预备工作
【HOSTNAME】 【IP】
master.puppet.com 10.200.37.177
agent.puppet.com 10.200.37.178
主机名设置参照：http://blog.csdn.net/zachaway/article/details/18259495
同时需要更改hosts文件，注意hosts要和主机名对应。
master与agent都要加入下面两行。
vim /etc/hosts
10.200.37.177 master.puppet.com puppetmaster
10.200.37.178 agent.puppet.com puppetagent
一、Puppet的安装
Puppet的安装方式支持源码安装、yum安装以及ruby的gem安装。官网推荐使用yum来安装puppet，方面以后的升级、管理、维护。Centos可以采用yum来安装，但是Centos的默认源中没有puppet包，因此需要先安装epel包。Epel是企业版Linux附加软件包(Extra Packages for Enterprise Linux)的缩写，是一个由特别兴趣小组创建、维护并管理的，针对红帽企业版Linux(RHEL)及其衍生发行版(比如CentOS、Scientific Linux)的一个高质量附加软件包项目。
1. Master的安装
yum -y install ruby ruby-libs ruby-shadow
wget ftp://ftp.sunet.se/pub/Linux/distributions/yellowdog/yum/6.2/extras/RPMS/epel-release-5-3.noarch.rpm
rpm -Uvh epel-release-5-3.noarch.rpm
yum -y install puppet puppet-server facter
2. Agent的安装
yum
install ruby ruby-libs ruby-shadow
wget ftp://ftp.sunet.se/pub/Linux/distributions/yellowdog/yum/6.2/extras/RPMS/epel-release-5-3.noarch.rpm
rpm -Uvh epel-release-5-3.noarch.rpm
yum -y install puppet facter
PS：如果出现No Package ruby-shadow...Nothing to do，不用管，不影响后续操作。根据后面安装的情况，ruby-shadow应该附带在ruby里安装完成了，所以不影响后续安装。
至此如果安装过程不报错的话，puppet已经安装成功了。
二、master的配置
ls
-1 /etc/puppet/
auth.conf
#定义puppet master的acl文件
fileserver.conf #定义puppet master文件服务器的配置文件
manifests #puppet脚本主文件目录，site.pp文件必须存在
modules #puppet模块目录
puppet.conf #puppet主配置文件
暂时没有什么需要修改的内容
2. Agent的配置
Agent的配置主要是更改agent上的/etc/puppet/puppet.conf文件的[agent]部分。
在agent上vim /etc/puppet/puppet.conf 添加如下配置
server = master.puppet.com #master服务器的地址
runinterval = 3600 #每隔多久的时间进行自动更新,时间单位为秒
listen = true #客户端作为一个服务进行监听，允许其它的机器触发puppet运行允许远程触发puppet的节点配置
三、puppet的启动和停止
1. Master的启动和停止
Master的启动
/etc/rc.d/init.d/puppetmaster
start
或者service puppetmaster start
第一次启动建议采用puppet
master --verbose --no-daemonize方式启动，有助于测试和调试错误，如果采用后面这种方式，这样就可以看到启动的整个过程，启动过程会做一些初始化的工作，为master创建本地证书认证中心，证书和key。并打开socket等待client的连接。可以在/etc/puppet/ssl目录看到相关的文件和目录。
Master的停止
/etc/rc.d/init.d/puppetmaster
stop
或者service puppetmaster stop
2. Agent的启动和停止
Agent的启动
/etc/rc.d/init.d/puppet
start
或者service
puppet start
调试的时候可以采用
puppet
agent --server=master.puppet.com --no-daemonize –verbose
Agent的停止
/etc/rc.d/init.d/puppet
stop
或者service
puppet stop
四、查看本地证书情况
puppetmaster第一次启动会自动生成证书自动注册自己
[root@master
~]# tree /var/lib/puppet/ssl/
/var/lib/puppet/ssl/
|-- ca
| |-- ca_crl.pem
| |-- ca_crt.pem
| |-- ca_key.pem
| |-- ca_pub.pem
| |-- inventory.txt
| |-- private
| | `-- ca.pass
| |-- requests
| |-- serial
| `-- signed
| |-- localhost.localdomain.pem
| `-- master.puppet.com.pem //已注册
|-- certificate_requests
