Chef集中管理工具实践之 (3) 自定义配置

目录结构
Chef集中管理工具实践之 (0) 什么是Chef
Chef集中管理工具实践之 (1) 环境部署
 Chef集中管理工具实践之 (2) 服务器配置
 Chef集中管理工具实践之 (3) 自定义配置

本文内容
Chef集中管理工具实践之 (3) 自定义配置

参考资料
http://wiki.opscode.com/display/chef/Resources#Resources-Service

环境介绍
OS: Ubuntu 10.10 Server 64-bit
Servers:
chef-server:10.6.1.170
chef-workstation:10.6.1.171
chef-client-1:10.6.1.172

1. 开始创造属于自己的大餐
“等我的手艺熟练之后我还会写我自己的菜色和菜谱，来创造属于我自己的大餐。” 在前面我提到过这句话，并且在上一个章节，也通过使用官方社区提供的cookbook完成了账号与openssh的配置。
在这一章，我们就来编写一个cookbook，将不同的自定义配置任务做成不同的recipe，最后实现对服务器的配置。

2. 如何开始
如何开始呢？使用官方社区的cookbook很简单，只需要修改attributes里面的参数就可以了，如果要自己来写，该怎么写用什么格式呢？
相信你一定有这个疑问存在。不过你可以尽管放心，Chef的官方社区有很完善的在线文档可供参考的。

上面提到的“参考资料”中的URL，就是对应的文档地址：http://wiki.opscode.com/display/chef/Resources#Resources-Service
具体内容很多，我们可以通过右侧的目录结构来理清思绪。

总共有差不多30个模块，每一个都有相应的示例。
最常用的有：
账号管理方面 Group,User
配置文件方面 Template,File,
脚本命令方面 Script,Execute
系统服务方面 Cron,Service,Mount,Package

这些模块的具体用法，都可以在上面的页面中找到，在这里我先就不描述了，接下来我们通过实践来理解它们。

3. 规划接下来要做的事情
以我的实际生产环境中遇到的情况为例，操作系统为Ubuntu,有以下几个任务要完成：
1.新建一个名为project的用户组，并将之前创建的用户ubuntu添加到该组
2.更改系统默认的APT镜像源为http://old-releases.ubuntu.com
3.通过apt-get安装build-essential
4.编译安装pcre 8.10

这一次，我们不再到官方社区去搜寻第三方的cookbook，而是自己来编写一个cookbook。

3.1 首先，来设计这个cookbook
将cookbook命名为mycookbook
然后分别创建4个不同的recipe，分别命名为
conf_group, conf_sources.list, install_build-essential, build_pcre
来实现对以上4个任务的完成

3.2 开始编写cookbook
3.2.1 创建cookbook
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook create mycookbook

 
** Creating cookbook mycookbook
** Creating README for cookbook: mycookbook
** Creating CHANGELOG for cookbook: mycookbook
** Creating metadata for cookbook: mycookbook

ubuntu@chef-workstation:/opt/chef-local$ cd cookbooks/mycookbook/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ ls

 
CHANGELOG.md  README.md  attributes  definitions  files  libraries  metadata.rb  providers  recipes  resources  templates

ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ cd recipes/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ls

 
default.rb

3.2.2 创建recipe conf_group
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_group.rb

 
group "project" do
  gid 999
  members [ 'ubuntu' ]
end

3.2.3 创建recipe conf_sources.list
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_sources.list.rb

 
execute "update" do
  command "sudo apt-get update"
  action :nothing
end

template "/etc/apt/sources.list" do
  source "sources.list.erb"
  mode 0644
  owner "root"
  group "root"
  notifies :run, "execute[update]", :immediately
end

ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../templates/default/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ sudo vim sources.list.erb

