puppet 使用Apache+passenger
李兴庆
很多同学喜欢使用ruby自带的webrick webserver来启动puppetmaster服务，因为简单方便。例如：
service puppetmaster start
首先，你要明白一点的是这些语言的内置webserver目的仅是为了方便调试代码，是根本不能放到生产环境去使用。
使用WebRick运行的Puppetmaster性能有多差？
仅9个并发请求就能把它拖垮。
我在在一台E5 2620的服务器上试验：只要9个puppet agent同时向运行在webrick上的puppet master发送请求，就处理不过来了，你会发现总有某台agent会出现40x Error的错误。
要提高单台Puppetmaster的性能很简单，只要使用常见的Web Server软件就可以显著地提高Puppet master的性能，例如Apache,Nginx等。这类文档很多，这里就不再详细说明配置的步骤了。
下面改用Apache http 作为puppetmaster的监听服务器
前提需求：
Puppet Master 默认启动在 TCP 8140 端口，这实际上是 WEBrick 在 8140 启动的一个简单的 WEB SERVER。
我们要做的就是使用 Apache + Passenger 来代替默认的 WEBrick。
首先，确认你的 Puppet Master 至少曾经成功的启动过一次。
这主要是保证 Puppet Master 已经正确的签署了安全证书等文件，为后面的 SSL 认证提供基础。
# Download apache and necessary dependencies
yum install -y httpd httpd-devel mod_ssl ruby-devel rubygems gcc-c++ curl-devel zlib-devel make automake
yum install mod_passenger rubygem-rake.noarch
1.安装必备的软件
2.修改配置文件
多了一个passenger.conf
增加一个puppetmaster_01.conf 监听8140
内容
3.启动http监听，关闭puppetmaster
以上搞定了。测试下
因为之前已经搞定了 ssl的握手验证，所以先来测试下推送文件 是否OK
test1.
puppetmaster上的一个site.pp文件
agent 144 端：
推送文件测试完毕。
验证测试：
服务端操作 test.145
客户端操作test.144
以上两步操作，把信任关系干掉了。
然后启动 test.144 ,同时会向master发起ssl验证
master 端 test.155 查看
目前成功的从puppetmaster自带的server 迁移到Apache上来了，并发可以承受住了。
当然下个目标可以使
1.Apache配置多个vhost ，这样的话一台机器上可以配置多个实例（很简单）
update 2:
service puppetmaster start
首先，你要明白一点的是这些语言的内置webserver目的仅是为了方便调试代码，是根本不能放到生产环境去使用。
使用WebRick运行的Puppetmaster性能有多差？
仅9个并发请求就能把它拖垮。
我在在一台E5 2620的服务器上试验：只要9个puppet agent同时向运行在webrick上的puppet master发送请求，就处理不过来了，你会发现总有某台agent会出现40x Error的错误。
要提高单台Puppetmaster的性能很简单，只要使用常见的Web Server软件就可以显著地提高Puppet master的性能，例如Apache,Nginx等。这类文档很多，这里就不再详细说明配置的步骤了。
下面改用Apache http 作为puppetmaster的监听服务器
前提需求：
Puppet Master 默认启动在 TCP 8140 端口，这实际上是 WEBrick 在 8140 启动的一个简单的 WEB SERVER。
我们要做的就是使用 Apache + Passenger 来代替默认的 WEBrick。
首先，确认你的 Puppet Master 至少曾经成功的启动过一次。
这主要是保证 Puppet Master 已经正确的签署了安全证书等文件，为后面的 SSL 认证提供基础。
# Download apache and necessary dependencies
yum install -y httpd httpd-devel mod_ssl ruby-devel rubygems gcc-c++ curl-devel zlib-devel make automake
yum install mod_passenger rubygem-rake.noarch
1.安装必备的软件
[root@test conf.d]# yum install mod_passenger rubygem-rake.noarch
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
省略
Installed:
mod_passenger.x86_64 0:4.0.18-9.6.el6 rubygem-rake.noarch 0:0.8.7-2.1.el6
Dependency Installed:
rubygem-passenger.x86_64 0:4.0.18-9.6.el6 rubygem-passenger-native.x86_64 0:4.0.18-9.6.el6
rubygem-passenger-native-libs.x86_64 0:4.0.18-9.6.el6
Complete!
