自动化运维工具puppet详解（一）

[root@localhost ~]# yum install -y puppet

[root@localhost ~]# rpm -ql puppet | less
/etc/NetworkManager
/etc/NetworkManager/dispatcher.d
/etc/NetworkManager/dispatcher.d/98-puppet
/etc/logrotate.d/puppet
/etc/puppet
/etc/puppet/auth.conf
/etc/puppet/modules
/etc/puppet/puppet.conf
/usr/bin/extlookup2hiera
/usr/bin/puppet
/usr/bin/start-puppet-agent
/usr/bin/start-puppet-ca
/usr/bin/start-puppet-master
/usr/lib/systemd/system/puppet.service
/usr/lib/systemd/system/puppetagent.service
/usr/share/doc/puppet-3.6.2
/usr/share/doc/puppet-3.6.2/LICENSE
/usr/share/doc/puppet-3.6.2/README.md
/usr/share/doc/puppet-3.6.2/examples
/usr/share/doc/puppet-3.6.2/examples/hiera
/usr/share/doc/puppet-3.6.2/examples/hiera/README.md
/usr/share/doc/puppet-3.6.2/examples/hiera/etc
/usr/share/doc/puppet-3.6.2/examples/hiera/etc/hiera.yaml
/usr/share/doc/puppet-3.6.2/examples/hiera/etc/hieradb
/usr/share/doc/puppet-3.6.2/examples/hiera/etc/hieradb/common.yaml
/usr/share/doc/puppet-3.6.2/examples/hiera/etc/hieradb/dc1.yaml
/usr/share/doc/puppet-3.6.2/examples/hiera/etc/hieradb/development.yaml
/usr/share/doc/puppet-3.6.2/examples/hiera/etc/puppet.conf
/usr/share/doc/puppet-3.6.2/examples/hiera/modules
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/data
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/data/manifests
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/data/manifests/common.pp
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/ntp
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/ntp/manifests
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/ntp/manifests/config.pp
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/ntp/manifests/data.pp
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/ntp/templates
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/ntp/templates/ntp.conf.erb
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/users
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/users/manifests
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/users/manifests/common.pp
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/users/manifests/dc1.pp
/usr/share/doc/puppet-3.6.2/examples/hiera/modules/users/manifests/development.pp
[root@localhost ~]# 

Namevar：可简称为name；
ensure：资源的目标状态；
Provider：指明资源的管理接口；

[root@localhost ~]# puppet describe group -s -m

group
=====
Manage groups. On most platforms this can only create groups.
Group membership must be managed on individual users.
On some platforms such as OS X, group membership is managed as an
attribute of the group, not the user record. Providers must have
the feature ‘manages_members‘ to manage the ‘members‘ property of
a group record.


Parameters
----------
    allowdupe, attribute_membership, attributes, auth_membership, ensure,
    forcelocal, gid, ia_load_module, members, name, system

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

Providers
---------
    aix, directoryservice, groupadd, ldap, pw, windows_adsi

属性：
    name：组名，可以省略，如果省略，将继承title的值；
    gid：GID；
    system：是否为系统组，true OR false；
    ensure：目标状态，present/absent；
    members：成员用户;

[root@localhost puppet]# mkdir ppp
[root@localhost puppet]# cd ppp/
[root@localhost ppp]# vi test.pp

group{‘liujunjun‘:
        gid     => 2000,
        ensure  => present,
}
user{‘liujunjun‘:
        uid     => 2000,
        gid     => 2000,
        shell   => ‘/bin/bash‘,
        home    => ‘/home/liujunjun‘,
        ensure  => present,
}

[root@localhost ppp]# puppet apply -v --noop test.pp　　试动行。
[root@localhost ppp]# puppet apply -v test.pp 
Notice: Compiled catalog for localhost in environment production in 0.27 seconds
Info: Applying configuration version ‘1579249129‘
Notice: /Stage[main]/Main/Group[liujunjun]/ensure: created
Notice: /Stage[main]/Main/User[liujunjun]/ensure: created
Info: Creating state file /var/lib/puppet/state/state.yaml
Notice: Finished catalog run in 0.13 seconds

