龍圖IT服務|北京IT外包公司|運維監控|Oracle優化|MySQL優化|Linux運維|網絡維護|IT運維|網站建設-www.plgkqm.com
作者:北京IT服務外包公司 發布時間:04-11 閱讀: 轉至微博：
|
環境介紹 OS: Ubuntu 10.10 Server 64-bit Servers: chef-server:10.6.1.170 chef-workstation:10.6.1.171 chef-client-1:10.6.1.172 1. 開始創造屬于自己的大餐 “等我的手藝熟練之后我還會寫我自己的菜色和菜譜，來創造屬于我自己的大餐。” 在前面我提到過這句話，并且在上一個章節，也通過使用官方社區提供的cookbook完成了賬號與openssh的配置。 在這一章，我們就來編寫一個cookbook，將不同的自定義配置任務做成不同的recipe，最后實現對服務器的配置。 2. 如何開始 如何開始呢？使用官方社區的cookbook很簡單，只需要修改attributes里面的參數就可以了，如果要自己來寫，該怎么寫用什么格式呢？ 相信你一定有這個疑問存在。不過你可以盡管放心，Chef的官方社區有很完善的在線文檔可供參考的。 上面提到的“參考資料”中的URL，就是對應的文檔地址：http://wiki.opscode.com/display/chef/Resources#Resources-Service 具體內容很多，我們可以通過右側的目錄結構來理清思緒。 總共有差不多30個模塊，每一個都有相應的示例。 最常用的有： 賬號管理方面 Group,User 配置文件方面 Template,File, 腳本命令方面 Script,Execute 系統服務方面 Cron,Service,Mount,Package 這些模塊的具體用法，都可以在上面的頁面中找到，在這里我先就不描述了，接下來我們通過實踐來理解它們。 3. 規劃接下來要做的事情 以我的實際生產環境中遇到的情況為例，操作系統為Ubuntu,有以下幾個任務要完成： 1.新建一個名為project的用戶組，并將之前創建的用戶ubuntu添加到該組 2.更改系統默認的APT鏡像源為http://old-releases.ubuntu.com 3.通過apt-get安裝build-essential 4.編譯安裝pcre 8.10 這一次，我們不再到官方社區去搜尋第三方的cookbook，而是自己來編寫一個cookbook。 3.1 首先，來設計這個cookbook 將cookbook命名為mycookbook 然后分別創建4個不同的recipe，分別命名為 conf_group, conf_sources.list, install_build-essential, build_pcre 來實現對以上4個任務的完成 3.2 開始編寫cookbook 3.2.1 創建cookbook ubuntu@chef-workstation:/opt/chef-local$ sudo knife cookbook create mycookbook 1 ** Creating cookbook mycookbook 2 ** Creating README for cookbook: mycookbook 3 ** Creating CHANGELOG for cookbook: mycookbook 4 ** Creating metadata for cookbook: mycookbook ubuntu@chef-workstation:/opt/chef-local$ cd cookbooks/mycookbook/ ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ ls 1 CHANGELOG.md README.md attributes definitions files libraries metadata.rb providers recipes resources templates ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook$ cd recipes/ ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ls 1 default.rb 3.2.2 創建recipe conf_group ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_group.rb 1 group "project" do 2 gid 999 3 members [ 'ubuntu' ] 4 end 3.2.3 創建recipe conf_sources.list ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim conf_sources.list.rb 01 execute "update" do 02 command "sudo apt-get update" 03 action :nothing 04 end 05 06 template "/etc/apt/sources.list" do 07 source "sources.list.erb" 08 mode 0644 09 owner "root" 10 group "root" 11 notifies :run, "execute[update]", :immediately 12 end ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../templates/default/ ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ sudo vim sources.list.erb 1 # Generated by Chef for <%= node['fqdn'] %> 2 deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse 3 deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse 4 deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse 5 deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse 6 deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse 7 deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse 3.2.4 創建recipe install_build-essential ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/templates/default$ cd ../../recipes/ ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim install_build-essential.rb 1 package "build-essential" do 2 action :install 3 end 3.2.5 創建recipe build_pcre ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo vim build_pcre.rb 01 script "build_pcre" do 02 interpreter "bash" 03 user "root" 04 cwd "/tmp" 05 not_if "test -f /usr/local/bin/pcregrep" 06 code <<-EOH 07 wget http://nchc.dl.sourceforge.net/project/pcre/pcre/8.10/pcre-8.10.tar.gz 08 tar zxvf pcre-8.10.tar.gz 09 cd pcre-8.10 10 ./configure 11 make 12 make install 13 EOH 14 end 3.3 更新并應用編寫的cookbook ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ ll 1 total 28 2 drwxr-xr-x 2 root root 4096 Jan 6 18:30 ./ 3 drwxr-xr-x 10 root root 4096 Jan 6 18:11 ../ 4 -rw-r--r-- 1 root root 305 Jan 6 18:30 build_pcre.rb 5 -rw-r--r-- 1 root root 56 Jan 6 18:17 conf_group.rb 6 -rw-r--r-- 1 root root 234 Jan 6 18:19 conf_sources.list.rb 7 -rw-r--r-- 1 root root 136 Jan 6 18:11 default.rb 8 -rw-r--r-- 1 root root 51 Jan 6 18:24 install_build-essential.rb 上傳cookbook ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ sudo knife cookbook upload mycookbook 1 Uploading mycookbook [0.1.0] 2 Uploaded 1 cookbook. 查看當前role配置文件 ubuntu@chef-workstation:/opt/chef-local/cookbooks/mycookbook/recipes$ cd ../../../roles/ ubuntu@chef-workstation:/opt/chef-local/roles$ ls 1 README.md ubuntu_servers.rb ubuntu@chef-workstation:/opt/chef-local/roles$ cat ubuntu_servers.rb 01 name "ubuntu_servers" 02 description "The base role applied to all nodes." 03 run_list( 04 "recipe[user]", 05 "recipe[user::data_bag]", 06 "recipe[openssh]" 07 ) 08 override_attributes( 09 "users" => [ "ubuntu" ] 10 ) 更新role配置文件 ubuntu@chef-workstation:/opt/chef-local/roles$ sudo vim ubuntu_servers.rb 01 name "ubuntu_servers" 02 description "The base role applied to all nodes." 03 run_list( 04 "recipe[user]", 05 "recipe[user::data_bag]", 06 "recipe[openssh]", 07 "recipe[mycookbook::conf_group]", 08 "recipe[mycookbook::conf_sources.list]", 09 "recipe[mycookbook::install_build-essential]", 10 "recipe[mycookbook::build_pcre]" 11 ) 12 override_attributes( 13 "users" => [ "ubuntu" ] 14 ) 上傳role配置文件 ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife role from file ubuntu_servers.rb 1 Updated Role ubuntu_servers! 查看節點 ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node list 1 chef-client-1 2 chef-server 更新節點run_list ubuntu@chef-workstation:/opt/chef-local/roles$ sudo knife node run_list add chef-client-1 "role[ubuntu_servers]" 1 run_list: role[ubuntu_servers] 3.4 在節點上應用新的cookbook ubuntu@chef-client-1:~$ sudo chef-client 01 INFO: *** Chef 10.16.2 *** 02 INFO: Run List is [role[ubuntu_servers]] 03 INFO: Run List expands to [user, user::data_bag, openssh, mycookbook::conf_group, mycookbook::conf_sources.list, mycookbook::install_build-essential, mycookbook::build_pcre] 04 INFO: HTTP Request Returned 404 Not Found: No routes match the request: /reports/nodes/chef-client-1/runs 05 INFO: Starting Chef Run for chef-client-1 06 INFO: Running start handlers 07 INFO: Start handlers complete. 08 INFO: Loading cookbooks [mycookbook, openssh, user] 09 INFO: Storing updated cookbooks/openssh/recipes/default.rb in the cache. 10 INFO: Storing updated cookbooks/openssh/attributes/default.rb in the cache. 11 INFO: Storing updated cookbooks/openssh/.gitignore in the cache. 12 INFO: Storing updated cookbooks/openssh/metadata.rb in the cache. 13 INFO: Storing updated cookbooks/openssh/README.md in the cache. 14 INFO: Storing updated cookbooks/openssh/LICENSE in the cache. 15 INFO: Storing updated cookbooks/openssh/CHANGELOG.md in the cache. 16 INFO: Storing updated cookbooks/openssh/metadata.json in the cache. 17 INFO: Storing updated cookbooks/openssh/Gemfile in the cache. 18 INFO: Storing updated cookbooks/openssh/CONTRIBUTING in the cache. 19 INFO: Storing updated cookbooks/user/resources/account.rb in the cache. 20 INFO: Storing updated cookbooks/user/providers/account.rb in the cache. 21 INFO: Storing updated cookbooks/user/recipes/data_bag.rb in the cache. 22 INFO: Storing updated cookbooks/user/recipes/default.rb in the cache. 23 INFO: Storing updated cookbooks/user/attributes/default.rb in the cache. 24 INFO: Storing updated cookbooks/user/Rakefile in the cache. 25 INFO: Storing updated cookbooks/user/CHANGELOG.md in the cache. 