nginx_proxy.conf'),   #文本流形式
    ensure    => file,
    notify     => Service['nginx'],
}

[root@centos7-01 learnc]# vim /root/modules/nginx/files/nginx_proxy.conf
user nginx;
worker_processes <%= @processorcount %>;

[root@centos7-01 learnc]# vim test16.pp
class nginx {

    package{'nginx':
        ensure => latest,
        name  => nginx,
    } ->

    service{'nginx':
        enable => true,
        ensure => running,
        hasrestart => true,
        hasstatus => true,
        restart => 'service nginx reload',
    }
}

class nginx::webserver inherits nginx {
     Package['nginx']{
         name => tengine,
     }
     file{'/etc/nginx/nginx.conf':
        source => '/root/modules/nginx/files/nginx_web.conf',
        ensure => file,
        notify => Service['nginx'],
     }
}

class nginx::proxy inherits nginx {
     file{'/etc/nginx/nginx.conf':
        content => template('/root/modules/nginx/files/nginx_proxy.conf'),
        ensure => file,
        notify => Service['nginx'],
     }
}

include nginx::proxy

[root@centos7-01 learnc]# puppet apply -v test16.pp
Notice: Compiled catalog for centos7-01 in environment production in 0.53 seconds
Info: Applying configuration version '1496704691'
Info: Computing checksum on file /etc/nginx/nginx.conf
Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Filebucketed /etc/nginx/nginx.conf to puppet with sum 9616c2f50cc51805decb6554ad3a97c5
Notice: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]/content: content changed '{md5}9616c2f50cc51805decb6554ad3a97c5' to '{md5}d885877ae53ea857e142961544242c33'
Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx]

Notice: /Stage[main]/Nginx/Service[nginx]: Triggered 'refresh' from 1 events
Notice: Finished catalog run in 172.42 seconds

[root@hd-test-all-01 manifests]# puppet help module
This subcommand can find, install, and manage modules from the Puppet Forge(第三方模块集结地),
a repository of user-contributed Puppet code. It can also generate empty
modules, and prepare locally developed modules for release on the Forge.

$ puppet apply --modulepath=/root/dev/modules -e "include ntpd::server"

[root@hd-test-all-01 manifests]# puppet module list
[root@hd-test-all-01 manifests]# puppet module search nginx

[root@hd-test-all-01 manifests]# mkdir -pv /etc/puppet/modules/nginx/{manifests,files,templates,tests,lib,spec}
[root@centos7-01 learnc]# cp test16.pp /etc/puppet/modules/nginx/manifests/init.pp
[root@centos7-01 learnc]# cp /root/modules/nginx/files/nginx_proxy.conf  /etc/puppet/modules/nginx/templates/nginx_proxy.conf.erb
[root@centos7-01 learnc]# cp  /root/modules/nginx/files/nginx_web.conf /etc/puppet/modules/nginx/files/
[root@centos7-01 learnc]# cat /etc/puppet/modules/nginx/manifests/init.pp
class nginx {

    package{'nginx':
        ensure => latest,
        name  => nginx,
    } ->

    service{'nginx':
        enable => true,
        ensure => running,
        hasrestart => true,
        hasstatus => true,
        restart => 'service nginx reload',
    }
}

class nginx::webserver inherits nginx {
     Package['nginx']{
         name => tengine,
     }
     file{'/etc/nginx/nginx.conf':
        source => 'puppet:///modules/nginx/nginx_web.conf',
        ensure => file,
        notify => Service['nginx'],
     }
}

class nginx::proxy inherits nginx {
     file{'/etc/nginx/nginx.conf':
        content => template('nginx/nginx_proxy.conf.erb'),
        ensure => file,
        notify => Service['nginx'],
     }
}