[root@test conf.d]#2.修改配置文件
[root@test conf.d]# ll /etc/httpd/conf.d/
total 32
-rw-r--r--. 1 root root 807 Nov 13 18:27 passenger.conf
-rw-r--r--. 1 root root 674 Sep 30 13:59 php.conf
-rw-r--r--. 1 root root 392 Apr 4 2014 README
-rw-r--r--. 1 root root 9473 Mar 20 2014 ssl.conf
-rw-r--r--. 1 root root 299 Mar 20 2014 welcome.conf
-rw-r--r--. 1 root root 1116 Aug 28 14:56 zabbix.conf
[root@test conf.d]# 多了一个passenger.conf
增加一个puppetmaster_01.conf 监听8140
内容
[root@test conf.d]# cat puppetmaster_01.conf
#很多目录需要自己创建
Listen 8140
<VirtualHost *:8140>
SSLEngine On
# Only allow high security cryptography. Alter if needed for compatibility.
SSLProtocol All -SSLv2
SSLCipherSuite HIGH:!ADH:RC4+RSA:-MEDIUM:-LOW:-EXP
SSLCertificateFile /var/lib/puppet/ssl/certs/test.145.pem
SSLCertificateKeyFile /var/lib/puppet/ssl/private_keys/test.145.pem
SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCACertificateFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVars +ExportCertData
# These request headers are used to pass the client certificate
# authentication information on to the puppet master process
RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
#puppet 2.7.x 开启会报错
#RackAutoDetect On
DocumentRoot /etc/puppet/rack/puppetmaster/public/
<Directory /etc/puppet/rack/puppetmaster/ >
Options None
AllowOverride None
Order Allow,Deny
Allow from All
</Directory>
</VirtualHost>
[root@test conf.d]# 3.启动http监听，关闭puppetmaster
[root@test conf.d]# /etc/init.d/puppetmaster stop
Stopping puppetmaster: [ OK ]
[root@test conf.d]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
[root@test conf.d]# netstat -ltp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 test.145:6379 *:* LISTEN 5992/redis-server
tcp 0 0 *:35824 *:* LISTEN 26345/beam
tcp 0 0 *:epmd *:* LISTEN 2294/epmd
tcp 0 0 *:ssh *:* LISTEN 1066/sshd
tcp 0 0 localhost:ipp *:* LISTEN 1032/cupsd
tcp 0 0 test.145:ddi-tcp-1 *:* LISTEN 22921/./bin/mongod
tcp 0 0 *:zabbix-trapper *:* LISTEN 5612/zabbix_server
tcp 0 0 *:mysql *:* LISTEN 5860/mysqld
tcp 0 0 *:8140 *:* LISTEN 31224/httpd
tcp 0 0 *:http *:* LISTEN 31224/httpd
tcp 0 0 *:ssh *:* LISTEN 1066/sshd
tcp 0 0 ::1:ipp *:* LISTEN 1032/cupsd
tcp 0 0 *:https *:* LISTEN 31224/httpd
tcp 0 0 *:zabbix-trapper *:* LISTEN 5612/zabbix_server
tcp 0 0 *:amqp *:* LISTEN 26345/beam
[root@test conf.d]# netstat -ltnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 10.210.71.145:6379 0.0.0.0:* LISTEN 5992/redis-server
tcp 0 0 0.0.0.0:35824 0.0.0.0:* LISTEN 26345/beam
tcp 0 0 0.0.0.0:4369 0.0.0.0:* LISTEN 2294/epmd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1066/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1032/cupsd
tcp 0 0 10.210.71.145:8888 0.0.0.0:* LISTEN 22921/./bin/mongod
tcp 0 0 0.0.0.0:10051 0.0.0.0:* LISTEN 5612/zabbix_server
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 5860/mysqld
tcp 0 0 :::8140 :::* LISTEN 31224/httpd
tcp 0 0 :::80 :::* LISTEN 31224/httpd
tcp 0 0 :::22 :::* LISTEN 1066/sshd
tcp 0 0 ::1:631 :::* LISTEN 1032/cupsd
tcp 0 0 :::443 :::* LISTEN 31224/httpd
tcp 0 0 :::10051 :::* LISTEN 5612/zabbix_server
tcp 0 0 :::5672 :::* LISTEN 26345/beam
[root@test conf.d]#以上搞定了。测试下
因为之前已经搞定了 ssl的握手验证，所以先来测试下推送文件 是否OK
test1.
