Puppet扩展篇7-puppet代码与版本控制系统的结合

一、介绍

通过安装部署Puppet C/S模型，实现Puppet Server端管理所有被控制机的整个生命周期：从初始化到软件升级、从配置文件创建到测试部署、从系统维护到服务器迁移等。Puppet能够持续化的与被控制机进行交互，从而实现配置文件的及时检测更新。结合SVN版本控制系统，puppet可在更新之前将当前正在运行的环境以版本的方式保存到SVN版本控制系统中，方便以后通过puppet更新出错或者需要回滚到之前的某一个环境时快速恢复。

二、环境介绍

  1. 序号    服务器类型                     版本/IP参数
  2.  1    PuppetMaster         RHEL6.4 x86_64（192.168.100.110）
  3.  2    PuppetAgent             RHEL5.8 x86_64（192.168.100.111）和RHEL5.7 x86_64（192.168.100.112）
  4.  3    SVN Service端     RHEL6.4 x86_64（192.168.100.110）
  5.  4    SVN Service端     RHEL6.4 x86_64（192.168.100.110）和Windows 8.1 x86_64(192.168.100.2)
  7. 编号      类型       主机名/软件名称    系统/软件版本                    其他信息
  8.  1    Software    Subversion        1.6.11-7    rpm                 package
  9.  2    Software    TortoiseSVN        1.8.2.24708-x64-svn-1.8.3        msi

三、部署流程

1 SVN Server端部署

1.1 安装相关软件包

  1. [root@puppetserver ~]# yum install subversion
  2. [root@puppetserver ~]# svnserve –version  #通过查看版本验证安装是否成功
  3. svnserve, version 1.6.11 (r934486)
  4.    compiled Apr 12 2012, 11:09:11
  6. Copyright (C) 2000-2009 CollabNet.
  7. Subversion is open source software, see http://subversion.tigris.org/
  8. This product includes software developed by CollabNet (http://www.Collab.Net/).
  10. The following repository back-end (FS) modules are available:
  12. * fs_base : Module for working with a Berkeley DB repository.
  13. * fs_fs : Module for working with a plain file (FSFS) repository.
  15. Cyrus SASL authentication is available.

1.2 创建第一个版本库

  1. [root@puppetserver ~]# mkdir /svndata
  2. [root@puppetserver ~]# svnadmin create /svndata/puppet
  3. [root@puppetserver ~]# ll /svndata/puppet/
  4. total 24
  5. drwxr-xr-x 2 root root 4096 Oct 22 13:29 conf
  6. drwxr-sr-x 6 root root 4096 Oct 22 13:29 db
  7. -r--r--r-- 1 root root    2 Oct 22 13:29 format
  8. drwxr-xr-x 2 root root 4096 Oct 22 13:29 hooks
  9. drwxr-xr-x 2 root root 4096 Oct 22 13:29 locks
  10. -rw-r--r-- 1 root root  229 Oct 22 13:29 README.txt

2 通过Apache+ssl安全认证访问SVN服务器

2.1 安装相关软件包

  1. [root@puppetserver ~]# yum install httpd httpd-devel mod_dav_svn

2.2 创建SVN虚拟主机

  1. [root@puppetserver svndata]# vim /etc/httpd/conf.d/subversion.conf
  2. LoadModule dav_svn_module     modules/mod_dav_svn.so
  3. LoadModule authz_svn_module   modules/mod_authz_svn.so
  4. Listen 8142
  5. <VirtualHost *:8142>
  6. <Location /svndata>
  7. DAV svn
  8. SVNListParentPath on
  9. SVNPath "/svndata/puppet"
  10. AuthType Basic
  11. AuthName "Subversion repository"
  12. AuthUserFile "/svndata/puppet/conf/authfile"
  13. #AuthzSVNAccessFile /svndata/puppet/conf/svn-acl-conf
  14. Require valid-user
  15. SVNAutoversioning on
  16. ModMimeUsePathInfo on
  17. </Location>
  18. </VirtualHost>

