摘要：
1、 什么是木偶？
一、简介
puppet是什么？它能做什么？
puppet是一个IT基础设施自动化运维工具，它能够帮助系统管理员管理基础设施的整个生命周期；比如，安装服务，提供配置文件，启动服务等等一系列操作；基于puppet，可实现自动化重复任务、快速部署关键性应用以及在本地或云端完成主动变更和快速扩展架构规模等；它遵循GPL协议（2.7.0以前），基于ruby语言开发，2.7.0以后使用apache 2.0协议；
puppet架构
提示：puppet是master/agent架构，master和agent使用https通信；puppet有两种工作方式，第一种是standalone模式，这种方式通常运行在单机之上；另一种则是master/agent模式，这种模式master和agent运行在不同的服务器之上；
puppet工作流程
提示：puppet工作流程分4个步骤，第一个步骤是定义manifast，这个步骤由管理员完成，主要通过过puppet的声明性配置语言定义基础设施配置的目标状态；第二个步骤是模拟，所谓模拟就是把我们定义的manifest，在目标主机上试着运行一遍，但不真正的应用（不改变目标主机的状态）；这一步主要用来检查我们定义的manifest是否有语法错误等等；第三步是强制，所谓强制就是把目标主机状态强制改变为我们在manifest中定义的状态；最后一步就是报告，报告就是指我们当前目标主机的状态和manifest中定义的状态的不同，以及达成目标状态所进行的改变信息；
puppet standalone模式工作过程
提示：在单机模式下，puppet的执行过程如上图；首先puppet会把我们写的manifest文件进行编译，编译成为代码这个为代码有点类似java中的字节码；然后puppet把编译的结果应用到对应的目标主机上；在应用之前它首先要对比目标主机当前状态和我们定义的目标状态是否一样，如果一样则跳过不更改其状态，如果不一样则强制让目标主机当前状态和我们定义的目标状态一样，最后将执行的过程报告给管理员；这里值得注意的是，在单机模型下，puppet应用manifest时，是我们人工手动指定来应用；
puppet master/agent模式工作过程
提示：master/agent模型，总的流程和单机模型类似，都是先编译然后再到应用；不同的是master/agent模型管理员可以不用手动应用manifest，默认情况下agent会每隔30分钟就到master拉取和自己相关的配置，如果对应master端有和自己相关的新配置，它会将其拉取到本地，然后强制执行，也就是说每隔30分钟各个agent会来master同步配置，如果对应目标主机当前状态和我们定义的目标状态不一样，最迟30分钟会自动修复；
二、puppet单机模型的安装和使用
安装puppet
[root@node12 ~]# yum install -y puppet
提示：单机模型我们只需要安装puppet即可；这个包来源epel仓库，安装之前，请确保epel仓库配置正常；另外在epel仓库中这个包的版本稍微有点低，如果要使用最新版本可以到https://yum.puppet.com这个仓库中下载对应版本的包进行安装即可；
puppet的基础使用
查看puppet工具帮助
[root@node12 ~]# puppet help
Usage: puppet <subcommand> [options] <action> [options]
Available subcommands:
agent The puppet agent daemon
apply Apply Puppet manifests locally
ca Local Puppet Certificate Authority management.
catalog Compile, save, view, and convert catalogs.
cert Manage certificates and requests
certificate Provide access to the CA for certificate management.
certificate_request Manage certificate requests.
certificate_revocation_list Manage the list of revoked certificates.
config Interact with Puppet's settings.
describe Display help about resource types
device Manage remote network devices
doc Generate Puppet documentation and references
facts Retrieve and store facts.
file Retrieve and store files in a filebucket
filebucket Store and retrieve files in a filebucket
help Display Puppet help.
inspect Send an inspection report
instrumentation_data Manage instrumentation listener accumulated data.
instrumentation_listener Manage instrumentation listeners.
instrumentation_probe Manage instrumentation probes.
key Create, save, and remove certificate keys.
kick Remotely control puppet agent
man Display Puppet manual pages.
master The puppet master daemon
module Creates, installs and searches for modules on the Puppet Forge.
node View and manage node definitions.
parser Interact directly with the parser.
plugin Interact with the Puppet plugin system.
queue Deprecated queuing daemon for asynchronous storeconfigs
report Create, display, and submit reports.
resource The resource abstraction layer shell
resource_type View classes, defined resource types, and nodes from all manifests.
secret_agent Mimics puppet agent.
status View puppet server status.