[root@centos7-01 learnc]# puppet apply --noop -v  -e "include nginx::proxy"
Notice: Compiled catalog for centos7-01 in environment production in 0.53 seconds
Info: Applying configuration version '1496741600'
Notice: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]/content: current_value {md5}9616c2f50cc51805decb6554ad3a97c5, should be {md5}d885877ae53ea857e142961544242c33 (noop)
Info: /Stage[main]/Nginx::Proxy/File[/etc/nginx/nginx.conf]: Scheduling refresh of Service[nginx]
Notice: Class[Nginx::Proxy]: Would have triggered 'refresh' from 1 events
Notice: /Stage[main]/Nginx/Service[nginx]: Would have triggered 'refresh' from 1 events
Notice: Class[Nginx]: Would have triggered 'refresh' from 1 events
Notice: Stage[main]: Would have triggered 'refresh' from 2 events
Notice: Finished catalog run in 0.63 seconds
[root@centos7-01 learnc]# vim /etc/nginx/nginx.conf

puppet doc --list 

查看某一reference：
puppet doc -r REFERENCE_NAME

[root@centos7-01 ~]# puppet doc --list
configuration - A reference for all settings
function - All functions available in the parser
indirection - Indirection types and their terminus classes
metaparameter - All Puppet metaparameters and all their details
providers - Which providers are valid for this machine
report - All available transaction reports
type - All Puppet resource types and all their details

[root@centos7-01 ~]# puppet doc -r configuration  |less
[root@centos7-01 ~]# puppet doc -r type | less

#master端配置DNS 主机信息
[root@centos7-01 ~]# hostname node01.bamaface.com
[root@centos7-01 ~]# bash
[root@node01 ~]# vim /etc/hosts
[root@node01 ~]# cat  /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.16.100.6 node01.bamaface.com node01
172.16.100.7 node02.bamaface.com node02

#puppet master前台运行测试
[root@node01 ~]# puppet master -v --no-daemonize
Info: Creating a new SSL key for ca  #自己生成 CA
Info: Creating a new SSL certificate request for ca  #给CA生成自签证书
Info: Certificate Request fingerprint (SHA256): EC:73:D2:8D:32:7C:8B:E7:74:4A:12:83:0C:D9:06:3A:3D:CB:9A:34:B0:62:32:AA:9A:BF:A2:6E:80:4A:61:E4  #自签请求
Notice: Signed certificate request for ca  #CA 做了自签
Info: Creating a new certificate revocation list  #生成证书回收列表
Info: Creating a new SSL key for node01.bamaface.com   #为当前节点生成用来通信的证书
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for node01.bamaface.com
Info: Certificate Request fingerprint (SHA256): 47:77:73:9B:5F:F2:F4:93:15:7C:AD:E0:78:D7:6D:63:81:97:69:D1:92:86:FD:D0:59:48:AB:C2:57:6E:39:6A  #签署证书
Notice: node01.bamaface.com has a waiting certificate request
Notice: Signed certificate request for node01.bamaface.com
Notice: Removing file Puppet::SSL::CertificateRequest node01.bamaface.com at '/var/lib/puppet/ssl/ca/requests/node01.bamaface.com.pem'
Notice: Removing file Puppet::SSL::CertificateRequest node01.bamaface.com at '/var/lib/puppet/ssl/certificate_requests/node01.bamaface.com.pem'
Notice: Starting Puppet master version 3.8.4

#查看证书生成路径文件
[root@node01 ~ ]# ls /var/lib/puppet/ssl/
ca  certificate_requests  certs  crl.pem  private  private_keys  public_keys
#这里只用于测试，删除即可。
[root@node01 ~ ]# rm -fr  /var/lib/puppet/ssl/*

#启动脚本位置
[root@node01 ~ ]# ls /usr/lib/systemd/system/pupp*
/usr/lib/systemd/system/puppetagent.service  /usr/lib/systemd/system/puppetmaster.service  /usr/lib/systemd/system/puppet.service
#启动后台运行master   工作于8140端口
[root@node01 ~ ]# systemctl start puppetmaster.service
[root@node01 ~ ]# ss -ntlp |grep 8140
LISTEN     0      128          *:8140                     *:*                   users:(("puppet",pid=2987,fd=8))

