一、簡介

　　puppet是什麼？它能做什麼？

　　puppet是一個IT基礎設施自動化運維工具，它能夠幫助系統管理員管理基礎設施的整個生命週期；比如，安裝服務，提供配置檔案，啟動服務等等一系列操作；基於puppet，可實現自動化重複任務、快速部署關鍵性應用以及在本地或雲端完成主動變更和快速擴充套件架構規模等；它遵循GPL協議（2.7.0以前），基於ruby語言開發，2.7.0以後使用apache 2.0協議；

　　puppet架構

　　提示：puppet是master/agent架構，master和agent使用https通訊；puppet有兩種工作方式，第一種是standalone模式，這種方式通常執行在單機之上；另一種則是master/agent模式，這種模式master和agent執行在不同的伺服器之上；

　　puppet工作流程

　　提示：puppet工作流程分4個步驟，第一個步驟是定義manifast，這個步驟由管理員完成，主要通過過puppet的宣告性配置語言定義基礎設施配置的目標狀態；第二個步驟是模擬，所謂模擬就是把我們定義的manifest，在目標主機上試著執行一遍，但不真正的應用（不改變目標主機的狀態）；這一步主要用來檢查我們定義的manifest是否有語法錯誤等等；第三步是強制，所謂強制就是把目標主機狀態強制改變為我們在manifest中定義的狀態；最後一步就是報告，報告就是指我們當前目標主機的狀態和manifest中定義的狀態的不同，以及達成目標狀態所進行的改變資訊；

　　puppet standalone模式工作過程

　　提示：在單機模式下，puppet的執行過程如上圖；首先puppet會把我們寫的manifest檔案進行編譯，編譯成為程式碼這個為程式碼有點類似java中的位元組碼；然後puppet把編譯的結果應用到對應的目標主機上；在應用之前它首先要對比目標主機當前狀態和我們定義的目標狀態是否一樣，如果一樣則跳過不更改其狀態，如果不一樣則強制讓目標主機當前狀態和我們定義的目標狀態一樣，最後將執行的過程報告給管理員；這裡值得注意的是，在單機模型下，puppet應用manifest時，是我們人工手動指定來應用；

　　puppet master/agent模式工作過程

　　提示：master/agent模型，總的流程和單機模型類似，都是先編譯然後再到應用；不同的是master/agent模型管理員可以不用手動應用manifest，預設情況下agent會每隔30分鐘就到master拉取和自己相關的配置，如果對應master端有和自己相關的新配置，它會將其拉取到本地，然後強制執行，也就是說每隔30分鐘各個agent會來master同步配置，如果對應目標主機當前狀態和我們定義的目標狀態不一樣，最遲30分鐘會自動修復；

　　二、puppet單機模型的安裝和使用

　　安裝puppet

[root@node12 ~]# yum install -y puppet

　　提示：單機模型我們只需要安裝puppet即可；這個包來源epel倉庫，安裝之前，請確保epel倉庫配置正常；另外在epel倉庫中這個包的版本稍微有點低，如果要使用最新版本可以到https://yum.puppet.com這個倉庫中下載對應版本的包進行安裝即可；

　　puppet的基礎使用

　　檢視puppet工具幫助

[root@node12 ~]# puppet help

Usage: puppet <subcommand> [options] <action> [options]

Available subcommands:
    
  agent             The puppet agent daemon
  apply             Apply Puppet manifests locally
  ca                Local Puppet Certificate Authority management.
  catalog           Compile, save, view, and convert catalogs.
  cert              Manage certificates and requests
  certificate       Provide access to the CA for certificate management.
  certificate_request  Manage certificate requests.
  certificate_revocation_list  Manage the list of revoked certificates.
  config            Interact with Puppet's settings.
  describe          Display help about resource types
  device            Manage remote network devices
  doc               Generate Puppet documentation and references
  facts             Retrieve and store facts.
  file              Retrieve and store files in a filebucket
  filebucket        Store and retrieve files in a filebucket
  help              Display Puppet help.
  inspect           Send an inspection report
  instrumentation_data  Manage instrumentation listener accumulated data.
  instrumentation_listener  Manage instrumentation listeners.
  instrumentation_probe  Manage instrumentation probes.
  key               Create, save, and remove certificate keys.
  kick              Remotely control puppet agent
  man               Display Puppet manual pages.
  master            The puppet master daemon
  module            Creates, installs and searches for modules on the Puppet Forge.
  node              View and manage node definitions.
  parser            Interact directly with the parser.
  plugin            Interact with the Puppet plugin system.
  queue             Deprecated queuing daemon for asynchronous storeconfigs
  report            Create, display, and submit reports.
  resource          The resource abstraction layer shell
  resource_type     View classes, defined resource types, and nodes from all manifests.
  secret_agent      Mimics puppet agent.
  status            View puppet server status.

