目录结构
Chef集中管理工具实践之 (0) 什么是Chef
Chef集中管理工具实践之 (1) 环境部署
Chef集中管理工具实践之 (2) 服务器配置
Chef集中管理工具实践之 (3) 自定义配置
本文内容
Chef集中管理工具实践之 (3) 自定义配置
参考资料
http://wiki.opscode.com/display/chef/Resources#Resources-Service
环境介绍
OS: Ubuntu 10.10 Server 64-bit
Servers:
chef-server:10.6.1.170
chef-workstation:10.6.1.171
chef-client-1:10.6.1.172
1. 开始创造属于自己的大餐
“等我的手艺熟练之后我还会写我自己的菜色和菜谱,来创造属于我自己的大餐。” 在前面我提到过这句话,并且在上一个章节,也通过使用官方社区提供的cookbook完成了账号与openssh的配置。
在这一章,我们就来编写一个cookbook,将不同的自定义配置任务做成不同的recipe,最后实现对服务器的配置。
2. 如何开始
如何开始呢?使用官方社区的cookbook很简单,只需要修改attributes里面的参数就可以了,如果要自己来写,该怎么写用什么格式呢?
相信你一定有这个疑问存在。不过你可以尽管放心,Chef的官方社区有很完善的在线文档可供参考的。
上面提到的“参考资料”中的URL,就是对应的文档地址:http://wiki.opscode.com/display/chef/Resources#Resources-Service
具体内容很多,我们可以通过右侧的目录结构来理清思绪。
总共有差不多30个模块,每一个都有相应的示例。
最常用的有:
账号管理方面 Group,User
配置文件方面 Template,File,
脚本命令方面 Script,Execute
系统服务方面 Cron,Service,Mount,Package
这些模块的具体用法,都可以在上面的页面中找到,在这里我先就不描述了,接下来我们通过实践来理解它们。
3. 规划接下来要做的事情
以我的实际生产环境中遇到的情况为例,操作系统为Ubuntu,有以下几个任务要完成:
1.新建一个名为project的用户组,并将之前创建的用户ubuntu添加到该组
2.更改系统默认的APT镜像源为http://old-releases.ubuntu.com
3.通过apt-get安装build-essential
4.编译安装pcre 8.10
这一次,我们不再到官方社区去搜寻第三方的cookbook,而是自己来编写一个cookbook。
3.1 首先,来设计这个cookbook
将cookbook命名为mycookbook
然后分别创建4个不同的recipe,分别命名为
conf_group, conf_sources.list, install_build-essential, build_pcre
来实现对以上4个任务的完成
3.2 开始编写cookbook
3.2.1 创建cookbook
ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook create mycookbook
** Creating cookbook mycookbook ** Creating README for cookbook: mycookbook ** Creating CHANGELOG for cookbook: mycookbook ** Creating metadata for cookbook: mycookbook
ubuntu@chef-workstation:/opt/chef-local$ cd cookbooks/mycookbook/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ ls
CHANGELOG.md README.md attributes definitions files libraries metadata.rb providers recipes resources templates
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ cd recipes/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ls
default.rb
3.2.2 创建recipe conf_group
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_group.rb
group "project" do gid 999 members [ 'ubuntu' ] end
3.2.3 创建recipe conf_sources.list
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_sources.list.rb
execute "update" do command "sudo apt-get update" action :nothing end template "/etc/apt/sources.list" do source "sources.list.erb" mode 0644 owner "root" group "root" notifies :run, "execute[update]", :immediately end
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../templates/default/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ sudo vim sources.list.erb
# Generated by Chef for <%= node['fqdn'] %> deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
3.2.4 创建recipe install_build-essential
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ cd ../../recipes/
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim install_build-essential.rb
package "build-essential" do action :install end
3.2.5 创建recipe build_pcre
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim build_pcre.rb
script "build_pcre" do interpreter "bash" user "root" cwd "/tmp" not_if "test -f /usr/local/bin/pcregrep" code <<-EOH wget http://nchc.dl.sourceforge.net/project/pcre/pcre/8.10/pcre-8.10.tar.gz tar zxvf pcre-8.10.tar.gz cd pcre-8.10 ./configure make make install EOH end
3.3 更新并应用编写的cookbook
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ll
total 28 drwxr-xr-x 2 root root 4096 Jan 6 18:30 ./ drwxr-xr-x 10 root root 4096 Jan 6 18:11 ../ -rw-r--r-- 1 root root 305 Jan 6 18:30 build_pcre.rb -rw-r--r-- 1 root root 56 Jan 6 18:17 conf_group.rb -rw-r--r-- 1 root root 234 Jan 6 18:19 conf_sources.list.rb -rw-r--r-- 1 root root 136 Jan 6 18:11 default.rb -rw-r--r-- 1 root root 51 Jan 6 18:24 install_build-essential.rb
上传cookbook
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo knife cookbook upload mycookbook
Uploading mycookbook [0.1.0] Uploaded 1 cookbook.