#测试agent端
[root@node02 ~]# hostname node02.bamaface.com
[root@node02 ~]# bash
[root@node02 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.16.100.6 node01.bamaface.com node01
172.16.100.7 node02.bamaface.com node02
#测试是否有问题
[root@node02 ~]# puppet agent --server=centos7-01 --no-daemonize --noop --test --verbose
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for node02
Info: Certificate Request fingerprint (SHA256): 12:77:E8:32:AD:20:77:27:7F:C9:58:27:74:34:7E:F3:D0:D1:22:03:DE:98:4D:0F:9B:9C:3E:0A:B2:DB:2B:C6
Info: Caching certificate for ca
Exiting; no certificate found and waitforcert is disabled
#执行 证书签署请求。 自动生成证书
[root@node02 ~]# puppet agent --server=node01.bamaface.com --no-daemonize  --verbose
Info: Creating a new SSL key for node02.bamaface.com
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for node02.bamaface.com
Info: Certificate Request fingerprint (SHA256): 54:60:2E:A4:04:0D:10:E7:44:AC:A3:E1:10:B5:62:D8:09:7F:7A:8F:F4:11:0E:4F:31:04:C3:F1:CB:86:1E:44
^C

#查看待签署证书
[root@node01 ~]# puppet cert list
  "node02.bamaface.com" (SHA256) 54:60:2E:A4:04:0D:10:E7:44:AC:A3:E1:10:B5:62:D8:09:7F:7A:8F:F4:11:0E:4F:31:04:C3:F1:CB:86:1E:44

#签署指定证书
[root@node01 ~]# puppet cert sign node02.bamaface.com
Notice: Signed certificate request for node02.bamaface.com
Notice: Removing file Puppet::SSL::CertificateRequest node02.bamaface.com at '/var/lib/puppet/ssl/ca/requests/node02.bamaface.com.pem'
#查看所有证书
[root@node01 ~]# puppet cert list --all
+ "node01.bamaface.com" (SHA256) 52:53:43:72:2E:85:B9:CD:5E:E0:D5:02:1E:BD:40:8C:9F:B2:A6:B7:DB:AF:2A:9A:F3:BA:8A:D7:8E:23:84:17 (alt names: "DNS:node01.bamaface.com", "DNS:puppet", "DNS:puppet.bamaface.com")
+ "node02.bamaface.com" (SHA256) 8A:F2:99:FB:39:E9:A3:36:F3:4C:28:D8:5F:62:C0:79:4F:A3:F1:6A:7B:DA:B0:9A:04:56:29:D9:4C:40:BB:C4


#agent端
[root@node02 ~]# puppet agent --server=node01.bamaface.com --no-daemonize  --verbose
Info: Caching certificate for node02.bamaface.com    #拿到了证书
Info: Caching certificate_revocation_list for ca      #拿到证书吊销列表
Info: Caching certificate for node02.bamaface.com
Notice: Starting Puppet client version 3.8.4
Info: Retrieving pluginfacts     #获取与自己相关的plugin
Info: Retrieving plugin     #加载所有插件
Info: Caching catalog for node02.bamaface.com
Info: Applying configuration version '1496977077'
Notice: Finished catalog run in 0.01 seconds
。。此时双方可以建立通信了

[root@node01 manifests]# cd /etc/puppet/manifests/
[root@node01 manifests]# cat site.pp
node "node02.bamaface.com" {
    include nginx::proxy,
}
[root@node01 manifests]# systemctl restart puppetmaster.service
[root@node01 manifests]# cat  /etc/puppet/modules/nginx/manifests/init.pp
class nginx {

    package{'nginx':
        ensure => latest,
        name  => nginx,
    } ->

    service{'nginx':
        enable => true,
        ensure => running,
        hasrestart => true,
        hasstatus => true,
        restart => 'service nginx reload',
    }
}

class nginx::webserver inherits nginx {
     file{'/etc/nginx/nginx.conf':
        source => 'puppet:///modules/nginx/nginx_web.conf',
        ensure => file,
        notify => Service['nginx'],
        require => Package['nginx'],
     }
}

class nginx::proxy inherits nginx {
     file{'/etc/nginx/nginx.conf':
        content => template('nginx/nginx_proxy.conf.erb'),
        ensure => file,
        notify => Service['nginx'],
        require => Package['nginx'],
     }
}