[root@localhost ppp]# tail -1 /etc/group
liujunjun:x:2000:

[root@localhost ppp]# puppet describe user -m -s

user
====
Manage users.  This type is mostly built to manage system
users, so it is lacking some features useful for managing normal
users.
This resource type uses the prescribed native tools for creating
groups and generally uses POSIX APIs for retrieving information
about them.  It does not directly modify `/etc/passwd` or anything.
**Autorequires:** If Puppet is managing the user‘s primary group (as
provided in the `gid` attribute), the user resource will autorequire
that group. If Puppet is managing any role accounts corresponding to the
user‘s roles, the user resource will autorequire those role accounts.


Parameters
----------
    allowdupe, attribute_membership, attributes, auth_membership, auths,
    comment, ensure, expiry, forcelocal, gid, groups, home, ia_load_module,
    iterations, key_membership, keys, managehome, membership, name,
    password, password_max_age, password_min_age, profile_membership,
    profiles, project, purge_ssh_keys, role_membership, roles, salt, shell,
    system, uid

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

Providers
---------
    aix, directoryservice, hpuxuseradd, ldap, pw, user_role_add, useradd,
    windows_adsi

属性：
    name：用户名，可以省略，如果省略，将继承title的值；
    uid: UID;
    gid：基本组ID；
    groups：附加组，不能包含基本组；
    comment：注释； 
    expiry：过期时间 ；
    home：用户的家目录； 
    shell：默认shell类型；
    system：是否为系统用户 ；
    ensure：present/absent；
    password：加密后的密码串； 

[root@localhost ppp]# cat test2.pp 
user{‘keerr0‘:
        ensure => present,
        system => false,　　　　　　　　#是否为系统用户。
        comment => ‘Test User‘,　　　　#注释
        shell => ‘/bin/bash‘,　　　　　　#默认shell类型
        home => ‘/home/keerr0‘,　　　　　#用户的家目录。
        managehome => true,
        groups => ‘liujunjun‘,
        uid => 3000,
        }

[root@localhost ppp]# puppet apply -v test2.pp
Notice: Compiled catalog for localhost in environment production in 0.17 seconds
Info: Applying configuration version ‘1579250211‘
Notice: /Stage[main]/Main/User[keerr0]/ensure: created
Notice: Finished catalog run in 0.12 seconds

[root@localhost ppp]# puppet describe package -m -s

package
=======
Manage packages.  There is a basic dichotomy in package
support right now:  Some package types (e.g., yum and apt) can
retrieve their own package files, while others (e.g., rpm and sun)
cannot.  For those package formats that cannot retrieve their own files,
you can use the `source` parameter to point to the correct file.
Puppet will automatically guess the packaging format that you are
using based on the platform you are on, but you can override it
using the `provider` parameter; each provider defines what it
requires in order to function, and you must meet those requirements
to use a given provider.
**Autorequires:** If Puppet is managing the files specified as a
package‘s `adminfile`, `responsefile`, or `source`, the package
resource will autorequire those files.


Parameters
----------
    adminfile, allow_virtual, allowcdrom, category, configfiles,
    description, ensure, flavor, install_options, instance, name,
    package_settings, platform, responsefile, root, source, status,
    uninstall_options, vendor

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

Providers
---------
    aix, appdmg, apple, apt, aptitude, aptrpm, blastwave, dpkg, fink,
    freebsd, gem, hpux, macports, msi, nim, openbsd, opkg, pacman, pip, pkg,
    pkgdmg, pkgin, pkgutil, portage, ports, portupgrade, rpm, rug, sun,
    sunfreeware, up2date, urpmi, windows, yum, zypper

属性：
    ensure：installed, present, latest, absent, any version string (implies present)
    name：包名，可以省略，如果省略，将继承title的值；
    source：程序包来源，仅对不会自动下载相关程序包的provider有用，例如rpm或dpkg；
    provider:指明安装方式；

