日均百万PV架构第五弹(运维自动化)
概念: puppet基于ruby的开源自动化部署工具 具有可测试性,强一致性部署体验 丰富资源定义完成系统配置全周期流程 内置丰富编程体验完成自主任务 资源标识与通知机制特性 puttet服务器端定义客户端节点所需资源类型,客户端加入部署环境后, 客户端凭借主机名等申请(https)对应服务器资源,服务器编译catelog 后将结果返回客户端,客户端利用这些信息完成系统资源的定义与处理, 并返回结果给服务器. 规划: 172.16.43.200 master.king.com (预装 puppet server) 172.16.43.1 slave1.king.com (预装 puppet agent再无其他资源) 按照之前架构,这次演示slave1.king.com的自动化安装,其他节点的安装配置以附件形式上传 针对slave1.king.com部署实现 -> puppet agent 软件(由cobbler预装) -> hosts 文件(puppet自动化) -> bind 软件及配置文件(puppet自动化) -> haproxy 软件及配置文件(puppet自动化) -> keepalived 软件及配置文件 本地测试阶段(master.king.com) 在master节点编写模块,测试通过后进行主从方式的配置 1 2 #安装puppet yum-y install puppet-2.7.23-1.el6.noarch.rpm 1.在/etc/puppet目录建立如下目录 1 2 mkdir /etc/puppet/manifest/ {haproxy,hosts,keepalived,named}/{files,manifests,templates}-pv mkdir /etc/puppet/modules 2.编辑/etc/puupet/manifests/hosts/files/hosts(host) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 #若要部署成前四节的架构,这里需要把每一个点都自动化所以配置文件及其对应的软件都要安装配置 127.0.0.1localhostlocalhost.localdomainlocalhost4localhost4.localdomain4 ::1localhostlocalhost.localdomainlocalhost6localhost6.localdomain6 172.16.43.1slave1.king.com 172.16.43.2slave2.king.com 172.16.43.3slave3.king.com 172.16.43.4slave4.king.com 172.16.43.3imgs1.king.com 172.16.43.3imgs2.king.com 172.16.43.3text1.king.com 172.16.43.3text2.king.com 172.16.43.3dynamic1.king.com 172.16.43.4dynamic2.king.com 172.16.43.200master.king.com 172.16.43.6server.king.com 172.16.43.5proxy.king.com 编辑/etc/puupet/manifests/hosts/files/init.pp, 这是hosts的模块定义 1 2 3 4 5 6 7 8 9 10 11 12 #hosts的init.pp #自动定义资源模块名为hosts #hosts不需要安装软件仅仅是将hosts文件在master/slave模型下复制到slave的某目录中 #所以这里定义的资源类型只有file classhosts{ file { "hosts" : ensure=> file , source => "puppet:///modules/hosts/hosts" , path=> "/etc/hosts" } } 3. 之后配置都如(2)类型配置,代码文件分别为配置文件和模块定义文件(named) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 // named.conf options{ // listen-onport53{127.0.0.1;}; // listen-on-v6port53{::1;}; directory "/var/named" ; dump- file "/var/named/data/cache_dump.db" ; statistics- file "/var/named/data/named_stats.txt" ; // memstatistics- file "/var/named/data/named_mem_stats.txt" ; allow-query{172.16.0.0 /16 ;}; recursion yes ; dnssec- enable yes ; dnssec-validation yes ; dnssec-lookasideauto; /*PathtoISCDLVkey*/ bindkeys- file "/etc/named.iscdlv.key" ; managed-keys-directory "/var/named/dynamic" ; }; logging{ channeldefault_debug{ file "data/named.run" ; severitydynamic; }; }; zone "." IN{ type hint; file "named.ca" ; }; include "/etc/named.rfc1912.zones" ; 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 // named.rfc1912.zones: zone "localhost.localdomain" IN{ type master; file "named.localhost" ; allow-update{none;}; }; zone "localhost" IN{ type master; file "named.localhost" ; allow-update{none;}; }; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN{ type master; file "named.loopback" ; allow-update{none;}; }; zone "1.0.0.127.in-addr.arpa" IN{ type master; file "named.loopback" ; allow-update{none;}; }; zone "0.in-addr.arpa" IN{ type master; file "named.empty" ; allow-update{none;}; }; zone "king.com" IN{ type master; file "king.com.zone" ; }; 1 2 3 4 5 6 7 8 9 10 11 12 13 #king.com.zone $TTL600 @INSOAdns.king.com.adminmail.king.com.