 
# Generated by Chef for <%= node['fqdn'] %>
deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse

3.2.4 创建recipe install_build-essential
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ cd ../../recipes/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim install_build-essential.rb

 
package "build-essential" do
  action :install
end

3.2.5 创建recipe build_pcre
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim build_pcre.rb

 
script "build_pcre" do
  interpreter "bash"
  user "root"
  cwd "/tmp"
  not_if "test -f /usr/local/bin/pcregrep"
  code <<-EOH
  wget http://nchc.dl.sourceforge.net/project/pcre/pcre/8.10/pcre-8.10.tar.gz
  tar zxvf pcre-8.10.tar.gz
  cd pcre-8.10
  ./configure
  make
  make install
  EOH
end

3.3 更新并应用编写的cookbook
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ll

 
total 28
drwxr-xr-x  2 root root 4096 Jan  6 18:30 ./
drwxr-xr-x 10 root root 4096 Jan  6 18:11 ../
-rw-r--r--  1 root root  305 Jan  6 18:30 build_pcre.rb
-rw-r--r--  1 root root   56 Jan  6 18:17 conf_group.rb
-rw-r--r--  1 root root  234 Jan  6 18:19 conf_sources.list.rb
-rw-r--r--  1 root root  136 Jan  6 18:11 default.rb
-rw-r--r--  1 root root   51 Jan  6 18:24 install_build-essential.rb

上传cookbook
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo knife cookbook upload mycookbook

 
Uploading mycookbook     [0.1.0]
Uploaded 1 cookbook.

查看当前role配置文件
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../../../roles/
ubuntu@chef-workstation:/opt/chef-local/roles$ ls

 
README.md  ubuntu_servers.rb

ubuntu@chef-workstation:/opt/chef-local/roles$ cat ubuntu_servers.rb

 
name "ubuntu_servers"
description "The base role applied to all nodes."
run_list(
    "recipe[user]",
    "recipe[user::data_bag]",
    "recipe[openssh]"
)
override_attributes(
    "users" => [ "ubuntu" ]
)

更新role配置文件
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu_servers.rb

 
name "ubuntu_servers"
description "The base role applied to all nodes."
run_list(
    "recipe[user]",
    "recipe[user::data_bag]",
    "recipe[openssh]",
    "recipe[mycookbook::conf_group]",
    "recipe[mycookbook::conf_sources.list]",
    "recipe[mycookbook::install_build-essential]",
    "recipe[mycookbook::build_pcre]"
)
override_attributes(
    "users" => [ "ubuntu" ]
)

上传role配置文件
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife role from file ubuntu_servers.rb

 
Updated Role ubuntu_servers!

查看节点
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node list

 
  chef-client-1
  chef-server

更新节点run_list
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node run_list add chef-client-1 "role[ubuntu_servers]"

 
run_list:  role[ubuntu_servers]