puppetmaster上的一个site.pp文件
[root@test conf.d]# cat /etc/puppet/manifests/site.pp
node default {
file {
"/tmp/hello_puppet":
content=>"hello_puppet nice to meet you,come from apache\n";
}
}
[root@test conf.d]# hostname
test.145
[root@test conf.d]# agent 144 端：
[root@test ~]# puppetd --test
notice: Ignoring --listen on onetime run
info: Caching catalog for test.144
info: Applying configuration version '1417611731'
notice: /Stage[main]//Node[default]/File[/tmp/hello_puppet]/content:
--- /tmp/hello_puppet 2014-12-03 15:24:45.048201779 +0800
+++ /tmp/puppet-file20141203-13556-49sc5r-0 2014-12-03 21:02:12.653200583 +0800
@@ -1 +1 @@
-hello_puppet nice to meet you
\ No newline at end of file
+hello_puppet nice to meet you,come from apache
info: FileBucket adding {md5}6152d048657a8a30d6894b3a6f164657
info: /Stage[main]//Node[default]/File[/tmp/hello_puppet]: Filebucketed /tmp/hello_puppet to puppet with sum 6152d048657a8a30d6894b3a6f164657
notice: /Stage[main]//Node[default]/File[/tmp/hello_puppet]/content: content changed '{md5}6152d048657a8a30d6894b3a6f164657' to '{md5}918e67eed208f028b587e70fb21949ed'
notice: Finished catalog run in 0.17 seconds
[root@test ~]# cat /tmp/hello_puppet
hello_puppet nice to meet you,come from apache
[root@test ~]# hostname
test.144
[root@test ~]#推送文件测试完毕。
验证测试：
服务端操作 test.145
[root@test conf.d]# cd /var/lib/puppet/ssl/ca/signed/
[root@test signed]# ll
total 8
-rw-r-----. 1 puppet puppet 1891 Dec 3 15:10 test.143.pem
-rw-r-----. 1 puppet puppet 1891 Dec 3 20:35 test.144.pem
[root@test signed]# rm -rf test.144.pem
[root@test signed]# pwd
/var/lib/puppet/ssl/ca/signed
[root@test signed]# ll
total 4
-rw-r-----. 1 puppet puppet 1891 Dec 3 15:10 test.143.pem
[root@test signed]#
客户端操作test.144
[root@test puppet]# pwd
/etc/puppet
[root@test puppet]# cd /var/lib/puppet/
[root@test puppet]# ll
total 32
-rw-r----- 1 root root 17 Dec 3 21:02 classes.txt
drwxr-x--- 3 root root 4096 Dec 3 21:02 clientbucket
drwxr-x--- 2 root root 4096 Dec 3 20:35 client_data
drwxr-x--- 3 root root 4096 Dec 3 20:35 client_yaml
drwxr-xr-x 2 root root 4096 Dec 3 20:35 facts
drwxr-xr-x 2 root root 4096 Dec 3 20:35 lib
drwxrwx--x 7 puppet root 4096 Dec 3 20:35 ssl
drwxr-xr-t 3 root root 4096 Dec 3 21:02 state
[root@test puppet]# /etc/init.d/puppet stop
Stopping puppet: [ OK ]
[root@test puppet]# rm -rf *
[root@test puppet]# pwd
/var/lib/puppet
[root@test puppet]# hostname
test.144
[root@test puppet]#以上两步操作，把信任关系干掉了。
然后启动 test.144 ,同时会向master发起ssl验证
[root@test puppet]# hostname
test.144
[root@test puppet]# /etc/init.d/puppet start
Starting puppet: [ OK ]
[root@test puppet]# ll
total 28
drwxr-x--- 2 root root 4096 Dec 4 10:48 clientbucket
drwxr-x--- 2 root root 4096 Dec 4 10:48 client_data
drwxr-x--- 2 root root 4096 Dec 4 10:48 client_yaml
drwxr-xr-x 2 root root 4096 Dec 4 10:48 facts
drwxr-xr-x 2 root root 4096 Dec 4 10:48 lib
drwxrwx--x 7 puppet root 4096 Dec 4 10:48 ssl
drwxr-xr-t 3 root root 4096 Dec 4 10:48 state
master 端 test.155 查看
[root@test signed]# puppetca --list --all
"test.144" (7C:14:91:F7:D7:5A:5B:6B:F2:2B:CE:16:C3:C6:02:E0)
+ "test.143" (D9:D5:89:D3:32:2C:CB:9D:50:F5:24:60:97:F5:C7:D7)
[root@test signed]# puppetca -s -a
