puppet 配置 5 常见例子

原创已于 2024-12-16 19:57:51 修改 · 1.2k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#puppet

于 2017-02-13 10:10:58 首次发布

puppet 专栏收录该内容

13 篇文章

订阅专栏

本文介绍如何使用 Puppet 进行高效的配置管理，包括变量复用、条件判断、配置文件管理和防火墙设置等核心功能。通过具体示例展示了如何为不同主机定义变量并根据 IP 地址执行特定任务。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

变量复用

说明:

变量定义后可以直接调用变量名称使用

范例:

	$etcd_controller1='10.100.84.22'
	$etcd_controller2='10.100.84.23'
	$etcd_controller3='10.100.84.24'
	
	$etcd_host1='gx-yun-084022.vclound.com'
	$etcd_host2='gx-yun-084023.vclound.com'
	$etcd_host3='gx-yun-084024.vclound.com'

	$etcd_connect="$etcd_host1=http://$etcd_host1:2380,$etcd_host2=http://$etcd_host2:2380,$etcd_host3=http://$etcd_host3:2380"

	$etcdcluster="$etcd_controller1:2379,$etcd_controller2:2379,$etcd_controller3:2379"

变量的判断

说明:
1. 对主机地址进行匹配, (可以利用 case , if 的方式进行判断, 效果一样)
2. 针对不同的主机, 定义不同的变量使用

范例

	$myipaddress=$ipaddress_vlanbr0

	if $myipaddress =~ /^10\.201\.\\*/ {
	    $ntpserver = '10.201.100.21'
	} elsif  $myipaddress =~ /^10\.200\.\\*/  {
	    $ntpserver = '10.200.100.21'
	} elsif $myipaddress =~ /^10\.205\.\\*/  {
	    $ntpserver = '10.205.100.25'
	} elsif $myipaddress =~ /^192\.168\.\\*/ {
	    $ntpserver = [ '10.199.129.21', '10.199.129.22' ]
	} elsif $myipaddress =~ /^10\.100\.\\*/ {
	    $ntpserver = [ '10.199.129.21', '10.199.129.22' ]
	}

case 语法

作用
1. 对主机地址进行匹配,
2. 利用匹配规则, 令不同的主机执行不同的命令

范例:

	case $myipaddress {
	  $etcd_controller1, $etcd_controller2, $etcd_controller3 : {
	    exec { 'exit':
	      user => root, group => root,
	      path => '/bin:/sbin:/usr/bin:/usr/sbin',
	      unless => [ "/usr/bin/nmap $fqdn -p 2380 | /usr/bin/grep -o open" ],
	      require => [ Package['nmap'], Class['initial'], Class['etcd::service']  ],
	    }
	  }
	
	  default : {
	    exec { 'exit':
	      user => root, group => root,
	      path => '/bin:/sbin:/usr/bin:/usr/sbin',
	      unless => [ "/usr/bin/nmap $etcd_controller1 -p 2380 | /usr/bin/grep -o open &&  /usr/bin/nmap $etcd_controller2 -p 2380 | /usr/bin/grep -o open &&  /usr/bin/nmap $etcd_controller3 -p 2380 | /usr/bin/grep -o open"  ],
	      require => Package['nmap'],
	    }
	  }
	}

配置文件特殊语法

参考下面语法 (config.pp)

	convoy_config {
		'Service/LimitMEMLOCK':  value => $convoyLimitMEMLOCK;
		'Service/LimitSTACK':  value => $convoyLimitSTACK;
		'Service/LimitNPROC':  value => $convoyLimitNPROC;
		'Service/LimitNOFILE':  value => $convoyLimitNOFILE;
		'Service/LimitCORE':  value => $convoyLimitCORE;
	}

当执行 puppet 后, 可以得到下面的常见的配置文件配置结果 (实际会得到等号后的变量值 )

	[Service]
	LimitMEMLOCK = $convoyLimitMEMLOCK
	LimitSTACK = $convoyLimitSTACK
	LimitNPROC = $convoyLimitNPROC
	LimitNOFILE = $convoyLimitNOFILE
	LimitCORE = $convoyLimitCORE

要使用这样的配置方法, 必须添加下面两个模块库文件

	/etc/puppet/modules/convoy
	├── lib
	│   └── puppet
	│       ├── provider
	│       │   └── convoy_config
	│       │       └── ini_setting.rb    <- 添加
	│       └── type
	│           └── convoy_config.rb       <- 添加
	├── manifests
	│   ├── config.pp                   <- 添加后, 配置才生效
	│   ├── directlvm.pp
	│   ├── init.pp

/etc/puppet/modules/convoy/lib/puppet/provider/convoy_config/ini_setting.rb

	Puppet::Type.type(:convoy_config).provide(
	  :ini_setting,
	  :parent => Puppet::Type.type(:ini_setting).provider(:ruby)
	) do
	
	  def section
	    resource[:name].split('/', 2).first
	  end
	
	  def setting
	    resource[:name].split('/', 2).last
	  end
	
	  def separator
	    '='
	  end
	
	  def self.file_path
	    '/usr/lib/systemd/system/convoy.service'
	  end
	
	  def file_path
	     self.class.file_path
	  end
	end

/etc/puppet/modules/convoy/lib/puppet/type/convoy_config.rb

	Puppet::Type.newtype(:convoy_config) do
	
	  ensurable
	
	  newparam(:name, :namevar => true) do
	    desc 'Section/setting name to manage from /usr/lib/systemd/system/convoy.service'
	    newvalues(/\S+\/\S+/)
	  end
	
	  newproperty(:value) do
	    desc 'The value of the setting to be defined.'
	    munge do |value|
	      value = value.to_s.strip
	      value.capitalize! if value =~ /^(true|false)$/i
	      value
	    end
	  end
	
	end

firewalld 配置

模块下载位置

https://github.com/crayfishx/puppet-firewalld

配置语法
一段端口配置方法

	firewalld_port { 'Open port 1000-50000 in the public zone tcp':
                ensure   => present,
                zone     => 'public',
                port     => 1000-50000,
                protocol => 'tcp',
	}

	firewalld_port { 'Open port 1000-50000 in the public zone udp':
                ensure   => present,
                zone     => 'public',
                port     => 1000-50000,
                protocol => 'udp',
	}

一个端口配置方法

	firewalld_port { 'Open port 2476 in the public zone':
                ensure   => present,
                zone     => 'public',
                port     => 2476,
                protocol => 'tcp',
	}

	firewalld_port { 'Open port 8080 in the public zone':
                ensure   => present,
                zone     => 'public',
                port     => 8080,
                protocol => 'tcp',
	}