26 INFO: Storing updated cookbooks/user/README.md in the cache. 27 INFO: Storing updated cookbooks/user/metadata.rb in the cache. 28 INFO: Storing updated cookbooks/user/metadata.json in the cache. 29 INFO: Storing updated cookbooks/mycookbook/recipes/build_nginx.rb in the cache. 30 INFO: Storing updated cookbooks/mycookbook/recipes/conf_group.rb in the cache. 31 INFO: Storing updated cookbooks/mycookbook/recipes/conf_sources.list.rb in the cache. 32 INFO: Storing updated cookbooks/mycookbook/recipes/default.rb in the cache. 33 INFO: Storing updated cookbooks/mycookbook/recipes/install_build-essential.rb in the cache. 34 INFO: Storing updated cookbooks/mycookbook/recipes/build_pcre.rb in the cache. 35 INFO: Storing updated cookbooks/mycookbook/README.md in the cache. 36 INFO: Storing updated cookbooks/mycookbook/metadata.rb in the cache. 37 INFO: Storing updated cookbooks/mycookbook/CHANGELOG.md in the cache. 38 INFO: Processing user_account[ubuntu] action create (user::data_bag line 36) 39 INFO: Processing user[ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 94) 40 INFO: user[ubuntu] created 41 INFO: Processing directory[/home/ubuntu/.ssh] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114) 42 INFO: directory[/home/ubuntu/.ssh] created directory /home/ubuntu/.ssh 43 INFO: directory[/home/ubuntu/.ssh] owner changed to 1001 44 INFO: directory[/home/ubuntu/.ssh] group changed to 109 45 INFO: directory[/home/ubuntu/.ssh] mode changed to 700 46 INFO: Processing directory[/home/ubuntu] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 114) 47 INFO: directory[/home/ubuntu] mode changed to 2755 48 INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action create (/var/chef/cache/cookbooks/user/providers/account.rb line 130) 49 INFO: template[/home/ubuntu/.ssh/authorized_keys] updated content 50 INFO: template[/home/ubuntu/.ssh/authorized_keys] owner changed to 1001 51 INFO: template[/home/ubuntu/.ssh/authorized_keys] group changed to 109 52 INFO: template[/home/ubuntu/.ssh/authorized_keys] mode changed to 600 53 INFO: Processing user[ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 94) 54 INFO: Processing directory[/home/ubuntu/.ssh] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114) 55 INFO: Processing directory[/home/ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 114) 56 INFO: Processing template[/home/ubuntu/.ssh/authorized_keys] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 130) 57 INFO: Processing execute[create ssh keypair for ubuntu] action nothing (/var/chef/cache/cookbooks/user/providers/account.rb line 148) 58 INFO: Processing package[openssh-client] action install (openssh::default line 27) 59 INFO: Processing package[openssh-server] action install (openssh::default line 27) 60 INFO: Processing service[ssh] action enable (openssh::default line 30) 61 INFO: service[ssh] enabled 62 INFO: Processing service[ssh] action start (openssh::default line 30) 63 INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 48) 64 INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20130106190629 65 INFO: template[/etc/ssh/ssh_config] updated content 66 INFO: template[/etc/ssh/ssh_config] owner changed to 0 67 INFO: template[/etc/ssh/ssh_config] group changed to 0 68 INFO: template[/etc/ssh/ssh_config] mode changed to 644 69 INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 66) 70 INFO: template[/etc/ssh/sshd_config] backed up to /var/chef/backup/etc/ssh/sshd_config.chef-20130106190629 71 INFO: template[/etc/ssh/sshd_config] updated content 72 INFO: template[/etc/ssh/sshd_config] owner changed to 0 73 INFO: template[/etc/ssh/sshd_config] group changed to 0 74 INFO: template[/etc/ssh/sshd_config] mode changed to 