自动化运维工具之Puppet基础入门

[root@node12 ~]# yum install -y puppet 

[root@node12 ~]# puppet help  Usage: puppet <subcommand> [options] <action> [options]  Available subcommands:        agent             The puppet agent daemon   apply             Apply Puppet manifests locally   ca                Local Puppet Certificate Authority management.   catalog           Compile, save, view, and convert catalogs.   cert              Manage certificates and requests   certificate       Provide access to the CA for certificate management.   certificate_request  Manage certificate requests.   certificate_revocation_list  Manage the list of revoked certificates.   config            Interact with Puppet's settings.   describe          Display help about resource types   device            Manage remote network devices   doc               Generate Puppet documentation and references   facts             Retrieve and store facts.   file              Retrieve and store files in a filebucket   filebucket        Store and retrieve files in a filebucket   help              Display Puppet help.   inspect           Send an inspection report   instrumentation_data  Manage instrumentation listener accumulated data.   instrumentation_listener  Manage instrumentation listeners.   instrumentation_probe  Manage instrumentation probes.   key               Create, save, and remove certificate keys.   kick              Remotely control puppet agent   man               Display Puppet manual pages.   master            The puppet master daemon   module            Creates, installs and searches for modules on the Puppet Forge.   node              View and manage node definitions.   parser            Interact directly with the parser.   plugin            Interact with the Puppet plugin system.   queue             Deprecated queuing daemon for asynchronous storeconfigs   report            Create, display, and submit reports.   resource          The resource abstraction layer shell   resource_type     View classes, defined resource types, and nodes from all manifests.   secret_agent      Mimics puppet agent.   status            View puppet server status.  See 'puppet help <subcommand> <action>' for help on a specific subcommand action. See 'puppet help <subcommand>' for help on a specific subcommand. Puppet v3.6.2 [root@node12 ~]#  

[root@node12 ~]# puppet describe --help  puppet-describe(8) -- Display help about resource types ========  SYNOPSIS -------- Prints help about Puppet resource types, providers, and metaparameters.   USAGE ----- puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta]   OPTIONS ------- * --help:   Print this help text  * --providers:   Describe providers in detail for each type  * --list:   List all types  * --meta:   List all metaparameters  * --short:   List only parameters without detail   EXAMPLE -------     $ puppet describe --list     $ puppet describe file --providers     $ puppet describe user -s -m   AUTHOR ------ David Lutterkort   COPYRIGHT --------- Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License  [root@node12 ~]#  

[root@node12 ~]# puppet describe --list These are the types known to puppet: augeas          - Apply a change or an array of changes to the  ... computer        - Computer object management using DirectorySer ... cron            - Installs and manages cron jobs exec            - Executes external commands file            - Manages files, including their content, owner ... filebucket      - A repository for storing and retrieving file  ... group           - Manage groups host            - Installs and manages host entries interface       - This represents a router or switch interface k5login         - Manage the `.k5login` file for a user macauthorization - Manage the Mac OS X authorization database mailalias       - .. no documentation .. maillist        - Manage email lists mcx             - MCX object management using DirectoryService  ... mount           - Manages mounted filesystems, including puttin ... nagios_command  - The Nagios type command nagios_contact  - The Nagios type contact nagios_contactgroup - The Nagios type contactgroup nagios_host     - The Nagios type host nagios_hostdependency - The Nagios type hostdependency nagios_hostescalation - The Nagios type hostescalation nagios_hostextinfo - The Nagios type hostextinfo nagios_hostgroup - The Nagios type hostgroup nagios_service  - The Nagios type service nagios_servicedependency - The Nagios type servicedependency nagios_serviceescalation - The Nagios type serviceescalation nagios_serviceextinfo - The Nagios type serviceextinfo nagios_servicegroup - The Nagios type servicegroup nagios_timeperiod - The Nagios type timeperiod notify          - .. no documentation .. package         - Manage packages resources       - This is a metatype that can manage other reso ... router          - .. no documentation .. schedule        - Define schedules for Puppet scheduled_task  - Installs and manages Windows Scheduled Tasks selboolean      - Manages SELinux booleans on systems with SELi ... selmodule       - Manages loading and unloading of SELinux poli ... service         - Manage running services ssh_authorized_key - Manages SSH authorized keys sshkey          - Installs and manages ssh host keys stage           - A resource type for creating new run stages tidy            - Remove unwanted files based on specific crite ... user            - Manage users vlan            - .. no documentation .. whit            - Whits are internal artifacts of Puppet's curr ... yumrepo         - The client-side description of a yum reposito ... zfs             - Manage zfs zone            - Manages Solaris zones zpool           - Manage zpools [root@node12 ~]#  