[root@localhost ppp]# vi package.pp

package{ ‘zip‘:
                ensure  => installed,
        provider    =>  yum
        }
~
[root@localhost ppp]# puppet apply -v package.pp
Notice: Compiled catalog for localhost in environment production in 0.76 seconds
Warning: The package type‘s allow_virtual parameter will be changing its default value from false to true in a future release. If you do not want to allow virtual packages, please explicitly set allow_virtual to false.
   (at /usr/share/ruby/vendor_ruby/puppet/type.rb:816:in `set_default‘)
Info: Applying configuration version ‘1579250994‘
Notice: Finished catalog run in 0.21 seconds

[root@localhost ppp]# puppet describe service -s -m

service
=======
Manage running services.  Service support unfortunately varies
widely by platform --- some platforms have very little if any concept of a
running service, and some have a very codified and powerful concept.
Puppet‘s service support is usually capable of doing the right thing, but
the more information you can provide, the better behaviour you will get.
Puppet 2.7 and newer expect init scripts to have a working status command.
If this isn‘t the case for any of your services‘ init scripts, you will
need to set `hasstatus` to false and possibly specify a custom status
command in the `status` attribute. As a last resort, Puppet will attempt to
search the process table by calling whatever command is listed in the `ps`
fact. The default search pattern is the name of the service, but you can
specify it with the `pattern` attribute.
**Refresh:** `service` resources can respond to refresh events (via
`notify`, `subscribe`, or the `~>` arrow). If a `service` receives an
event from another resource, Puppet will restart the service it manages.
The actual command used to restart the service depends on the platform and
can be configured:
* If you set `hasrestart` to true, Puppet will use the init script‘s restart
command.
* You can provide an explicit command for restarting with the `restart`
attribute.
* If you do neither, the service‘s stop and start commands will be used.


Parameters
----------
    binary, control, enable, ensure, flags, hasrestart, hasstatus, manifest,
    name, path, pattern, restart, start, status, stop

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

Providers
---------
    base, bsd, daemontools, debian, freebsd, gentoo, init, launchd, openbsd,
    openrc, openwrt, redhat, runit, service, smf, src, systemd, upstart,
    windows

属性：
    ensure：服务的目标状态，值有true（running）和false（stopped） 
    enable：是否开机自动启动，值有true和false
    name：服务名称，可以省略，如果省略，将继承title的值
    path：服务脚本路径，默认为/etc/init.d/下
    start：定制启动命令
    stop：定制关闭命令
    restart：定制重启命令
    status：定制状态

[root@localhost ppp]# cat service1.pp 
service{‘nginx‘:
        ensure  => true,
        enable  => false
}
CentOS7下的启动不了。

[root@localhost ppp]# puppet describe file -s -m

file
====
Manages files, including their content, ownership, and permissions.
The `file` type can manage normal files, directories, and symlinks; the
type should be specified in the `ensure` attribute. Note that symlinks
cannot
be managed on Windows systems.
File contents can be managed directly with the `content` attribute, or
downloaded from a remote source using the `source` attribute; the latter
can also be used to recursively serve directories (when the `recurse`
attribute is set to `true` or `local`). On Windows, note that file
contents are managed in binary mode; Puppet never automatically translates
line endings.
**Autorequires:** If Puppet is managing the user or group that owns a
file, the file resource will autorequire them. If Puppet is managing any
parent directories of a file, the file resource will autorequire them.


Parameters
----------
    backup, checksum, content, ctime, ensure, force, group, ignore, links,
    mode, mtime, owner, path, purge, recurse, recurselimit, replace,
    selinux_ignore_defaults, selrange, selrole, seltype, seluser, show_diff,
    source, source_permissions, sourceselect, target, type, validate_cmd,
    validate_replacement

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

Providers
---------
    posix, windows
[root@localhost ppp]# 

属性：
    ensure：目标状态，值有absent,present,file,directory和link
        file：类型为普通文件，其内容由content属性生成或复制由source属性指向的文件路径来创建；
        link：类型为符号链接文件，必须由target属性指明其链接的目标文件；
        directory：类型为目录，可通过source指向的路径复制生成，recurse属性指明是否递归复制；
    path：文件路径；
    source：源文件；
    content：文件内容；
    target：符号链接的目标文件； 
    owner：定义文件的属主；
    group：定义文件的属组；
    mode：定义文件的权限；
    atime/ctime/mtime：时间戳；