See 'puppet help <subcommand> <action>' for help on a specific subcommand action.
See 'puppet help <subcommand>' for help on a specific subcommand.
Puppet v3.6.2
[root@node12 ~]#
提示：puppet这个工具有很多子命令，对应不同的子命令有不同的选项，同时对应不同的子命令有着不同的操作命令，不同操作命令对应不同的选项；
查询对应子命令的帮助
查看describe子命令的帮助说明
[root@node12 ~]# puppet describe --help
puppet-describe(8) -- Display help about resource types
========
SYNOPSIS
--------
Prints help about Puppet resource types, providers, and metaparameters.
USAGE
-----
puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta]
OPTIONS
-------
* --help:
Print this help text
* --providers:
Describe providers in detail for each type
* --list:
List all types
* --meta:
List all metaparameters
* --short:
List only parameters without detail
EXAMPLE
-------
$ puppet describe --list
$ puppet describe file --providers
$ puppet describe user -s -m
AUTHOR
------
David Lutterkort
COPYRIGHT
---------
Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
[root@node12 ~]#
提示：describe这个子命令主要用来显示资源类型的帮助信息；在puppet中所谓资源指我们能够操作目标主机的对象，比如创建用户，那么这个用户资源就是我们操作的对象，创建用户组，对应组就是我们操作的对象；
查看puppet支持的资源类型列表
[root@node12 ~]# puppet describe --list These are the types known to puppet: augeas - Apply a change or an array of changes to the ... computer - Computer object management using DirectorySer ... cron - Installs and manages cron jobs exec - Executes external commands file - Manages files, including their content, owner ... filebucket - A repository for storing and retrieving file ... group - Manage groups host - Installs and manages host entries interface - This represents a router or switch interface k5login - Manage the `.k5login` file for a user macauthorization - Manage the Mac OS X authorization database mailalias - .. no documentation .. maillist - Manage email lists mcx - MCX object management using DirectoryService ... mount - Manages mounted filesystems, including puttin ... nagios_command - The Nagios type command nagios_contact - The Nagios type contact nagios_contactgroup - The Nagios type contactgroup nagios_host - The Nagios type host nagios_hostdependency - The Nagios type hostdependency nagios_hostescalation - The Nagios type hostescalation nagios_hostextinfo - The Nagios type hostextinfo nagios_hostgroup - The Nagios type hostgroup nagios_service - The Nagios type service nagios_servicedependency - The Nagios type servicedependency nagios_serviceescalation - The Nagios type serviceescalation nagios_serviceextinfo - The Nagios type serviceextinfo nagios_servicegroup - The Nagios type servicegroup nagios_timeperiod - The Nagios type timeperiod notify - .. no documentation .. package - Manage packages resources - This is a metatype that can manage other reso ... router - .. no documentation .. schedule - Define schedules for Puppet scheduled_task - Installs and manages Windows Scheduled Tasks selboolean - Manages SELinux booleans on systems with SELi ... selmodule - Manages loading and unloading of SELinux poli ... service - Manage running services ssh_authorized_key - Manages SSH authorized keys sshkey - Installs and manages ssh host keys stage - A resource type for creating new run stages tidy - Remove unwanted files based on specific crite ... user - Manage users vlan - .. no documentation .. whit - Whits are internal artifacts of Puppet's curr ... yumrepo - The client-side description of a yum reposito ... zfs - Manage zfs zone - Manages Solaris zones zpool - Manage zpools [root@node12 ~]#
查看对应资源类型的使用帮助
查看user资源类型的帮助
[root@node12 ~]# puppet describe user
user
====
Manage users. This type is mostly built to manage system
users, so it is lacking some features useful for managing normal
users.
This resource type uses the prescribed native tools for creating
groups and generally uses POSIX APIs for retrieving information
about them. It does not directly modify `/etc/passwd` or anything.
**Autorequires:** If Puppet is managing the user's primary group (as
provided in the `gid` attribute), the user resource will autorequire
that group. If Puppet is managing any role accounts corresponding to the
user's roles, the user resource will autorequire those role accounts.
Parameters
----------
- **allowdupe**
Whether to allow duplicate UIDs. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **attribute_membership**
Whether specified attribute value pairs should be treated as the
**complete list** (`inclusive`) or the **minimum list** (`minimum`) of
attribute/value pairs for the user. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **attributes**
Specify AIX attributes for the user in an array of attribute = value
pairs.