#agent端
[root@node02 ~]# puppet agent --server=node01.bamaface.com --no-daemonize  --verbose  --noop #测试一遍
[root@node02 ~]# puppet agent --server=node01.bamaface.com --no-daemonize  --verbose  #执行

[master]  #声明支持的环境 
environment = production, testing, development  支持的环境
[production]  #生产环境
manifest = /etc/puppet/environments/production/manifests/site.pp  #站点清单环境路径
modulepath = /etc/puppet/environments/production/modules/        #模块路径
fileserverconfig = /etc/puppet/fileserver.conf              #文件访问授权
[testing]   #测试环境 
manifest = /etc/puppet/environments/testing/manifests/site.pp
modulepath = /etc/puppet/environments/testing/modules/
fileserverconfig = /etc/puppet/fileserver.conf
[development]   #开发环境
manifest = /etc/puppet/environments/development/manifests/site.pp
modulepath = /etc/puppet/environments/development/modules/
fileserverconfig = /etc/puppet/fileserver.conf

[agent]
environment = testing

[root@node02 ~]# puppet config print environment
production
[root@node02 ~]# puppet agent --configprint environment
production

[mount_point]  #挂载点
path /PATH/TO/SOMEWHERE
allow HOSTNAME
allow_ip IP
deny all

[files]
path /etc/puppet/files
allow 10.1.4.0/24


2.   site.pp文件的配置
最好是更改其他的文件，然后用这个文件import进来，我这里为了测试简便就直接更改这个文件了
file { "/etc/test2":
    source => "puppet://node01.bamaface.com/files/test2",
  }

https://master:8140/{environment}/{resource}/{key}  #Restful风格的 API

#master端
[root@node01 puppet]# cat autosign.conf
*.bamaface.com

[root@node01 puppet]# systemctl restart puppetmaster.service

在[agent]后面添加   
listen = true  //这个是让puppet监听8139端口

编辑或新建文件/etc/puppet/namespaceauth.conf，包含下面内容
[puppetrunner]
allow *.cici.com

path /run
method save
allow node01.cici.com   
# puppet master

# this one is not stricly necessary, but it has the merit
# to show the default policy which is deny everything else
path /
auth any

[root@node01 puppet]# mkdir -pv  /etc/puppet/modules/varnish/{manifests,files,templates,lib,tests,spec} ’
[root@node01 puppet]# cat /etc/puppet/modules/varnish/manifests/init.pp
class varnish {
    package{'varnish':
        ensure  => latest,
    }
}

[root@node01 puppet]# cat  /etc/puppet/manifests/site.pp
node basenode {
    include varnish
    include nginx::proxy
}
node "node02.bamaface.com" inherits basenode {
}

[root@node02 ~]# vim /etc/puppet/puppet.conf
在[agent]后面添加
listen = true  //这个是让puppet监听8139端口

[root@node02 ~]# vim  /etc/puppet/namespaceauth.conf
[puppetrunner]
allow *.cici.com

[root@node02 ~]# vim auth.conf
[root@node02 ~]# vim /etc/puppet/auth.conf
path /run
method save
allow node01.cici.com
# puppet master

# this one is not stricly necessary, but it has the merit
# to show the default policy which is deny everything else
path /
auth any

[root@node02 ~]# systemctl restart puppetagent.service

[root@node01 puppet]# puppet kick node02.bamaface.com

# yum install rubygem-rake ruby-mysql
# yum localinstall puppet-dashboard
# gem install rake

CREATE DATABASE dashboard CHARACTER SET utf8;
GRANT ALL PRIVILEGES ON dashboard.* TO 'dashboard'@'localhost' IDENTIFIED BY 'your_password';

production:
  host: 172.16.100.15
  database: dashboard
  username: dashboard
  password: dbdpass
  encoding: utf8
  adapter: mysql

# cd /usr/share/puppet-dashboard/config/
# rake gems:refresh_specs

/usr/share/puppet-dashboard/script/server -e production

# puppet.conf (on puppet master)
[master]
  reports = store, http
  reporturl = http://dashboard.example.com:3000/reports/upload

# puppet.conf (on each agent)
[agent]
  report = true