[root@localhost ppp]# vim file1.pp

file{‘aaa‘:
        path    => ‘/data/aaa‘,
        source  => ‘/etc/aaa‘,
        owner   => ‘keerr0‘,
        mode    => ‘611‘,
        }

[root@localhost ppp]# puppet apply -v file1.pp
Notice: Compiled catalog for localhost in environment production in 0.15 seconds
Info: Applying configuration version ‘1579252230‘
Notice: /Stage[main]/Main/File[aaa]/ensure: defined content as ‘{md5}d41d8cd98f00b204e9800998ecf8427e‘
Notice: Finished catalog run in 0.08 seconds
[root@localhost ppp]# ls /data/aaa 
/data/aaa

[root@localhost ppp]# puppet describe exec -s -m

exec
====
Executes external commands.
Any command in an `exec` resource **must** be able to run multiple times
without causing harm --- that is, it must be *idempotent*. There are three
main ways for an exec to be idempotent:
* The command itself is already idempotent. (For example, `apt-get update`.)
* The exec has an `onlyif`, `unless`, or `creates` attribute, which prevents
  Puppet from running the command unless some condition is met.
* The exec has `refreshonly => true`, which only allows Puppet to run the
  command when some other resource is changed. (See the notes on refreshing
  below.)
A caution: There‘s a widespread tendency to use collections of execs to
manage resources that aren‘t covered by an existing resource type. This
works fine for simple tasks, but once your exec pile gets complex enough
that you really have to think to understand what‘s happening, you should
consider developing a custom resource type instead, as it will be much
more predictable and maintainable.
**Refresh:** `exec` resources can respond to refresh events (via
`notify`, `subscribe`, or the `~>` arrow). The refresh behavior of execs
is non-standard, and can be affected by the `refresh` and
`refreshonly` attributes:
* If `refreshonly` is set to true, the exec will _only_ run when it receives
an
  event. This is the most reliable way to use refresh with execs.
* If the exec already would have run and receives an event, it will run its
  command **up to two times.** (If an `onlyif`, `unless`, or `creates`
condition
  is no longer met after the first run, the second run will not occur.)
* If the exec already would have run, has a `refresh` command, and receives
an
  event, it will run its normal command, then run its `refresh` command
  (as long as any `onlyif`, `unless`, or `creates` conditions are still met
  after the normal command finishes).
* If the exec would **not** have run (due to an `onlyif`, `unless`, or
`creates`
  attribute) and receives an event, it still will not run.
* If the exec has `noop => true`, would otherwise have run, and receives
  an event from a non-noop resource, it will run once (or run its `refresh`
  command instead, if it has one).
In short: If there‘s a possibility of your exec receiving refresh events,
it becomes doubly important to make sure the run conditions are restricted.
**Autorequires:** If Puppet is managing an exec‘s cwd or the executable
file used in an exec‘s command, the exec resource will autorequire those
files. If Puppet is managing the user that an exec should run as, the
exec resource will autorequire that user.


Parameters
----------
    command, creates, cwd, environment, group, logoutput, onlyif, path,
    refresh, refreshonly, returns, timeout, tries, try_sleep, umask, unless,
    user

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

Providers
---------
    posix, shell, windows

属性：
    command(namevar)：要运行的命令；
    cwd：指定运行该命令的目录；
    creates：文件路径，仅此路径表示的文件不存在时，command方才执行；
    user/group：运行命令的用户身份；
    path：指定命令执行的搜索路径；
    onlyif：此属性指定一个命令，此命令正常（退出码为0）运行时，当前command才会运行；
    unless：此属性指定一个命令，此命令非正常（退出码为非0）运行时，当前command才会运行；
    refresh：重新执行当前command的替代命令；
    refreshonly：仅接收到订阅的资源的通知时方才运行；