|-- certs
| |-- ca.pem
| |-- localhost.localdomain.pem
| `-- master.puppet.com.pem
|-- crl.pem
|-- private
|-- private_keys
| |-- localhost.localdomain.pem
| `-- master.puppet.com.pem
`-- public_keys
|-- localhost.localdomain.pem
`-- master.puppet.com.pem
9 directories, 18 files
在agent端通过调试模式启动节点向Puppetmaster端发起认证
[root@agent
~]# puppet agent --test
info: Creating a new SSL key for agent.puppet.com
info: Creating a new SSL certificate request for agent.puppet.com
info: Certificate Request fingerprint (md5): 65:1A:E7:EC:81:7C:C8:4A:65:F7:53:B9:6E:72:AB:A3
Exiting; no certificate found and waitforcert is disabled
在master端查看认证情况
[root@master
~]# tree /var/lib/puppet/ssl/
/var/lib/puppet/ssl/
|-- ca
| |-- ca_crl.pem
| |-- ca_crt.pem
| |-- ca_key.pem
| |-- ca_pub.pem
| |-- inventory.txt
| |-- private
| | `-- ca.pass
| |-- requests
| | `-- agent.puppet.com.pem //请求已经发送过来了
| |-- serial
| `-- signed
| |-- localhost.localdomain.pem
| `-- master.puppet.com.pem
|-- certificate_requests
|-- certs
| |-- ca.pem
| |-- localhost.localdomain.pem
| `-- master.puppet.com.pem
|-- crl.pem
|-- private
|-- private_keys
| |-- localhost.localdomain.pem
| `-- master.puppet.com.pem
`-- public_keys
|-- localhost.localdomain.pem
`-- master.puppet.com.pem
9 directories, 18 files
或者
[root@master ~]# puppet cert --list --all //另一种查看认证情况
"agent.puppet.com" (65:1A:E7:EC:81:7C:C8:4A:65:F7:53:B9:6E:72:AB:A3)
+ "master.puppet.com" (E2:39:E2:8E:48:E2:C4:6F:66:26:E1:9D:4B:A6:EF:CC) (alt names: "DNS:master.puppet.com", "DNS:puppet", "DNS:puppet.puppet.com")
在master上注册agent
[root@master ~]# puppet cert --sign agent.puppet.com
notice: Signed certificate request for agent.puppet.com
notice: Removing file Puppet::SSL::CertificateRequest agent.puppet.com at '/var/lib/puppet/ssl/ca/requests/agent.puppet.com.pem'
再次查看认证情况
[root@master ~]# puppet cert --list --all
+ "agent.puppet.com" (39:FA:BE:2D:71:45:20:AB:7C:CD:0A:61:DA:96:60:9B)
+ "master.puppet.com" (E2:39:E2:8E:48:E2:C4:6F:66:26:E1:9D:4B:A6:EF:CC) (alt names: "DNS:master.puppet.com", "DNS:puppet", "DNS:puppet.puppet.com")
至此，puppet的简单的安装与配置已经完成。
PS：测试节点agent
[root@master motd]# puppet agent --test
err: Could not retrieve catalog from remote server: getaddrinfo: Name or service not known
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
err: Could not send report: getaddrinfo: Name or service not known
解决办法：客户端和服务器端时间不同步，SSL连接需要依赖主机上的时间是否正确。执行更新时间的命令：
[root@agent ~]# ntpdate master.puppet.com
28 Mar 12:16:58 ntpdate[3348]: step time server 10.200.37.178 offset -29.556532 sec
//此时agent上的ntpd服务应该处于关闭状态，不让它自动同步。