2.3 创建svn权限配置文件

  1. [root@puppetserver svndata]# vim puppet/conf/authz  
  2. [groups]
  3. admin = puppet
  4. [admin:/]
  5. @admin = rw
  6. [/]
  7. * = r
  8. [$name:/]
  9. test = rw">>/svndata/puppet/conf/authz
  11. 2.4    创建用户名及密码并设置相应权限
  12. [root@puppetserver ~]# /usr/bin/htpasswd -c /svndata/puppet/conf/authfile puppet #创建SVN服务器账户puppet密码为redhat
  13. New password: redhat
  14. Re-type new password: redhat
  15. Adding password for user puppet
  16. [root@puppetserver ~]# chown apache /svndata/puppet -R
  17. [root@puppetserver ~]# echo "puppet = redhat" >>/svndata/puppet/conf/passwd

2.5 配置SVN服务信息

  1. [root@puppetserver svndata]# vim /svndata/puppet/conf/svnserve.conf 
  2. [general] 
  3. anon-access = none
  4. auth-access = write
  5. password-db = /svndata/puppet/conf/passwd
  6. authz-db = /svndata/puppet/conf/authz
  7. realm = puppet Repository

2.6 通过浏览器测试访问

  1. [root@puppetserver svndata]# /etc/rc.d/init.d/httpd restart #重启httpd服务
  2. http://192.168.100.110:8142/svndata/

svn版本控制测试界面

svn版本控制测试界面

2.7 通过其他linux节点访问测试

  1. [root@agent1 ~]# svn checkout http://192.168.100.110:8142/svndata/  /mnt/
  2. Authentication realm: <http://192.168.100.110:8142> Puppet Subversion repository
  3. Password for 'root': 
  4. Authentication realm: <http://192.168.100.110:8142> Puppet Subversion repository
  5. Username: puppet 
  6. Password for 'puppet':
  7. -----------------------------------------------------------------------
  8. ATTENTION!  Your password for authentication realm:
  10.    <http://192.168.100.110:8142> Puppet Subversion repository
  12. can only be stored to disk unencrypted!  You are advised to configure
  13. your system so that Subversion can store passwords encrypted, if
  14. possible.  See the documentation for details.
  16. You can avoid future appearances of this warning by setting the value
  17. of the 'store-plaintext-passwords' option to either 'yes' or 'no' in
  18. '/root/.subversion/servers'.
  19. -----------------------------------------------------------------------
  20. Store password unencrypted (yes/no)? no
  21. Checked out revision 0.

2.8 通过Windows客户端TortoiseSVN访问测试

svn版本控制测试界面

svn版本控制测试界面

svn版本控制测试界面

备注：由于还为import版本，所以查看的内容为空

3 整合puppet server端

3.1 将puppet server模块目录导入到版本库中

  1. [root@puppetserver ~]# svn import /etc/puppet/environments/testing
  2. http://192.168.100.110:8142/svndata/puppet -m "Puppet Initial repository" 
  3. Authentication realm: <http://192.168.100.110:8142> Puppet Subversion repository
  4. Password for 'root': 
  5. Authentication realm: <http://192.168.100.110:8142> Puppet Subversion repository
  6. Username: puppet
  7. Password for 'puppet': 
  8. Adding         /etc/puppet/environments/testing/groups
  9. Adding         /etc/puppet/environments/testing/groups/modules
  10. Adding         /etc/puppet/environments/testing/groups/modules/grub
  11. Adding         /etc/puppet/environments/testing/groups/modules/grub/files
  12. Adding         /etc/puppet/environments/testing/groups/modules/grub/manifests
  13. …
  14. Committed revision 1.

备注：由于SVN服务器端和puppetserver在同一台服务器上，也可以通过以下方式进行导入

  1. [root@puppetserver ~]# svn import /etc/puppet/environments/testing  
  2. file:///svndata/puppet -m "Puppet Initial repository"