[root@localhost ppp]# vim exec1.pp

exec{‘cmd‘:
        command => ‘mkdir /data/testdir‘,
        path => [‘/bin‘,‘/sbin‘,‘/usr/bin‘,‘/usr/sbin‘],
        #   path => ‘/bin:/sbin:/usr/bin:/usr/sbin‘,
        }
[root@localhost ppp]# puppet apply -v exec1.pp
Notice: Compiled catalog for localhost in environment production in 0.05 seconds
Info: Applying configuration version ‘1579252384‘
Notice: /Stage[main]/Main/Exec[cmd]/returns: executed successfully
Notice: Finished catalog run in 0.05 seconds
[root@localhost ppp]# ls /data/testdir/

[root@localhost ppp]# puppet describe cron -s -m

cron
====
Installs and manages cron jobs.  Every cron resource created by Puppet
requires a command and at least one periodic attribute (hour, minute,
month, monthday, weekday, or special).  While the name of the cron job is
not part of the actual job, the name is stored in a comment beginning with
`# Puppet Name: `. These comments are used to match crontab entries created
by Puppet with cron resources.
If an existing crontab entry happens to match the scheduling and command of
a
cron resource that has never been synched, Puppet will defer to the existing
crontab entry and will not create a new entry tagged with the `# Puppet
Name: `
comment.
Example:
    cron { logrotate:
      command => "/usr/sbin/logrotate",
      user    => root,
      hour    => 2,
      minute  => 0
    }
Note that all periodic attributes can be specified as an array of values:
    cron { logrotate:
      command => "/usr/sbin/logrotate",
      user    => root,
      hour    => [2, 4]
    }
...or using ranges or the step syntax `*/2` (although there‘s no guarantee
that your `cron` daemon supports these):
    cron { logrotate:
      command => "/usr/sbin/logrotate",
      user    => root,
      hour    => [‘2-4‘],
      minute  => ‘*/10‘
    }
An important note: _the Cron type will not reset parameters that are
removed from a manifest_. For example, removing a `minute => 10` parameter
will not reset the minute component of the associated cronjob to `*`.
These changes must be expressed by setting the parameter to
`minute => absent` because Puppet only manages parameters that are out of
sync with manifest entries.
**Autorequires:** If Puppet is managing the user account specified by the
`user` property of a cron resource, then the cron resource will autorequire
that user.


Parameters
----------
    command, ensure, environment, hour, minute, month, monthday, name,
    special, target, user, weekday

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

Providers
---------
    crontab

属性：
    command：要执行的任务（命令或脚本）；
    ensure：目标状态，present/absent；
    hour：时；
    minute：分；
    monthday：日；
    month：月；
    weekday：周；
    user：以哪个用户的身份运行命令（默认为root）；
    target：添加为哪个用户的任务；
    name：cron job的名称；

[root@localhost ppp]# vim cron1.pp

cron{‘timesync‘:
        command => ‘/usr/sbin/ntpdata 127.0.0.1‘,
        ensure  => present,
        minute  => ‘*/3‘,
        user    => ‘root‘,
        }
[root@localhost ppp]# puppet apply -v cron1.pp
Notice: Compiled catalog for localhost in environment production in 0.06 seconds
Info: Applying configuration version ‘1579252608‘
Notice: /Stage[main]/Main/Cron[timesync]/ensure: created
Notice: Finished catalog run in 0.14 seconds

[root@localhost ppp]# crontab -l
# HEADER: This file was autogenerated at 2020-01-17 17:16:49 +0800 by puppet.
# HEADER: While it can still be managed manually, it is definitely not recommended.
# HEADER: Note particularly that the comments starting with ‘Puppet Name‘ should
# HEADER: not be deleted, as doing so could cause duplicate cron jobs.
# Puppet Name: timesync
*/3 * * * * /usr/sbin/ntpdata 127.0.0.1
[root@localhost ppp]# 

[root@localhost ppp]# puppet describe notify -s -m

notify
======
Sends an arbitrary message to the agent run-time log.


Parameters
----------
    message, name, withpath

Meta Parameters
---------------
    alias, audit, before, loglevel, noop, notify, require, schedule, stage,
    subscribe, tag

属性：
    message：记录的信息
    name：信息名称