Requires features manages_aix_lam.
- **auth_membership**
Whether specified auths should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of auths the user
has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **auths**
The auths the user has. Multiple auths should be
specified as an array.
Requires features manages_solaris_rbac.
- **comment**
A description of the user. Generally the user's full name.
- **ensure**
The basic state that the object should be in.
Valid values are `present`, `absent`, `role`.
- **expiry**
The expiry date for this user. Must be provided in
a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
If you want to make sure the user account does never
expire, you can pass the special value `absent`.
Valid values are `absent`. Values can match `/^d{4}-d{2}-d{2}$/`.
Requires features manages_expiry.
- **forcelocal**
Forces the mangement of local accounts when accounts are also
being managed by some other NSS
Valid values are `true`, `false`, `yes`, `no`.
Requires features libuser.
- **gid**
The user's primary group. Can be specified numerically or by name.
This attribute is not supported on Windows systems; use the `groups`
attribute instead. (On Windows, designating a primary group is only
meaningful for domain accounts, which Puppet does not currently manage.)
- **groups**
The groups to which the user belongs. The primary group should
not be listed, and groups should be identified by name rather than by
GID. Multiple groups should be specified as an array.
- **home**
The home directory of the user. The directory must be created
separately and is not currently checked for existence.
- **ia_load_module**
The name of the I&A module to use to manage this user.
Requires features manages_aix_lam.
- **iterations**
This is the number of iterations of a chained computation of the
password hash (http://en.wikipedia.org/wiki/PBKDF2). This parameter
is used in OS X. This field is required for managing passwords on OS X
>= 10.8.
Requires features manages_password_salt.
- **key_membership**
Whether specified key/value pairs should be considered the
**complete list** (`inclusive`) or the **minimum list** (`minimum`) of
the user's attributes. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **keys**
Specify user attributes in an array of key = value pairs.
Requires features manages_solaris_rbac.
- **managehome**
Whether to manage the home directory when managing the user.
This will create the home directory when `ensure => present`, and
delete the home directory when `ensure => absent`. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **membership**
Whether specified groups should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of groups to which
the user belongs. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **name**
The user name. While naming limitations vary by operating system,
it is advisable to restrict names to the lowest common denominator,
which is a maximum of 8 characters beginning with a letter.
Note that Puppet considers user names to be case-sensitive, regardless
of the platform's own rules; be sure to always use the same case when
referring to a given user.
- **password**
The user's password, in whatever encrypted format the local
system requires.
* Most modern Unix-like systems use salted SHA1 password hashes. You can
use
Puppet's built-in `sha1` function to generate a hash from a password.
* Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
* Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs
[stdlib][]
module contains a `str2saltedsha512` function which can generate
password
hashes for Lion.
* Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
managing passwords on these systems the salt and iterations properties
need to be specified as well as the password.
* Windows passwords can only be managed in cleartext, as there is no
Windows API
for setting the password hash.
[stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
Be sure to enclose any value that includes a dollar sign ($) in single
quotes (') to avoid accidental variable interpolation.
Requires features manages_passwords.
- **password_max_age**
The maximum number of days a password may be used before it must be
changed.
Requires features manages_password_age.
- **password_min_age**
The minimum number of days a password must be used before it may be
changed.
Requires features manages_password_age.
- **profile_membership**
Whether specified roles should be treated as the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of roles
of which the user is a member. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **profiles**
The profiles the user has. Multiple profiles should be
specified as an array.
Requires features manages_solaris_rbac.
- **project**
The name of the project associated with a user.
Requires features manages_solaris_rbac.
- **purge_ssh_keys**
Purge ssh keys authorized for the user
if they are not managed via ssh_authorized_keys. When true,
looks for keys in .ssh/authorized_keys in the user's home
directory. Possible values are true, false, or an array of
paths to file to search for authorized keys. If a path starts
with ~ or %h, this token is replaced with the user's home directory.
Valid values are `true`, `false`.
- **role_membership**
Whether specified roles should be considered the **complete list**
(`inclusive`) or the **minimum list** (`minimum`) of roles the user
has. Defaults to `minimum`.
Valid values are `inclusive`, `minimum`.
- **roles**
The roles the user has. Multiple roles should be
specified as an array.
Requires features manages_solaris_rbac.
- **salt**
This is the 32 byte salt used to generate the PBKDF2 password used in
OS X. This field is required for managing passwords on OS X >= 10.8.
