(1)puppet安装
简介：
基于C/S架构的Puppet更新方式一般有两种，一种是Agent端设置同步时间主动去PuppetMaster端拉取配置，另一种是通过PuppetMaster端使用puppet kick命令或者借助mcollctive触发更新配置，两种方式适应不同的生产环境，各具特色。
安装说明：
系统：centos6.7
版本：puppet3.8
服务端 puppet-master 172.16.0.112
客户端 puppet-agent 172.16.0.114
1.两台机器都设置一下主机名，机器很多的话配dns服务器比较好
[root@puppet-master ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.16.0.112 puppet-master
172.16.0.114 puppet-agent两台机器互ping验证一下dns
[root@puppet-master ~]# ping puppet-agent
PING puppet-agent (172.16.0.114) 56(84) bytes of data.
64 bytes from puppet-agent (172.16.0.114): icmp_seq=1 ttl=64 time=1.25 ms
64 bytes from puppet-agent (172.16.0.114): icmp_seq=2 ttl=64 time=0.285 ms
64 bytes from puppet-agent (172.16.0.114): icmp_seq=3 ttl=64 time=0.289 ms 2、安装官方yum仓库
[root@puppet-master ~]# rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-el-6.noarch.rpm3、安装服务端puppet（注意中间有“-”）
[root@puppet-master ~]# yum install puppet-server
[root@puppet-master ~]# puppet master --version
3.8.7
[root@puppet-master ~]# chkconfig puppetmaster on
[root@puppet-master ~]# chkconfig --list puppetmaster
puppetmaster 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@puppet-master ~]# service puppetmaster start
Starting puppetmaster: [ OK ]
[root@puppet-master ~]# netstat -tupln #运行在8140端口
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8140 0.0.0.0:* LISTEN 2581/ruby
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2204/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 2046/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2329/master
tcp 0 0 :::22 :::* LISTEN 2204/sshd
tcp 0 0 ::1:631 :::* LISTEN 2046/cupsd
tcp 0 0 ::1:25 :::* LISTEN 2329/master
udp 0 0 0.0.0.0:631 0.0.0.0:* 2046/cupsd
4、安装客户端 puppet
[root@puppet-agent ~]# yum install puppet
[root@puppet-agent ~]# chkconfig puppet on
[root@puppet-agent ~]# chkconfig --list puppet
puppet 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@puppet-agent ~]# vim /etc/puppet/puppet.conf
#[agent]末尾添加如下一句，agent启动时会自动向master请求证书认证
server=puppet-master
[root@puppet-agent ~]# service puppet start
Starting puppet agent: [ OK ]5、证书认证
5a.服务端查看证书，如果是已经签发的证书，会在本行最前面带一个”+”
前面没有“+”表示正在请求认证
[root@puppet-master ~]# puppet cert list --all
"puppet-agent" (SHA256) 74:F3:C0:00:FF:8A:70:1D:64:69:CA:70:72:D9:A1:65:F8:34:18:89:F5:F2:94:9E:F3:ED:14:F0:1E:70:17:27
+ "puppet-master.puppet-master" (SHA256) 79:B9:47:A2:67:00:F2:DE:7C:48:A6:12:45:3C:CD:37:53:B6:69:87:89:CF:44:5E:07:26:88:4B:AD:1A:21:4B (alt names: "DNS:puppet", "DNS:puppet-master.puppet-master", "DNS:puppet.puppet-master")这个时候,服务端已经自动把本机当成客户端,管理起来,证书已经自动签发。但是客户端的证书还没有签发。
5b.服务端签发证书认证
[root@puppet-master ~]# puppet cert --sign puppet-agent5c.一次性签发所有证书
[root@puppet-master ~]# puppet cert --sign --all5d.再次查看
[root@puppet-master ~]# puppet cert list --all
+ "puppet-agent" (SHA256) A6:2E:62:1F:1B:AF:E3:55:E1:EA:A9:69:37:01:83:4B:F2:8D:AF:00:6C:7F:38:71:65:20:95:26:7B:FD:74:B9
+ "puppet-master.puppet-master" (SHA256) 79:B9:47:A2:67:00:F2:DE:7C:48:A6:12:45:3C:CD:37:53:B6:69:87:89:CF:44:5E:07:26:88:4B:AD:1A:21:4B (alt names: "DNS:puppet", "DNS:puppet-master.puppet-master", "DNS:puppet.puppet-master")5e.已签发证书的目录
[root@puppet-master ~]# ls /var/lib/puppet/ssl/ca/signed/
puppet-master.puppet-master.pem
6、调试：
验证配置是否有误，一般来说通过查看日志文件 /var/log/puppet，也可手动执行
[root@puppet-agent ssl]# puppet agent -t加上debug 选项会显示 Puppet 本次运行时的差不多每一个步骤，这在调试非常复杂的问题时很有用。
[root@puppet-agent ssl]# puppet agent -t --debug到此为止 puppet 客户端和服务端都可以正常工作了。但是，现在 puppet master 没有任何要客户端做的事。
7、写个pp文件验证一下
[root@puppet-master manifests]# vim /etc/puppet/manifests/test.pp
file{"/tmp/123.txt":
content => aaaaababbau,
ensure => present
}
[root@puppet-master manifests]# service puppetmaster restart
[root@puppet-agent ~]# puppet agent -t #强制客户端立即生效
[root@puppet-agent ~]# cat /tmp/123.txt
aaaaababbau8、配置生效方式：
主机节点定时更新：24小时后更新（时间可以自己设置）
主动触发更新，有两种：
server端push更新： puppet kick hostname
client端pull更新： puppet agent -t
参考链接：
https://docs.puppet.com/puppet/3.8/install_el.html
http://www.cnblogs.com/taosim/articles/3336986.html
http://kisspuppet.com/2014/03/08/puppet_learning_base4/
https://linux.cn/article-3959-1.html
