自动化配置管理

Puppet

二、安装部署
1、环境描述
   master：172.16.0.167
   node1：172.16.0.168

   hosts文件如下：
       [root@master ~]# cat /etc/hosts
           127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
           ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
           172.16.0.167 master.yes.com
           172.16.0.168 node1.yes.com
   master端：
       [root@master ~]# hostname
           master.yes.com
       [root@master ~]# cat /etc/hostname
           master.yes.com
   node1端：
       [root@node1 ~]# hostname
           node1.yes.com
       [root@node1 ~]# cat /etc/hostname
           node1.yes.com
2、安装配置
   1）安装软件
       master：
           [root@master ~]# cd /etc/yum.repos.d/
           [root@master yum.repos.d]# ls
               bak               CentOS-Debuginfo.repo CentOS-Sources.repo
               CentOS-Base.repo CentOS-fasttrack.repo CentOS-Vault.repo
               CentOS-CR.repo    CentOS-Media.repo      mnt_cdrom.repo.gz
           [root@master yum.repos.d]# rpm -ivh https://mirrors.aliyun.com/epel/epel-release-latest-7.noarch.rpm
           [root@master yum.repos.d]# yum install ruby ruby-libs puppet puppet-server facter -y

           facter：系统盘点工具，负责采集系统信息的
       agent： yum配置同master
           [root@node1 yum.repos.d]# rpm -ivh https://mirrors.aliyun.com/epel/epel-release-latest-7.noarch.rpm
           [root@node1 yum.repos.d]# yum install ruby ruby-libs puppet facter -y
   2）master操作
       [root@master yum.repos.d]# puppet -V
           3.6.2
       a、准备site.pp
           [root@master ~]# touch /etc/puppet/manifests/site.pp
       b、启动服务
           [root@master ~]# systemctl start puppetmaster.service
           [root@master ~]# systemctl enable puppetmaster.service
           [root@master ~]# ls /var/lib/puppet/ssl/ca/signed/       —— 已签名的证书再次
                   master.yes.com.pem
   3）agent操作
       a、修改配置文件
           [root@node1 ~]# vim /etc/puppet/puppet.conf
                   server = master.yes.com       //在[main]段添加，指定谁是我的master
       b、启动服务
           [root@node1 ~]# systemctl start puppet
           [root@node1 ~]# systemctl enable puppet
   4）master操作
       查看签名请求列表
           [root@master ~]# puppet cert -l
               "node1.yes.com" (SHA256) 92:0B:27:72:08:92:BE:CA:14:31:43:6B:B8:90:20:86:3D:64:E0:E1:B4:79:46:D5:29:E0:8E:6E:96:35:14:7D
       签发所有的证书请求
           [root@master ~]# puppet cert -sa

       ------
           -l：查看列表
           -a：查看所有的
           -s：签发证书请求
       -----
       -----------------------------------------
            证书存放路径：
                /var/lib/puppet/ssl
            [root@master puppet]# cd /var/lib/puppet/ssl
            [root@master ssl]# ls
                ca                    certs    private       public_keys
                certificate_requests crl.pem private_keys
           证书请求在哪？
                [root@master requests]# pwd
                        /var/lib/puppet/ssl/ca/requests
       -----------------------------------------

   -------------------------------------------------------
   插曲：
       [root@master ~]# rpm -ql puppet-server
           /etc/puppet/fileserver.conf               文件服务器相关的配置文件
           /etc/puppet/manifests                       清单目录，存放配置文件的，配置文件以.pp结尾
           /usr/lib/systemd/system/puppetmaster.service
           /usr/share/man/man8/puppet-kick.8.gz
           /usr/share/man/man8/puppet-master.8.gz
           /usr/share/man/man8/puppet-queue.8.gz
       [root@master ~]# rpm -ql puppet | head -20
           /etc/NetworkManager
           /etc/NetworkManager/dispatcher.d
           /etc/NetworkManager/dispatcher.d/98-puppet
           /etc/logrotate.d/puppet
           /etc/puppet
           /etc/puppet/auth.conf       认证相关的配置文件
           /etc/puppet/modules           模块目录
           /etc/puppet/puppet.conf       主配置文件
           /usr/bin/extlookup2hiera
           /usr/bin/puppet
       [root@master ~]# yum install tree -y
       [root@master ~]# tree /etc/puppet/
               /etc/puppet/
                   ├── auth.conf
                   ├── fileserver.conf
                   ├── manifests
                   │          └── site.pp       //puppetmaster第一个加载的配置文件
                   ├── modules
                   └── puppet.conf
               2 directories, 4 files
       [root@master ~]# ls -d /var/lib/puppet/ssl ——   存放与ssl加密连接相关的文件，比如证书文件等
           /var/lib/puppet/ssl
   -------------------------------------------------------