( 2014050401 1H 5M 3D 12H) INNSdns dnsINA172.16.43.1 wwwINA172.16.43.88 wwwINA172.16.43.188 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 #named的init.pp #定义模块named,dns软件报名为bind,所以package是安装bind软件借助yum源 classnamed{ package{ "bind" : ensure=>present, name=> "bind" , provider=>yum, } #named软件要运行起来需要配置区域文件并且要求改变属主属组 file { "/etc/named.conf" : ensure=> file , require=>Package[ "bind" ], source => "puppet:///modules/named/named.conf" , owner=>named, group=>named, } file { "/etc/named.rfc1912.zones" : ensure=> file , require=>Package[ "bind" ], source => "puppet:///modules/named/named.rfc1912.zones" , owner=>named, group=>named, } file { "/var/named/king.com.zone" : ensure=> file , require=>Package[ "bind" ], source => "puppet:///modules/named/king.com.zone" , owner=>named, group=>named, } #bind软件在package安装了之后,需要启动并设置开启启动,但前提是package已经帮我们装好的bind软件 service{ "named" : ensure=> true , require=>Package[ "bind" ], enable => true , } } 4. haproxy的配置 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 #/etc/haproxy/haproxy.cfg global log127.0.0.1local2 chroot /var/lib/haproxy pidfile /var/run/haproxy .pid maxconn4000 userhaproxy grouphaproxy daemon defaults modehttp logglobal optionhttplog optiondontlognull optionhttp-server-close optionforwardforexcept127.0.0.0 /8 optionredispatch retries3 timeouthttp-request10s timeoutqueue1m timeoutconnect10s timeoutclient1m timeoutserver1m timeouthttp-keep-alive10s timeoutcheck10s maxconn30000 listenstats modehttp bind0.0.0.0:8080 stats enable statshide-version statsuri /haproxyadmin ?stats statsrealmHaproxy\Statistics statsauthadmin:admin statsadmin if TRUE frontendhttp- in bind*:80 modehttp logglobal optionhttpclose optionlogasap optiondontlognull capturerequestheaderHostlen20 capturerequestheaderRefererlen60 aclimg_staticpath_beg-i /images /imgs aclimg_staticpath_end-i.jpg.jpeg.gif.png acltext_staticpath_beg-i/ /static /js /css acltext_staticpath_end-i.html.shtml.js.css use_backendimg_servers if img_static use_backendtext_servers if text_static default_backenddynamic_servers backendimg_servers balanceroundrobin serverimgsrv1imgs1.king.com:6081checkmaxconn4000 serverimgsrv2imgs2.king.com:6081checkmaxconn4000 backendtext_servers balanceroundrobin servertextsrv1text1.king.com:6081checkmaxconn4000 servertextsrv2text2.king.com:6081checkmaxconn4000 backenddynamic_servers balanceroundrobin serverwebsrv1dynamic1.king.com:80checkmaxconn1000 serverwebsrv2dynamic2.king.com:80checkmaxconn1000 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 #haproxy的init.pp classhaproxy{ package{ "haproxy" : ensure=>present, name=> "haproxy" , provider=>yum, } file { "/etc/haproxy/haproxy.cfg" : ensure=> file , require=>Package[ "haproxy" ], source => "puppet:///modules/haproxy/haproxy.cfg" , } service{ "haproxy" : ensure=> true , require=>Package[ "haproxy" ], enable => true , } } 5. keepalived的配置 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 #/etc/keepalived/keepalived.conf global_defs{ notification_email{ root@localhost } notification_email_fromkeepadmin@localhost smtp_connect_timeout3 smtp_server127.0.0.1 router_idLVS_DEVEL_KING } vrrp_scriptchk_haproxy{ script "/etc/keepalived/chk_haproxy.sh" interval2 weight2 } vrrp_instanceVI_1{ interfaceeth0 stateMASTER #BACKUPforslaverouters priority100 #99forBACKUP virtual_router_id173 garp_master_delay1 authentication{ auth_typePASS auth_passking1 } track_interface{ eth0 } virtual_ipaddress{ 172.16.43.88 /16 deveth0 } track_script{ chk_haproxy } } vrrp_instanceVI_2{ interfaceeth0 stateBACKUP #masterforslaverouters priority99 #99formaster virtual_router_id174 garp_master_delay1 authentication{ auth_typePASS auth_passking2 } track_interface{ eth0 } virtual_ipaddress{ 172.16.43.188 /16 deveth0 } } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 #keepalived的init.pp classkeepalived{ package{ "keepalived" : ensure=>present, name=> "keepalived" , provider=>yum, } file { "/etc/keepalived/keepalived.conf" : ensure=> file , require=>Package[ "keepalived" ], source => "puppet:///modules/keepalived/keepalived.conf" , notify=>Exec[ "reload" ], } service{ "keepalived" : ensure=> true , require=>Package[ "keepalived" ], enable => true , } exec { "reload" : command => "/usr/sbin/keepalivedreload" , subscribe=>File[ "/etc/keepalived/keepalived.conf" ], path=> "/bin:/sbin:/usr/bin:/usr/sbin" , refresh=> "/usr/sbin/keepalivedreload" , } } 6. 一切定义完毕进入测试 # 首先所有的包都没有安装 # 使用puppet apply -e 命令在master节点测试安装hosts模块前后 /etc/hosts 文件的变化情况 # 其余模块一次测试 , # 观察keepalived的启动效果,在配置文件中定义的vrrp已经出现 # 观察服务端口是否均已启动 # 本地测试没有异常的情况下,现在考虑将slave1.king.com之前内容情况后,利用puppet自动化部署slave1.king.com节点所需的软件和配置 master/slave测试 puppet master: 1, 安装puppet-server并配置,启动服务 yum -y install puppet-server-2.7.23-1.el6.noarch.rpm puppet master --genconfig >> /etc/puppet/puppet.conf service puppetmaster start puppet agent: 1、安装puppet客户端并配置,启动服务 yum -y install puppet-2.7.23-1.el6.noarch.rpm vim /etc/puppet/puppet.conf，在[agent]中添加server=master.king.com service puppet start # 在master/slave服务启动后,slave1节点会发出请求查询,master会从site.pp文件中查找slave1.king.com该装什么模块 1 2 3 4 5 6 7 8 9 10 11 #/etc/puppet/modules/site.pp #这里就是表示slave1将安装named,keepalived,haproxy,hosts等文件 #当然之前写过的模块还有这里的节点都可以按照面向对象编程里的class一样 #带有继承关系的 node 'slave1.king.com' { includenamed includekeepalived includehaproxy includehosts } #在master/slave服务启动后,agent会根据配置文件中server的位置发起调用安装配置的请求,这才服务器需要将请求签证 # 已达到安全传输的目的 签署证书： master: puppet cert list # 查看所有的客户端的签证请求 puppet cert sign --all # 签署所有请求,那么客户端与服务器就可以进行交互了 # 在稍等片刻后,这些节点将被自动的在slave1.king.com上完成部署,当然也可以手动进行 1 2 #slave1.king.com puppetagent-t # 手动去请求服务器应用完毕的结果 # 部署完毕后vrrp节点信息,此时仅仅部署了一个slave1节点,所以会有两个vrrp的ip地址,详见keepalived的配置文件 # slave1上自动部署完成后的服务端口信息 本文转自My_King1 51CTO博客，原文链接：http://blog.51cto.com/apprentice/1415003，如需转载请自行联系原作者