3.4 在节点上应用新的cookbook
ubuntu@chef-client-1:~$ sudo chef-client

 
INFO: *** Chef 10.16.2 ***
INFO: Run List is [role[ubuntu_servers]]
INFO: Run List expands to [user, user::data_bag, openssh, mycookbook::conf_group, mycookbook::conf_sources.list, mycookbook::install_build-essential, mycookbook::build_pcre]
INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs
INFO: Starting Chef Run for chef-client-1
INFO: Running start handlers
INFO: Start handlers complete.
INFO: Loading cookbooks [mycookbook, openssh, user]
INFO: Storing updated cookbooks/openssh/recipes/default.rb in the cache.
INFO: Storing updated cookbooks/openssh/attributes/default.rb in the cache.
INFO: Storing updated cookbooks/openssh/.gitignore in the cache.
INFO: Storing updated cookbooks/openssh/metadata.rb in the cache.
INFO: Storing updated cookbooks/openssh/README.md in the cache.
INFO: Storing updated cookbooks/openssh/LICENSE in the cache.
INFO: Storing updated cookbooks/openssh/CHANGELOG.md in the cache.
INFO: Storing updated cookbooks/openssh/metadata.json in the cache.
INFO: Storing updated cookbooks/openssh/Gemfile in the cache.
INFO: Storing updated cookbooks/openssh/CONTRIBUTING in the cache.
INFO: Storing updated cookbooks/user/resources/account.rb in the cache.
INFO: Storing updated cookbooks/user/providers/account.rb in the cache.
INFO: Storing updated cookbooks/user/recipes/data_bag.rb in the cache.
INFO: Storing updated cookbooks/user/recipes/default.rb in the cache.
INFO: Storing updated cookbooks/user/attributes/default.rb in the cache.
INFO: Storing updated cookbooks/user/Rakefile in the cache.
INFO: Storing updated cookbooks/user/CHANGELOG.md in the cache.
INFO: Storing updated cookbooks/user/README.md in the cache.
INFO: Storing updated cookbooks/user/metadata.rb in the cache.
INFO: Storing updated cookbooks/user/metadata.json in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/build_nginx.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/conf_group.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/conf_sources.list.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/default.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/install_build-essential.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/recipes/build_pcre.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/README.md in the cache.
INFO: Storing updated cookbooks/mycookbook/metadata.rb in the cache.
INFO: Storing updated cookbooks/mycookbook/CHANGELOG.md in the cache.
INFO: Processing user_account[ubuntu] action create (user::data_bag line 36)
INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
INFO: user[ubuntu] created
INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: directory[/home/ubuntu/.ssh] created directory /home/ubuntu/.ssh
INFO: directory[/home/ubuntu/.ssh] owner changed to 1001
INFO: directory[/home/ubuntu/.ssh] group changed to 109
INFO: directory[/home/ubuntu/.ssh] mode changed to 700
INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: directory[/home/ubuntu] mode changed to 2755
INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
INFO: template[/home/ubuntu/.ssh/authorized_keys] updated content
INFO: template[/home/ubuntu/.ssh/authorized_keys] owner changed to 1001
INFO: template[/home/ubuntu/.ssh/authorized_keys] group changed to 109
INFO: template[/home/ubuntu/.ssh/authorized_keys] mode changed to 600
INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94)
INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114)
INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130)
INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148)
INFO: Processing package[openssh-client] action install (openssh::default line 27)
INFO: Processing package[openssh-server] action install (openssh::default line 27)
INFO: Processing service[ssh] action enable (openssh::default line 30)
INFO: service[ssh] enabled
INFO: Processing service[ssh] action start (openssh::default line 30)
INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 48)
INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20130106190629
INFO: template[/etc/ssh/ssh_config] updated content
INFO: template[/etc/ssh/ssh_config] owner changed to 0
INFO: template[/etc/ssh/ssh_config] group changed to 0
INFO: template[/etc/ssh/ssh_config] mode changed to 644
INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 66)
INFO: template[/etc/ssh/sshd_config] backed up to /var/chef/backup/etc/ssh/sshd_config.chef-20130106190629
INFO: template[/etc/ssh/sshd_config] updated content
INFO: template[/etc/ssh/sshd_config] owner changed to 0
INFO: template[/etc/ssh/sshd_config] group changed to 0
INFO: template[/etc/ssh/sshd_config] mode changed to 644
INFO: Processing group[project] action create (mycookbook::conf_group line 1)
INFO: group[project] created
INFO: Processing execute[update] action nothing (mycookbook::conf_sources.list line 1)
INFO: Processing template[/etc/apt/sources.list] action create (mycookbook::conf_sources.list line 6)
INFO: template[/etc/apt/sources.list] backed up to /var/chef/backup/etc/apt/sources.list.chef-20130106190629
INFO: template[/etc/apt/sources.list] updated content
INFO: template[/etc/apt/sources.list] owner changed to 0
INFO: template[/etc/apt/sources.list] group changed to 0
INFO: template[/etc/apt/sources.list] mode changed to 644
INFO: template[/etc/apt/sources.list] sending run action to execute[update] (immediate)
INFO: Processing execute[update] action run (mycookbook::conf_sources.list line 1)
INFO: execute[update] ran successfully
INFO: Processing package[build-essential] action install (mycookbook::install_build-essential line 1)
INFO: Processing script[build_pcre] action run (mycookbook::build_pcre line 1)
INFO: script[build_pcre] ran successfully
INFO: template[/etc/ssh/sshd_config] sending restart action to service[ssh] (delayed)
INFO: Processing service[ssh] action restart (openssh::default line 30)
INFO: service[ssh] restarted
INFO: Chef Run complete in 448.775004685 seconds
INFO: Running report handlers
INFO: Report handlers complete