查看当前role配置文件
ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../../../roles/
ubuntu@chef-workstation:/opt/chef-local/roles$ ls
README.md ubuntu_servers.rb
ubuntu@chef-workstation:/opt/chef-local/roles$ cat ubuntu_servers.rb
name "ubuntu_servers" description "The base role applied to all nodes." run_list( "recipe[user]", "recipe[user::data_bag]", "recipe[openssh]" ) override_attributes( "users" => [ "ubuntu" ] )
更新role配置文件
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu_servers.rb
name "ubuntu_servers" description "The base role applied to all nodes." run_list( "recipe[user]", "recipe[user::data_bag]", "recipe[openssh]", "recipe[mycookbook::conf_group]", "recipe[mycookbook::conf_sources.list]", "recipe[mycookbook::install_build-essential]", "recipe[mycookbook::build_pcre]" ) override_attributes( "users" => [ "ubuntu" ] )
上传role配置文件
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife role from file ubuntu_servers.rb
Updated Role ubuntu_servers!
查看节点
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node list
chef-client-1 chef-server
更新节点run_list
ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node run_list add chef-client-1 "role[ubuntu_servers]"
run_list: role[ubuntu_servers]
3.4 在节点上应用新的cookbook
ubuntu@chef-client-1:~$ sudo chef-client
INFO: *** Chef 10.16.2 *** INFO: Run List is [role[ubuntu_servers]] INFO: Run List expands to [user, user::data_bag, openssh, mycookbook::conf_group, mycookbook::conf_sources.list, mycookbook::install_build-essential, mycookbook::build_pcre] INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs INFO: Starting Chef Run for chef-client-1 INFO: Running start handlers INFO: Start handlers complete. INFO: Loading cookbooks [mycookbook, openssh, user] INFO: Storing updated cookbooks/openssh/recipes/default.rb in the cache. INFO: Storing updated cookbooks/openssh/attributes/default.rb in the cache. INFO: Storing updated cookbooks/openssh/.gitignore in the cache. INFO: Storing updated cookbooks/openssh/metadata.rb in the cache. INFO: Storing updated cookbooks/openssh/README.md in the cache. INFO: Storing updated cookbooks/openssh/LICENSE in the cache. INFO: Storing updated cookbooks/openssh/CHANGELOG.md in the cache. INFO: Storing updated cookbooks/openssh/metadata.json in the cache. INFO: Storing updated cookbooks/openssh/Gemfile in the cache. INFO: Storing updated cookbooks/openssh/CONTRIBUTING in the cache. INFO: Storing updated cookbooks/user/resources/account.rb in the cache. INFO: Storing updated cookbooks/user/providers/account.rb in the cache. INFO: Storing updated cookbooks/user/recipes/data_bag.rb in the cache. INFO: Storing updated cookbooks/user/recipes/default.rb in the cache. INFO: Storing updated cookbooks/user/attributes/default.rb in the cache. INFO: Storing updated cookbooks/user/Rakefile in the cache. INFO: Storing updated cookbooks/user/CHANGELOG.md in the cache. INFO: Storing updated cookbooks/user/README.md in the cache. INFO: Storing updated cookbooks/user/metadata.rb in the cache. INFO: Storing updated cookbooks/user/metadata.json in the cache. INFO: Storing updated cookbooks/mycookbook/recipes/build_nginx.rb in the cache. INFO: Storing updated cookbooks/mycookbook/recipes/conf_group.rb in the cache. INFO: Storing updated cookbooks/mycookbook/recipes/conf_sources.list.rb in the cache. INFO: Storing updated cookbooks/mycookbook/recipes/default.rb in the cache. INFO: Storing updated cookbooks/mycookbook/recipes/install_build-essential.rb in the cache. INFO: Storing updated cookbooks/mycookbook/recipes/build_pcre.rb in the cache. INFO: Storing updated cookbooks/mycookbook/README.md in the cache. INFO: Storing updated cookbooks/mycookbook/metadata.rb in the cache. INFO: Storing updated cookbooks/mycookbook/CHANGELOG.md in the cache. INFO: Processing user_account[ubuntu] action create (user::data_bag line 36) INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94) INFO: user[ubuntu] created INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114) INFO: directory[/home/ubuntu/.ssh] created directory /home/ubuntu/.ssh INFO: directory[/home/ubuntu/.ssh] owner changed to 1001 INFO: directory[/home/ubuntu/.ssh] group changed to 109 INFO: directory[/home/ubuntu/.ssh] mode changed to 700 INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114) INFO: directory[/home/ubuntu] mode changed to 2755 INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130) INFO: template[/home/ubuntu/.ssh/authorized_keys] updated content INFO: template[/home/ubuntu/.ssh/authorized_keys] owner changed to 1001 INFO: template[/home/ubuntu/.ssh/authorized_keys] group changed to 109 INFO: template[/home/ubuntu/.ssh/authorized_keys] mode changed to 600 INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94) INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114) INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114) INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130) INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148) INFO: Processing package[openssh-client] action install (openssh::default line 27) INFO: Processing package[openssh-server] action install (openssh::default line 27) INFO: Processing service[ssh] action enable (openssh::default line 30) INFO: service[ssh] enabled INFO: Processing service[ssh] action start (openssh::default line 30) INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 48) INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20130106190629 INFO: template[/etc/ssh/ssh_config] updated content INFO: template[/etc/ssh/ssh_config] owner changed to 0 INFO: template[/etc/ssh/ssh_config] group changed to 0 INFO: template[/etc/ssh/ssh_config] mode changed to 644 INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 66) INFO: template[/etc/ssh/sshd_config] backed up to /var/chef/backup/etc/ssh/sshd_config.chef-20130106190629 INFO: template[/etc/ssh/sshd_config] updated content INFO: template[/etc/ssh/sshd_config] owner changed to 0 INFO: template[/etc/ssh/sshd_config] group changed to 0 INFO: template[/etc/ssh/sshd_config] mode changed to 644 INFO: Processing group[project] action create (mycookbook::conf_group line 1) INFO: group[project] created INFO: Processing execute[update] action nothing (mycookbook::conf_sources.list line 1) INFO: Processing template[/etc/apt/sources.list] action create (mycookbook::conf_sources.list line 6) INFO: template[/etc/apt/sources.list] backed up to /var/chef/backup/etc/apt/sources.list.chef-20130106190629 INFO: template[/etc/apt/sources.list] updated content INFO: template[/etc/apt/sources.list] owner changed to 0 INFO: template[/etc/apt/sources.list] group changed to 0 INFO: template[/etc/apt/sources.list] mode changed to 644 INFO: template[/etc/apt/sources.list] sending run action to execute[update] (immediate) INFO: Processing execute[update] action run (mycookbook::conf_sources.list line 1) INFO: execute[update] ran successfully INFO: Processing package[build-essential] action install (mycookbook::install_build-essential line 1) INFO: Processing script[build_pcre] action run (mycookbook::build_pcre line 1) INFO: script[build_pcre] ran successfully INFO: template[/etc/ssh/sshd_config] sending restart action to service[ssh] (delayed) INFO: Processing service[ssh] action restart (openssh::default line 30) INFO: service[ssh] restarted INFO: Chef Run complete in 448.775004685 seconds INFO: Running report handlers INFO: Report handlers complete
ubuntu@chef-client-1:/etc$
通过以上输出,我们可以很清晰的看到每个recipe的执行过程,并且全部都成功执行了。
我们通过以下方式来一一校验:
ubuntu@chef-client-1:~$ id ubuntu
uid=1001(ubuntu) gid=109(admin) groups=109(admin),999(project)
ubuntu@chef-client-1:~$ cat /etc/apt/sources.list
# Generated by Chef for chef-client-1 deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse
ubuntu@chef-client-1:~$ dpkg -l | grep build-essential
ii build-essential 11.5 Informational list of build-essential packages
ubuntu@chef-client-1:~$ which pcregrep
/usr/local/bin/pcregrep
通过以上校验,再次证明所有的任务都已经执行了。
我们成功的完成了cookbook的自定义配置。
4. 更多深入的功能
至此,我们已经具备了一定的编写cookbook的能力了。
下面我分享一些比较有价值的经验:
4.1 安装官方社区的cookbook chef-client 可以实现客户端的定时自动拉取服务端配置,默认30分钟一次,具体时间可配置
Tips:
---
$ sudo knife cookbook site install chef-client
通过以下方式引用:
"recipe[chef-client::delete_validation]", "recipe[chef-client::config]", "recipe[chef-client::service]",
4.2 改造cookbook openssh
Tips:
---
直接将系统的/etc/ssh/sshd_config 复制成为模板文件sshd_config.erb
然后仅将需要自定义的参数修改为从attributes中读取,如:
PasswordAuthentication <%= node['openssh']['server']['password_authentication'] %> UseDNS <%= node['openssh']['server']['use_dns'] %>
同样,我们也可以自己来写attributes文件,实现参数的功能。
4.3 在role文件中重新定义参数值
Tips:
---
通过override_attributes可以直接定义参数的值,实现不同role采用不同的参数。
例如,针对官方社区的sudo的配置,可以通过以下方式重新定义参数的值:
默认的参数值:
default['authorization']['sudo']['groups'] = Array.new default['authorization']['sudo']['users'] = Array.new default['authorization']['sudo']['passwordless'] = false default['authorization']['sudo']['include_sudoers_d'] = false default['authorization']['sudo']['agent_forwarding'] = false
在role文件中重新定义后的值:
override_attributes( "authorization" => { "sudo" => { "groups" => ["admin"], "passwordless" => true, "users" => ["zabbix"] } } )
5. 至此,整个系列的文章可以告一段落了
用一句很2的话来说,就是,我只能帮你到这儿了。接下来,通过参考官方文档,以及实践中的更多应用,我们就能够更加熟练的掌握Chef这个强大的集中管理工具,再多的服务器在我们的手里也能管理的井然有序。
#1 by Jack Zhang on 2013/01/11 - 11:18
老师,您好,您讲的这些东西对理解chef相当不错,您有时间能做一些有关插件方面的说明吗?
谢谢
#2 by jackwill on 2013/03/20 - 21:21
转载请注明出处,谢谢,这是做技术最起码做到的!