目录

Puppet Server从部署到上线使用

注意
本文最后更新于 2021-10-29,文中内容可能已过时。

这是一篇todo文章,可以快速将puppetserver部署起来,经常遇到的坑也会写出来,但是自己不踩吭记忆是没有成长的(不仅仅是收获经验,重要的是增加了学习的能力),如果不缺时间的话,强烈建议看官方文档:https://puppet.com/docs/puppet/7/server/install_from_packages.html

安装master

通过源来安装

sudo rpm -Uvh https://yum.puppet.com/puppet7-release-el-8.noarch.rpm
sudo yum install puppetserver

启动master服务

sudo systemctl start puppetserver

如果报错Found master private key '/etc/puppetlabs/puppet/ssl/private_keys/localhost.localdomain.pem' but master public key '/etc/puppetlabs/puppet/ssl/public...需要把ssl目录删除sudo rm -rf /etc/puppetlabs/puppet/ssl/*已经上线的master,请自己考虑后果再决定),再尝试启动

修改dns解析

解析puppet到master的ip即可

或者绑定hosts, 如果是hosts,客户端和服务器都需要绑定hosts到master的ip

10.10.0.10  puppet

安装puppet-agent

安装agnet需要先启用仓库

sudo rpm -Uvh https://yum.puppet.com/puppet7-release-el-8.noarch.rpm
sudo yum install puppet-agent

anget连接server

手动签名认证

#] puppet agent --test

Info: Creating a new RSA SSL key for agent
Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for agent
Info: Certificate Request fingerprint (SHA256): A3:CA:C3:B1:69:C9:97:3D:3A:BB:A4:F0:E5:15:34:A5:74:B5:86:08:E1:A9:02:A6:D4:91:12:04:6A:89:76:70
Info: Certificate for agent has not been signed yet
Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (agent).
Exiting now because the waitforcert setting is set to 0.

这时候需要在master节点上面允许agnet的证书,以下是master节点执行:

# 查看还没签名的证书
puppetserver ca list

# 给所有证书签名
puppetserver ca sign --all

自动签名认证

自动认证需要编写ACL规则,一个简单的规则如下:

#] vim /etc/puppetlabs/puppet/autosign.conf

*.nutscloud.com

然后重新启动master服务即可

部署代码

然后把清单文件(.pp)放到master的/etc/puppetlabs/code/environments/production/manifests
modules放到/etc/puppetlabs/code/modules

其他证书操作

吊销证书

如果不想让某个agent来连接master,可以在master上面把证书撤销

puppetserver ca revoke --certname agent_name

清理证书

比如说重装了系统,需要master重新生成证书

puppetserver ca clean --certname agent_name