See 'puppet help <subcommand> <action>' for help on a specific subcommand action.
See 'puppet help <subcommand>' for help on a specific subcommand.
Puppet v3.6.2
[root@node12 ~]# 

　　提示：puppet這個工具有很多子命令，對應不同的子命令有不同的選項，同時對應不同的子命令有著不同的操作命令，不同操作命令對應不同的選項；

　　查詢對應子命令的幫助

　　檢視describe子命令的幫助說明

[root@node12 ~]# puppet describe --help

puppet-describe(8) -- Display help about resource types
========

SYNOPSIS
--------
Prints help about Puppet resource types, providers, and metaparameters.


USAGE
-----
puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta]


OPTIONS
-------
* --help:
  Print this help text

* --providers:
  Describe providers in detail for each type

* --list:
  List all types

* --meta:
  List all metaparameters

* --short:
  List only parameters without detail


EXAMPLE
-------
    $ puppet describe --list
    $ puppet describe file --providers
    $ puppet describe user -s -m


AUTHOR
------
David Lutterkort


COPYRIGHT
---------
Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License

[root@node12 ~]# 

　　提示：describe這個子命令主要用來顯示資源型別的幫助資訊；在puppet中所謂資源指我們能夠操作目標主機的物件，比如建立使用者，那麼這個使用者資源就是我們操作的物件，建立使用者組，對應組就是我們操作的物件；

　　檢視puppet支援的資源型別列表

[root@node12 ~]# puppet describe --list
These are the types known to puppet:
augeas          - Apply a change or an array of changes to the  ...
computer        - Computer object management using DirectorySer ...
cron            - Installs and manages cron jobs
exec            - Executes external commands
file            - Manages files, including their content, owner ...
filebucket      - A repository for storing and retrieving file  ...
group           - Manage groups
host            - Installs and manages host entries
interface       - This represents a router or switch interface
k5login         - Manage the `.k5login` file for a user
macauthorization - Manage the Mac OS X authorization database
mailalias       - .. no documentation ..
maillist        - Manage email lists
mcx             - MCX object management using DirectoryService  ...
mount           - Manages mounted filesystems, including puttin ...
nagios_command  - The Nagios type command
nagios_contact  - The Nagios type contact
nagios_contactgroup - The Nagios type contactgroup
nagios_host     - The Nagios type host
nagios_hostdependency - The Nagios type hostdependency
nagios_hostescalation - The Nagios type hostescalation
nagios_hostextinfo - The Nagios type hostextinfo
nagios_hostgroup - The Nagios type hostgroup
nagios_service  - The Nagios type service
nagios_servicedependency - The Nagios type servicedependency
nagios_serviceescalation - The Nagios type serviceescalation
nagios_serviceextinfo - The Nagios type serviceextinfo
nagios_servicegroup - The Nagios type servicegroup
nagios_timeperiod - The Nagios type timeperiod
notify          - .. no documentation ..
package         - Manage packages
resources       - This is a metatype that can manage other reso ...
router          - .. no documentation ..
schedule        - Define schedules for Puppet
scheduled_task  - Installs and manages Windows Scheduled Tasks
selboolean      - Manages SELinux booleans on systems with SELi ...
selmodule       - Manages loading and unloading of SELinux poli ...
service         - Manage running services
ssh_authorized_key - Manages SSH authorized keys
sshkey          - Installs and manages ssh host keys
stage           - A resource type for creating new run stages
tidy            - Remove unwanted files based on specific crite ...
user            - Manage users
vlan            - .. no documentation ..
whit            - Whits are internal artifacts of Puppet's curr ...
yumrepo         - The client-side description of a yum reposito ...
zfs             - Manage zfs
zone            - Manages Solaris zones
zpool           - Manage zpools
[root@node12 ~]# 

　　檢視對應資源型別的使用幫助

　　檢視user資源型別的幫助

[root@node12 ~]# puppet describe user

user
====
Manage users.  This type is mostly built to manage system
users, so it is lacking some features useful for managing normal
users.
This resource type uses the prescribed native tools for creating
groups and generally uses POSIX APIs for retrieving information
about them.  It does not directly modify `/etc/passwd` or anything.
**Autorequires:** If Puppet is managing the user's primary group (as
provided in the `gid` attribute), the user resource will autorequire
that group. If Puppet is managing any role accounts corresponding to the
user's roles, the user resource will autorequire those role accounts.


Parameters
----------

- **allowdupe**
    Whether to allow duplicate UIDs. Defaults to `false`.
    Valid values are `true`, `false`, `yes`, `no`. 

- **attribute_membership**
    Whether specified attribute value pairs should be treated as the
    **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
    attribute/value pairs for the user. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **attributes**
    Specify AIX attributes for the user in an array of attribute = value
    pairs.
Requires features manages_aix_lam.