3.2 通过IE浏览器访问SVN服务器

svn版本控制测试界面

3.3 通过Windows客户端TortoiseSVN checkout最新的版本库到本地

svn版本控制测试界面

svn版本控制测试界面

svn版本控制测试界面

3.4 删除puppetserver端testing目录，并将版本库中的数据导出

  1. [root@puppetserver ~]# cd /etc/puppet/environments/testing/
  2. [root@puppetserver testing]# rm -rf *  #删除之前建议备份
  3. [root@puppetserver testing]# svn checkout
  4. http://192.168.100.110:8142/svndata/puppet  /etc/puppet/environments/testing 
  5. Authentication realm: <http://192.168.100.110:8142> Puppet Subversion repository
  6. Password for 'puppet':
  7. Please type 'yes' or 'no': no
  8. A    groups
  9. A    groups/modules
  10. A    groups/modules/grub
  11. A    groups/modules/grub/files
  12. A    groups/modules/grub/manifests
  13. Checked out revision 1.
  14. [root@puppetserver testing]# ls -a
  15. .  ..  agents  environment  groups  manifests  .svn
  16. [root@puppetserver testing]# ls .svn/  #每个目录下面都会生成.svn隐藏目录，用于保存当前版本的信息
  17. all-wcprops  entries  prop-base  props  text-base  tmp
  18. 备注：checkout之后，在/etc/puppet/environments/testing目录下就会有一份SVN服务器上最新版本的副本。

4 部署SVN hooks

4.1 设置pre-commit

设置pre-commit钩子可以提交文件到SNV服务器之前对puppet语法进行检查，语法通过则提交成功，语法错误则提交失败。

  1. [root@puppetserver hooks]# chmod 774 pre-commit^C
  2. [root@puppetserver hooks]# cp pre-commit.tmpl pre-commit
  3. [root@puppetserver hooks]# chmod 774 pre-commit 
  4. [root@puppetserver hooks]# vim pre-commit 
  5. #!/bin/sh
  6. # SVN pre-commit hook to check Puppet syntax for .pp files
  7. # Modified from http://mail.madstop.com/pipermail/puppet-users/2007-March/002034.html
  8. # Access http://projects.puppetlabs.com/projects/1/wiki/puppet_version_control
  9. REPOS="$1"
  10. TXN="$2"
  11. tmpfile=`mktemp`
  12. export HOME=/
  13. SVNLOOK=/usr/bin/svnlook
  14. $SVNLOOK changed -t "$TXN" "$REPOS" | awk '/^[^D].*\.pp$/ {print $2}' | while read line
  15. do
  16.     $SVNLOOK cat -t "$TXN" "$REPOS" "$line" > $tmpfile
  17.     if [ $? -ne 0 ]
  18.     then
  19.         echo "Warning: Failed to checkout $line" >&2
  20.     fi
  21. #    puppet --color=false --confdir=/etc/puppet --vardir=/var/lib/puppet --parseonly --ignoreimport $tmpfile >>/var/log/puppet/svn_pre-commit.log 2>&1
  22.     puppet --color=false --confdir=/etc/puppet --vardir=/var/lib/puppet --parser --ignoreimport $tmpfile >>/var/log/puppet/svn_pre-commit.log 2>&1
  23.     if [ $? -ne 0 ]
  24.     then
  25.         echo "Puppet syntax error in $line." >>/var/log/puppet/svn_pre-commit.log 2>&1
  26.         exit 2
  27.     fi
  28. done
  29. res=$?
  30. rm -f $tmpfile
  31. if [ $res -ne 0 ]
  32. then
  33.     exit $res
  34. fi

4.2 设置post-commit

设置post-commit钩子可以在正确提交文件至SVN服务器之后，puppetmaster的模块目录/etc/puppet/environments/testing会自动从SNV服务器上update最新的版本库到本地。

  1. #!/bin/sh
  2. # POST-COMMIT HOOK
  3. REPOS="$1"
  4. REV="$2"
  5. #mailer.py commit "$REPOS" "$REV" /path/to/mailer.conf
  6. export LANG=en_US.UTF-8
  7. SVN=/usr/bin/svn
  8. PUPPET_DIR=/etc/puppet
  9. #/usr/bin/svn  up /etc/puppet -non-interactive
  10. $SVN  update $PUPPET_DIR --username puppet --password 123.com >>/var/log/puppet/svn_post-commit.log

5 SVN Client端部署测试

5.1 本地测试

1）导出版本数据库文件到本地

  1. [root@puppetserver ~]# svn checkout file:///svndata/puppet  /puppet/puppet

2）、创建并添加新的目录及文件

  1. [root@puppetserver puppet]# svn add ssh

3）、将修改后的文件提交到SVN服务器，此时版本库版本加1

  1. [root@puppetserver .svn]# svn commit -m "add ssh modules" /puppet/puppet/*

5.2 远程测试（Linux）

  1. [root@agent1 svndata]#  svn checkout http://172.16.200.100/svndata/  /mnt/

5.3 客户端TortoiseSVN测试（Windows）

svn版本控制测试界面

svn版本控制测试界面