[root@node12 ~]# puppet describe user  user ==== Manage users.  This type is mostly built to manage system users, so it is lacking some features useful for managing normal users. This resource type uses the prescribed native tools for creating groups and generally uses POSIX APIs for retrieving information about them.  It does not directly modify `/etc/passwd` or anything. **Autorequires:** If Puppet is managing the user's primary group (as provided in the `gid` attribute), the user resource will autorequire that group. If Puppet is managing any role accounts corresponding to the user's roles, the user resource will autorequire those role accounts.   Parameters ----------  - **allowdupe**     Whether to allow duplicate UIDs. Defaults to `false`.     Valid values are `true`, `false`, `yes`, `no`.   - **attribute_membership**     Whether specified attribute value pairs should be treated as the     **complete list** (`inclusive`) or the **minimum list** (`minimum`) of     attribute/value pairs for the user. Defaults to `minimum`.     Valid values are `inclusive`, `minimum`.   - **attributes**     Specify AIX attributes for the user in an array of attribute = value     pairs. Requires features manages_aix_lam.  - **auth_membership**     Whether specified auths should be considered the **complete list**     (`inclusive`) or the **minimum list** (`minimum`) of auths the user     has. Defaults to `minimum`. Valid values are `inclusive`, `minimum`.   - **auths**     The auths the user has.  Multiple auths should be     specified as an array. Requires features manages_solaris_rbac.  - **comment**     A description of the user.  Generally the user's full name.  - **ensure**     The basic state that the object should be in.     Valid values are `present`, `absent`, `role`.   - **expiry**     The expiry date for this user. Must be provided in     a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.     If you want to make sure the user account does never     expire, you can pass the special value `absent`.     Valid values are `absent`. Values can match `/^d{4}-d{2}-d{2}$/`.     Requires features manages_expiry.  - **forcelocal**     Forces the mangement of local accounts when accounts are also     being managed by some other NSS     Valid values are `true`, `false`, `yes`, `no`.      Requires features libuser.  - **gid**     The user's primary group.  Can be specified numerically or by name.     This attribute is not supported on Windows systems; use the `groups`     attribute instead. (On Windows, designating a primary group is only     meaningful for domain accounts, which Puppet does not currently manage.)  - **groups**     The groups to which the user belongs.  The primary group should     not be listed, and groups should be identified by name rather than by     GID.  Multiple groups should be specified as an array.  - **home**     The home directory of the user.  The directory must be created     separately and is not currently checked for existence.  - **ia_load_module**     The name of the I&A module to use to manage this user.     Requires features manages_aix_lam.  - **iterations**     This is the number of iterations of a chained computation of the     password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter     is used in OS X. This field is required for managing passwords on OS X     >= 10.8. Requires features manages_password_salt.  - **key_membership**     Whether specified key/value pairs should be considered the     **complete list** (`inclusive`) or the **minimum list** (`minimum`) of     the user's attributes. Defaults to `minimum`.     Valid values are `inclusive`, `minimum`.   - **keys**     Specify user attributes in an array of key = value pairs.     Requires features manages_solaris_rbac.  - **managehome**     Whether to manage the home directory when managing the user.     This will create the home directory when `ensure => present`, and     delete the home directory when `ensure => absent`. Defaults to `false`.     Valid values are `true`, `false`, `yes`, `no`.   - **membership**     Whether specified groups should be considered the **complete list**     (`inclusive`) or the **minimum list** (`minimum`) of groups to which     the user belongs. Defaults to `minimum`.     Valid values are `inclusive`, `minimum`.   - **name**     The user name. While naming limitations vary by operating system,     it is advisable to restrict names to the lowest common denominator,     which is a maximum of 8 characters beginning with a letter.     Note that Puppet considers user names to be case-sensitive, regardless     of the platform's own rules; be sure to always use the same case when     referring to a given user.  - **password**     The user's password, in whatever encrypted format the local     system requires.     * Most modern Unix-like systems use salted SHA1 password hashes. You can     use       Puppet's built-in `sha1` function to generate a hash from a password.     * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.     * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs     [stdlib][]       module contains a `str2saltedsha512` function which can generate     password       hashes for Lion.     * Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When       managing passwords on these systems the salt and iterations properties       need to be specified as well as the password.     * Windows passwords can only be managed in cleartext, as there is no     Windows API       for setting the password hash.     [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/     Be sure to enclose any value that includes a dollar sign ($) in single     quotes (') to avoid accidental variable interpolation.     Requires features manages_passwords.  - **password_max_age**     The maximum number of days a password may be used before it must be     changed. Requires features manages_password_age.  - **password_min_age**     The minimum number of days a password must be used before it may be     changed. Requires features manages_password_age.  - **profile_membership**     Whether specified roles should be treated as the **complete list**     (`inclusive`) or the **minimum list** (`minimum`) of roles     of which the user is a member. Defaults to `minimum`.     Valid values are `inclusive`, `minimum`.   - **profiles**     The profiles the user has.  Multiple profiles should be     specified as an array. Requires features manages_solaris_rbac.  - **project**     The name of the project associated with a user.     Requires features manages_solaris_rbac.  - **purge_ssh_keys**     Purge ssh keys authorized for the user     if they are not managed via ssh_authorized_keys. When true,     looks for keys in .ssh/authorized_keys in the user's home     directory. Possible values are true, false, or an array of     paths to file to search for authorized keys. If a path starts     with ~ or %h, this token is replaced with the user's home directory.     Valid values are `true`, `false`.   - **role_membership**     Whether specified roles should be considered the **complete list**     (`inclusive`) or the **minimum list** (`minimum`) of roles the user     has. Defaults to `minimum`. Valid values are `inclusive`, `minimum`.   - **roles**     The roles the user has.  Multiple roles should be     specified as an array. Requires features manages_solaris_rbac.  - **salt**     This is the 32 byte salt used to generate the PBKDF2 password used in     OS X. This field is required for managing passwords on OS X >= 10.8.     Requires features manages_password_salt.  - **shell**     The user's login shell.  The shell must exist and be     executable.     This attribute cannot be managed on Windows systems.     Requires features manages_shell.  - **system**     Whether the user is a system user, according to the OS's criteria;     on most platforms, a UID less than or equal to 500 indicates a system     user. Defaults to `false`.     Valid values are `true`, `false`, `yes`, `no`.   - **uid**     The user ID; must be specified numerically. If no user ID is     specified when creating a new user, then one will be chosen     automatically. This will likely result in the same user having     different UIDs on different systems, which is not recommended. This is     especially noteworthy when managing the same user on both Darwin and     other platforms, since Puppet does UID generation on Darwin, but     the underlying tools do so on other platforms.     On Windows, this property is read-only and will return the user's     security identifier (SID).  Providers ---------     aix, directoryservice, hpuxuseradd, ldap, pw, user_role_add, useradd,     windows_adsi [root@node12 ~]#  