- **auth_membership**
    Whether specified auths should be considered the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of auths the user
    has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`. 

- **auths**
    The auths the user has.  Multiple auths should be
    specified as an array.
Requires features manages_solaris_rbac.

- **comment**
    A description of the user.  Generally the user's full name.

- **ensure**
    The basic state that the object should be in.
    Valid values are `present`, `absent`, `role`. 

- **expiry**
    The expiry date for this user. Must be provided in
    a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
    If you want to make sure the user account does never
    expire, you can pass the special value `absent`.
    Valid values are `absent`. Values can match `/^\d{4}-\d{2}-\d{2}$/`.
    Requires features manages_expiry.

- **forcelocal**
    Forces the mangement of local accounts when accounts are also
    being managed by some other NSS
    Valid values are `true`, `false`, `yes`, `no`. 
    Requires features libuser.

- **gid**
    The user's primary group.  Can be specified numerically or by name.
    This attribute is not supported on Windows systems; use the `groups`
    attribute instead. (On Windows, designating a primary group is only
    meaningful for domain accounts, which Puppet does not currently manage.)

- **groups**
    The groups to which the user belongs.  The primary group should
    not be listed, and groups should be identified by name rather than by
    GID.  Multiple groups should be specified as an array.

- **home**
    The home directory of the user.  The directory must be created
    separately and is not currently checked for existence.

- **ia_load_module**
    The name of the I&A module to use to manage this user.
    Requires features manages_aix_lam.

- **iterations**
    This is the number of iterations of a chained computation of the
    password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter
    is used in OS X. This field is required for managing passwords on OS X
    >= 10.8.
Requires features manages_password_salt.

- **key_membership**
    Whether specified key/value pairs should be considered the
    **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
    the user's attributes. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **keys**
    Specify user attributes in an array of key = value pairs.
    Requires features manages_solaris_rbac.

- **managehome**
    Whether to manage the home directory when managing the user.
    This will create the home directory when `ensure => present`, and
    delete the home directory when `ensure => absent`. Defaults to `false`.
    Valid values are `true`, `false`, `yes`, `no`. 

- **membership**
    Whether specified groups should be considered the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of groups to which
    the user belongs. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **name**
    The user name. While naming limitations vary by operating system,
    it is advisable to restrict names to the lowest common denominator,
    which is a maximum of 8 characters beginning with a letter.
    Note that Puppet considers user names to be case-sensitive, regardless
    of the platform's own rules; be sure to always use the same case when
    referring to a given user.

- **password**
    The user's password, in whatever encrypted format the local
    system requires.
    * Most modern Unix-like systems use salted SHA1 password hashes. You can
    use
      Puppet's built-in `sha1` function to generate a hash from a password.
    * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
    * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs
    [stdlib][]
      module contains a `str2saltedsha512` function which can generate
    password
      hashes for Lion.
    * Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
      managing passwords on these systems the salt and iterations properties
      need to be specified as well as the password.
    * Windows passwords can only be managed in cleartext, as there is no
    Windows API
      for setting the password hash.
    [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
    Be sure to enclose any value that includes a dollar sign ($) in single
    quotes (') to avoid accidental variable interpolation.
    Requires features manages_passwords.

- **password_max_age**
    The maximum number of days a password may be used before it must be
    changed.
Requires features manages_password_age.

- **password_min_age**
    The minimum number of days a password must be used before it may be
    changed.
Requires features manages_password_age.

- **profile_membership**
    Whether specified roles should be treated as the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of roles
    of which the user is a member. Defaults to `minimum`.
    Valid values are `inclusive`, `minimum`. 

- **profiles**
    The profiles the user has.  Multiple profiles should be
    specified as an array.
Requires features manages_solaris_rbac.

- **project**
    The name of the project associated with a user.
    Requires features manages_solaris_rbac.

- **purge_ssh_keys**
    Purge ssh keys authorized for the user
    if they are not managed via ssh_authorized_keys. When true,
    looks for keys in .ssh/authorized_keys in the user's home
    directory. Possible values are true, false, or an array of
    paths to file to search for authorized keys. If a path starts
    with ~ or %h, this token is replaced with the user's home directory.
    Valid values are `true`, `false`. 

- **role_membership**
    Whether specified roles should be considered the **complete list**
    (`inclusive`) or the **minimum list** (`minimum`) of roles the user
    has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`. 

- **roles**
    The roles the user has.  Multiple roles should be
    specified as an array.
Requires features manages_solaris_rbac.

- **salt**
    This is the 32 byte salt used to generate the PBKDF2 password used in
    OS X. This field is required for managing passwords on OS X >= 10.8.
    Requires features manages_password_salt.

- **shell**
    The user's login shell.  The shell must exist and be
    executable.
    This attribute cannot be managed on Windows systems.
    Requires features manages_shell.