644 75 INFO: Processing group[project] action create (mycookbook::conf_group line 1) 76 INFO: group[project] created 77 INFO: Processing execute[update] action nothing (mycookbook::conf_sources.list line 1) 78 INFO: Processing template[/etc/apt/sources.list] action create (mycookbook::conf_sources.list line 6) 79 INFO: template[/etc/apt/sources.list] backed up to /var/chef/backup/etc/apt/sources.list.chef-20130106190629 80 INFO: template[/etc/apt/sources.list] updated content 81 INFO: template[/etc/apt/sources.list] owner changed to 0 82 INFO: template[/etc/apt/sources.list] group changed to 0 83 INFO: template[/etc/apt/sources.list] mode changed to 644 84 INFO: template[/etc/apt/sources.list] sending run action to execute[update] (immediate) 85 INFO: Processing execute[update] action run (mycookbook::conf_sources.list line 1) 86 INFO: execute[update] ran successfully 87 INFO: Processing package[build-essential] action install (mycookbook::install_build-essential line 1) 88 INFO: Processing script[build_pcre] action run (mycookbook::build_pcre line 1) 89 INFO: script[build_pcre] ran successfully 90 INFO: template[/etc/ssh/sshd_config] sending restart action to service[ssh] (delayed) 91 INFO: Processing service[ssh] action restart (openssh::default line 30) 92 INFO: service[ssh] restarted 93 INFO: Chef Run complete in 448.775004685 seconds 94 INFO: Running report handlers 95 INFO: Report handlers complete ubuntu@chef-client-1:/etc$ 通過以上輸出，我們可以很清晰的看到每個recipe的執行過程，并且全部都成功執行了。 我們通過以下方式來一一校驗: ubuntu@chef-client-1:~$ id ubuntu 1 uid=1001(ubuntu) gid=109(admin) groups=109(admin),999(project) ubuntu@chef-client-1:~$ cat /etc/apt/sources.list 1 # Generated by Chef for chef-client-1 2 deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse 3 deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse 4 deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse 5 deb-src http://old-releases.ubuntu.com/ubuntu/ maverick main restricted universe multiverse 6 deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted universe multiverse 7 deb-src http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted universe multiverse ubuntu@chef-client-1:~$ dpkg -l | grep build-essential 1 ii build-essential 11.5 Informational list of build-essential packages ubuntu@chef-client-1:~$ which pcregrep 1 /usr/local/bin/pcregrep 通過以上校驗，再次證明所有的任務都已經執行了。 我們成功的完成了cookbook的自定義配置。 4. 更多深入的功能 至此，我們已經具備了一定的編寫cookbook的能力了。 下面我分享一些比較有價值的經驗： 4.1 安裝官方社區的cookbook chef-client 可以實現客戶端的定時自動拉取服務端配置，默認30分鐘一次，具體時間可配置 Tips: --- $ sudo knife cookbook site install chef-client 通過以下方式引用： 1 "recipe[chef-client::delete_validation]", 2 "recipe[chef-client::config]", 3 "recipe[chef-client::service]", 4.2 改造cookbook openssh Tips: --- 直接將系統的/etc/ssh/sshd_config 復制成為模板文件sshd_config.erb 然后僅將需要自定義的參數修改為從attributes中讀取，如： 1 PasswordAuthentication <%= node['openssh']['server']['password_authentication'] %> 2 UseDNS <%= node['openssh']['server']['use_dns'] %> 同樣，我們也可以自己來寫attributes文件，實現參數的功能。 4.3 在role文件中重新定義參數值 Tips: --- 通過override_attributes可以直接定義參數的值，實現不同role采用不同的參數。 例如，針對官方社區的sudo的配置，可以通過以下方式重新定義參數的值： 默認的參數值： 1 default['authorization']['sudo']['groups'] = Array.new 2 default['authorization']['sudo']['users'] = Array.new 3 default['authorization']['sudo']['passwordless'] = false 4 default['authorization']['sudo']['include_sudoers_d'] = false 5 default['authorization']['sudo']['agent_forwarding'] = false 在role文件中重新定義后的值： 1 override_attributes( 2 "authorization" => { 3 "sudo" => { 4 "groups" => ["admin"], 5 "passwordless" => true, 6 "users" => ["zabbix"] 7 } 8 } 9 ) 5. 至此，整個系列的文章可以告一段落了 用一句很2的話來說，就是，我只能幫你到這兒了。接下來，通過參考官方文檔，以及實踐中的更多應用，我們就能夠更加熟練的掌握Chef這個強大的集中管理工具，再多的服務器在我們的手里也能管理的井然有序。 關鍵詞： Chef
|