ubuntu@chef-client-1:/etc$

通过以上输出，我们可以很清晰的看到每个recipe的执行过程，并且全部都成功执行了。

我们通过以下方式来一一校验:
ubuntu@chef-client-1:~$ id ubuntu

 
uid=1001(ubuntu) gid=109(admin) groups=109(admin),999(project)

ubuntu@chef-client-1:~$ cat /etc/apt/sources.list

 
# Generated by Chef for chef-client-1
deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse
deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse

ubuntu@chef-client-1:~$ dpkg -l | grep build-essential

 
ii  build-essential                 11.5                              Informational list of build-essential packages

ubuntu@chef-client-1:~$ which pcregrep

 
/usr/local/bin/pcregrep

通过以上校验，再次证明所有的任务都已经执行了。
我们成功的完成了cookbook的自定义配置。

4. 更多深入的功能
至此，我们已经具备了一定的编写cookbook的能力了。
下面我分享一些比较有价值的经验：

4.1 安装官方社区的cookbook chef-client 可以实现客户端的定时自动拉取服务端配置，默认30分钟一次，具体时间可配置
Tips:
---
$ sudo knife cookbook site install chef-client

通过以下方式引用：

 
    "recipe[chef-client::delete_validation]",
    "recipe[chef-client::config]",
    "recipe[chef-client::service]",

4.2 改造cookbook openssh
Tips:
---
直接将系统的/etc/ssh/sshd_config 复制成为模板文件sshd_config.erb
然后仅将需要自定义的参数修改为从attributes中读取，如：

 
PasswordAuthentication <%= node['openssh']['server']['password_authentication'] %>
UseDNS <%= node['openssh']['server']['use_dns'] %>

同样，我们也可以自己来写attributes文件，实现参数的功能。

4.3 在role文件中重新定义参数值
Tips:
---
通过override_attributes可以直接定义参数的值，实现不同role采用不同的参数。
例如，针对官方社区的sudo的配置，可以通过以下方式重新定义参数的值：

默认的参数值：

 
default['authorization']['sudo']['groups'] = Array.new
default['authorization']['sudo']['users'] = Array.new
default['authorization']['sudo']['passwordless'] = false
default['authorization']['sudo']['include_sudoers_d'] = false
default['authorization']['sudo']['agent_forwarding'] = false

在role文件中重新定义后的值：

 
override_attributes(
    "authorization" => {
      "sudo" => {
        "groups" => ["admin"],
        "passwordless" => true,
        "users" => ["zabbix"]
      }
    }
)

5. 至此，整个系列的文章可以告一段落了
用一句很2的话来说，就是，我只能帮你到这儿了。接下来，通过参考官方文档，以及实践中的更多应用，我们就能够更加熟练的掌握Chef这个强大的集中管理工具，再多的服务器在我们的手里也能管理的井然有序。

Chef, DevOps, 集中管理

Hey! Linux.

Chef集中管理工具实践之 (3) 自定义配置

标签云(Tags)

近期评论(Recent Comments)

新浪微博(Sina Weibo)

友情链接(Blogroll)

文章归档(Archives)

功能(Meta)

网站安全监测(Webscan)

美国时间(US Time)

Google +1 (Plusone Button)

广告(Google Adsense)