- **system**
    Whether the user is a system user, according to the OS's criteria;
    on most platforms, a UID less than or equal to 500 indicates a system
    user. Defaults to `false`.
    Valid values are `true`, `false`, `yes`, `no`. 

- **uid**
    The user ID; must be specified numerically. If no user ID is
    specified when creating a new user, then one will be chosen
    automatically. This will likely result in the same user having
    different UIDs on different systems, which is not recommended. This is
    especially noteworthy when managing the same user on both Darwin and
    other platforms, since Puppet does UID generation on Darwin, but
    the underlying tools do so on other platforms.
    On Windows, this property is read-only and will return the user's
    security identifier (SID).

Providers
---------
    aix, directoryservice, hpuxuseradd, ldap, pw, user_role_add, useradd,
    windows_adsi
[root@node12 ~]# 

　　提示：以上從以上幫助資訊可以看到，我們定義在目標主機上建立使用者可以使用user這個資源型別，其中對應有很多屬性，這些屬性主要用來描述對應資源該有的屬性，比如uid用來描述使用者的id，gid用於描述組id；

　　定義資源清單語法

type {'title':
    attribute1 	=> value1,
    atrribute2	=> value2,
    ……
}

　　提示：type指資源型別，type必須使用小寫字元；title是一個字串，在同一型別中必須惟一；

　　資源屬性中的三個特殊屬性：

　　　　Namevar， 可簡稱為name；
　　　　ensure：資源的目標狀態；
　　　　Provider：指明資源的管理介面；

　　示例：定義manifest，建立使用者

[root@node12 ~]# cat user.pp
user{'tom':
        ensure  => present,
        uid     => 5000,
        home    => '/home/tom',
        shell   => '/bin/bash',
        comment => 'this is test user',
}
[root@node12 ~]#

　　提示：上述資源清單中，沒有用name指定對應資源型別的名稱，如果沒有指定預設使用title的值作為其資源型別的名稱；資源清單使用.pp為字尾，意思就是puppet的簡寫；

　　應用資源清單

[root@node12 ~]# puppet apply -v --noop user.pp
Notice: Compiled catalog for node12.test.org in environment production in 0.07 seconds
Info: Applying configuration version '1606542594'
Notice: /Stage[main]/Main/User[tom]/ensure: current_value absent, should be present (noop)
Notice: Class[Main]: Would have triggered 'refresh' from 1 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Info: Creating state file /var/lib/puppet/state/state.yaml
Notice: Finished catalog run in 0.02 seconds
[root@node12 ~]# 

　　提示：應用資源清單使用puppet apply命令，其中-v用於指定顯示執行輸出過程；--noop用於指定幹跑，不應用，主要檢測對應的manifast檔案是否有語法錯誤；如果沒有語法錯誤，我們就可以把對應noop選項取消，然後真正應用其資源清單到本地；

[root@node12 ~]# puppet apply -v  user.pp      
Notice: Compiled catalog for node12.test.org in environment production in 0.06 seconds
Info: Applying configuration version '1606542785'
Notice: /Stage[main]/Main/User[tom]/ensure: created
Notice: Finished catalog run in 0.05 seconds
[root@node12 ~]#

　　驗證：檢視tom使用者是否建立呢？

[root@node12 ~]# getent passwd tom
tom:x:5000:5000:this is test user:/home/tom:/bin/bash
[root@node12 ~]# 

　　提示：可以看到對應tom使用者已經建立成功，並且uid，註釋資訊和家目錄，shell等資訊都是我們指定的內容；

　　示例：刪除tom使用者

[root@node12 ~]# cat user.pp
user{'tom':
        ensure  => absent,
        uid     => 5000,
        home    => '/home/tom',
        shell   => '/bin/bash',
        comment => 'this is test user',
}
[root@node12 ~]#

　　提示：ensure這個屬性主要指定對應資源型別在目標主機上的狀態，absent表示缺席之意，如果對應主機上有tom使用者就刪除；

　　驗證：應用資源清單，看看tom使用者是否被刪除？

[root@node12 ~]# puppet apply -v user.pp
Notice: Compiled catalog for node12.test.org in environment production in 0.25 seconds
Info: Applying configuration version '1606574872'
Notice: /Stage[main]/Main/User[tom]/ensure: removed
Notice: Finished catalog run in 0.11 seconds
[root@node12 ~]# getent passwd tom      
[root@node12 ~]# id tom
id: tom: no such user
[root@node12 ~]# 

　　提示：可以看到應用了資源清單以後，本機的tom使用者就被刪除了；

　　以上就是puppet的基礎使用方式，在使用puppet我們最核心的就是要寫manifest（資源清單），就是我們要讓某資源處於什麼狀態，就用puppet的配置語言描述，然後使用puppet apply命令應用對應的資源清單即