Anisble

    1、安装ansible   ------ 167
        [root@master ~]# cat /etc/resolv.conf
       nameserver 8.8.8.8
       [root@master ~]# route -n
           Kernel IP routing table
           Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
           0.0.0.0         172.16.0.244    0.0.0.0         UG    100    0        0 ens33
           172.16.0.0      0.0.0.0         255.255.0.0     U     100    0        0 ens33
           192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
       [root@master ~]# ls /etc/yum.repos.d/
           bak               CentOS-Debuginfo.repo CentOS-Sources.repo epel-testing.repo
           CentOS-Base.repo CentOS-fasttrack.repo CentOS-Vault.repo    mnt_cdrom.repo.gz
           CentOS-CR.repo    CentOS-Media.repo      epel.repo
       [root@master ~]# rpm -ivh https://mirrors.aliyun.com/epel/epel-release-latest-7.noarch.rpm
       [root@master ~]# yum install ansible -y

       [root@master ~]# rpm -ql ansible | head -20
               /etc/ansible                   配置目录
               /etc/ansible/ansible.cfg               配置文件
               /etc/ansible/hosts                   定义被管主机列表的文件   host inventory
               /etc/ansible/roles                   定义角色的
               /usr/bin/ansible                       命令
               /usr/bin/ansible-doc
                   [root@master ~]# ansible-doc -l      查看ansible支持的模块列表
                   [root@master ~]# ansible-doc ping       //查看ping模块的帮助
               /usr/bin/ansible-playbook       运行ansible的剧本的

   2、ansible的简单配置
       [root@master ~]# vim /etc/ansible/hosts
           # Ex 1: Ungrouped hosts, specify before any group headers.

           ## green.example.com
           ## blue.example.com
           ## 192.168.100.1
           ## 192.168.100.10

           # Ex 2: A collection of hosts belonging to the 'webservers' group

           ## [webservers]
           ## alpha.example.org
           ## beta.example.org
           ## 192.168.1.100
           ## 192.168.1.110
           # If you have multiple hosts following a pattern(模式) you can specify
           # them like this:

           ## www[001:006].example.com      六台机器


       简单演示
           [root@master ~]# vim /etc/ansible/hosts
               172.16.0.168
           [root@master ~]# ansible 172.16.0.168 -m ping -k
                       -k：提示输入密码
SSH password:
172.16.0.168 | FAILED! => {
    "msg": "Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host."
}
[root@master ~]# ssh 172.16.0.168
The authenticity of host '172.16.0.168 (172.16.0.168)' can't be established.
ECDSA key fingerprint is SHA256:UxvDcaHHOg3F4Zwte3QiR1KN35pFyGYBSWnVhqMoSeQ.
ECDSA key fingerprint is MD5:3f:9f:aa:08:70:c6:0c:00:39:5a:f0:c6:5b:04:4e:b5.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.16.0.168' (ECDSA) to the list of known hosts.
[email protected]'s password:

[root@master ~]# ansible 172.16.0.168 -m ping -k
SSH password:
172.16.0.168 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

------
报错：原因：是该主机不在ansible的管理列表中
[root@master ~]# ansible 172.16.0.169 -m ping -k
SSH password:
[WARNING]: Could not match supplied host pattern, ignoring: 172.16.0.169

[WARNING]: No hosts matched, nothing to do
----------------------------

       案例一：定义一个主机组
           [root@master ~]# vim /etc/ansible/hosts
               [test]
                   172.16.0.168
                   172.16.0.169
           [root@master ~]# ansible test -m ping -k
               SSH password:
               172.16.0.169 | SUCCESS => {
                   "changed": false,
                   "ping": "pong"
               }
               172.16.0.168 | SUCCESS => {
                   "changed": false,
                   "ping": "pong"
               }

       --------------------------------
       方式二：如果不使用-k，想要不交互
           [root@master ~]# vim /etc/ansible/hosts
               172.16.0.168 ansible_ssh_user=root ansible_ssh_pass=redhat
           [root@master ~]# ansible 172.16.0.168 -m ping
               172.16.0.168 | SUCCESS => {
                   "changed": false,
                   "ping": "pong"
               }
       方式三：走ssh免密码登录    ******* 常用的方式
           批量传输公钥
           服务器端生成密钥对
               [root@master ~]# ssh-keygen

           [root@master ~]# yum install expect -y
           [root@master ~]# cat /root/ip_list.txt
               172.16.0.168
               172.16.0.169
           [root@master ~]# cat scp_ssh_key.sh
               #!/bin/bash
               for ipaddr in `cat /root/ip_list.txt`
               do
                   cmd="ssh-copy-id $ipaddr"
               expect -c "
                   set timeout 60
                   spawn $cmd
                   expect {
                   \"(yes/no)?\" {send \"yes\r\";exp_continue}
                   \"$ipaddr's password:\" {send \"redhat\r\";exp_continue}
                   }
               "
               done
           [root@master ~]# chmod +x scp_ssh_key.sh
           [root@master ~]# ./scp_ssh_key.sh

猜你喜欢