Requires features manages_password_salt.
- **shell**
The user's login shell. The shell must exist and be
executable.
This attribute cannot be managed on Windows systems.
Requires features manages_shell.
- **system**
Whether the user is a system user, according to the OS's criteria;
on most platforms, a UID less than or equal to 500 indicates a system
user. Defaults to `false`.
Valid values are `true`, `false`, `yes`, `no`.
- **uid**
The user ID; must be specified numerically. If no user ID is
specified when creating a new user, then one will be chosen
automatically. This will likely result in the same user having
different UIDs on different systems, which is not recommended. This is
especially noteworthy when managing the same user on both Darwin and
other platforms, since Puppet does UID generation on Darwin, but
the underlying tools do so on other platforms.
On Windows, this property is read-only and will return the user's
security identifier (SID).
Providers
---------
aix, directoryservice, hpuxuseradd, ldap, pw, user_role_add, useradd,
windows_adsi
[root@node12 ~]#
提示：以上从以上帮助信息可以看到，我们定义在目标主机上创建用户可以使用user这个资源类型，其中对应有很多属性，这些属性主要用来描述对应资源该有的属性，比如uid用来描述用户的id，gid用于描述组id；
定义资源清单语法
type {'title':
attribute1 => value1,
atrribute2 => value2,
……
}
提示：type指资源类型，type必须使用小写字符；title是一个字符串，在同一类型中必须惟一；
资源属性中的三个特殊属性：
Namevar， 可简称为name；
ensure：资源的目标状态；
Provider：指明资源的管理接口；
示例：定义manifest，创建用户
[root@node12 ~]# cat user.pp
user{'tom':
ensure => present,
uid => 5000,
home => '/home/tom',
shell => '/bin/bash',
comment => 'this is test user',
}
[root@node12 ~]#
提示：上述资源清单中，没有用name指定对应资源类型的名称，如果没有指定默认使用title的值作为其资源类型的名称；资源清单使用.pp为后缀，意思就是puppet的简写；
应用资源清单
[root@node12 ~]# puppet apply -v --noop user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.07 seconds Info: Applying configuration version '1606542594' Notice: /Stage[main]/Main/User[tom]/ensure: current_value absent, should be present (noop) Notice: Class[Main]: Would have triggered 'refresh' from 1 events Notice: Stage[main]: Would have triggered 'refresh' from 1 events Info: Creating state file /var/lib/puppet/state/state.yaml Notice: Finished catalog run in 0.02 seconds [root@node12 ~]#
提示：应用资源清单使用puppet apply命令，其中-v用于指定显示执行输出过程；--noop用于指定干跑，不应用，主要检测对应的manifast文件是否有语法错误；如果没有语法错误，我们就可以把对应noop选项取消，然后真正应用其资源清单到本地；
[root@node12 ~]# puppet apply -v user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.06 seconds Info: Applying configuration version '1606542785' Notice: /Stage[main]/Main/User[tom]/ensure: created Notice: Finished catalog run in 0.05 seconds [root@node12 ~]#
验证：查看tom用户是否创建呢？
[root@node12 ~]# getent passwd tom tom:x:5000:5000:this is test user:/home/tom:/bin/bash [root@node12 ~]#
提示：可以看到对应tom用户已经创建成功，并且uid，注释信息和家目录，shell等信息都是我们指定的内容；
示例：删除tom用户
[root@node12 ~]# cat user.pp
user{'tom':
ensure => absent,
uid => 5000,
home => '/home/tom',
shell => '/bin/bash',
comment => 'this is test user',
}
[root@node12 ~]#
提示：ensure这个属性主要指定对应资源类型在目标主机上的状态，absent表示缺席之意，如果对应主机上有tom用户就删除；
验证：应用资源清单，看看tom用户是否被删除？
[root@node12 ~]# puppet apply -v user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.25 seconds Info: Applying configuration version '1606574872' Notice: /Stage[main]/Main/User[tom]/ensure: removed Notice: Finished catalog run in 0.11 seconds [root@node12 ~]# getent passwd tom [root@node12 ~]# id tom id: tom: no such user [root@node12 ~]#
提示：可以看到应用了资源清单以后，本机的tom用户就被删除了；
以上就是puppet的基础使用方式，在使用puppet我们最核心的就是要写manifest（资源清单），就是我们要让某资源处于什么状态，就用puppet的配置语言描述，然后使用puppet apply命令应用对应的资源清单即可；