type {'title':     attribute1 	=> value1,     atrribute2	=> value2,     …… } 

[root@node12 ~]# cat user.pp user{'tom':         ensure  => present,         uid     => 5000,         home    => '/home/tom',         shell   => '/bin/bash',         comment => 'this is test user', } [root@node12 ~]# 

[root@node12 ~]# puppet apply -v --noop user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.07 seconds Info: Applying configuration version '1606542594' Notice: /Stage[main]/Main/User[tom]/ensure: current_value absent, should be present (noop) Notice: Class[Main]: Would have triggered 'refresh' from 1 events Notice: Stage[main]: Would have triggered 'refresh' from 1 events Info: Creating state file /var/lib/puppet/state/state.yaml Notice: Finished catalog run in 0.02 seconds [root@node12 ~]#  

[root@node12 ~]# puppet apply -v  user.pp       Notice: Compiled catalog for node12.test.org in environment production in 0.06 seconds Info: Applying configuration version '1606542785' Notice: /Stage[main]/Main/User[tom]/ensure: created Notice: Finished catalog run in 0.05 seconds [root@node12 ~]# 

[root@node12 ~]# getent passwd tom tom:x:5000:5000:this is test user:/home/tom:/bin/bash [root@node12 ~]#  

[root@node12 ~]# cat user.pp user{'tom':         ensure  => absent,         uid     => 5000,         home    => '/home/tom',         shell   => '/bin/bash',         comment => 'this is test user', } [root@node12 ~]# 

[root@node12 ~]# puppet apply -v user.pp Notice: Compiled catalog for node12.test.org in environment production in 0.25 seconds Info: Applying configuration version '1606574872' Notice: /Stage[main]/Main/User[tom]/ensure: removed Notice: Finished catalog run in 0.11 seconds [root@node12 ~]# getent passwd tom       [root@node12 ~]# id tom id: tom: no such user [root@node12 ~]#