notice: Signed certificate request for test.144
notice: Removing file Puppet::SSL::CertificateRequest test.144 at '/var/lib/puppet/ssl/ca/requests/test.144.pem'
[root@test signed]# puppetca --list --all
+ "test.143" (D9:D5:89:D3:32:2C:CB:9D:50:F5:24:60:97:F5:C7:D7)
+ "test.144" (D7:D4:F0:DD:C9:3E:A2:C6:3A:57:65:A7:3F:14:E6:3B)
[root@test signed]#
OK 目前ssl 握手也是完成了。
目前成功的从puppetmaster自带的server 迁移到Apache上来了，并发可以承受住了。
当然下个目标可以使
1.Apache配置多个vhost ，这样的话一台机器上可以配置多个实例（很简单）
2.前端配置nginx做负载，后端配置多个Apache。（后续会有相关文章）
-----------------------update--------------------------------
568 yum install httpd httpd-devel mod_ssl ruby-devel rubygems gcc
569 yum install mod_passenger rubygem-rake.noarch
570 history
571 sudo curl --fail -sSLo /etc/yum.repos.d/passenger.repo https://oss-binaries.phusionpassenger.com/yum/definitions/el-passenger.repo
572 yum install mod_passenger rubygem-rake.noarch
573 cd /etc/httpd/
574 ll
575 cd conf.d/
576 ll
577 cp passenger.conf passenger_01.conf
578 cat passenger_01.conf
579 ll
580 >passenger_01.conf
581 vim passenger_01.conf
582 ll /etc/puppet/rack/puppetmaster/public/
583 sudo mkdir -p /usr/share/puppet/rack/puppetmasterd
584 sudo mkdir /usr/share/puppet/rack/puppetmasterd/public /usr/share/puppet/rack/puppetmasterd/tmp
585 sudo cp /usr/share/puppet/ext/rack/config.ru /usr/share/puppet/rack/puppetmasterd/
586 sudo chown puppet:puppet /usr/share/puppet/rack/puppetmasterd/config.ru
587 vim passenger_01.conf
588 /etc/init.d/puppetmaster stop
589 /etc/init.d/httpd restart
590 vim /etc/httpd/conf.d/passenger_01.conf +1
591 /etc/init.d/httpd restart
592 vim /etc/httpd/conf.d/passenger_01.conf +1
593 /etc/init.d/httpd restart
594 /etc/init.d/nginx stop
595 /etc/init.d/httpd restart
596 netstat -lntp
597 netstat -ltp
598 history
599 puppet kick -d --host hadoop00
600 cd /etc/puppet/modules/apache/manifests/
601 ll
602 vim service.pp
603 puppet kick -d --host hadoop00update 2:
[root@hadoop01 manifests]# cat /etc/httpd/conf.d/passenger_01.conf
Listen 8140
<VirtualHost *:8140>
SSLEngine On
# Only allow high security cryptography. Alter if needed for compatibility.
SSLProtocol All -SSLv2
SSLCipherSuite HIGH:!ADH:RC4+RSA:-MEDIUM:-LOW:-EXP
SSLCertificateFile /var/lib/puppet/ssl/certs/hadoop01.pem
SSLCertificateKeyFile /var/lib/puppet/ssl/private_keys/hadoop01.pem
SSLCertificateChainFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCACertificateFile /var/lib/puppet/ssl/ca/ca_crt.pem
SSLCARevocationFile /var/lib/puppet/ssl/ca/ca_crl.pem
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVars +ExportCertData
# These request headers are used to pass the client certificate
# authentication information on to the puppet master process
RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
#puppet 2.7.x 开启会报错
#RackAutoDetect On
#DocumentRoot /etc/puppet/rack/puppetmaster/public/
DocumentRoot /usr/share/puppet/rack/puppetmasterd/public/
<Directory /usr/share/puppet/rack/puppetmasterd/ >
Options None
AllowOverride None
Order Allow,Deny
Allow from All
</Directory>
</VirtualHost>
[root@hadoop01 manifests]#
参考链接 ：
http://www.cnblogs.com/yuxc/p/3916726.html
http://www.6tech.org/2013/01/how-to-install-puppet-open-source-on-centos-6-3/
类似资料：