Puppet 简明教程

Puppet - Resource

资源是 Puppet 用于设计和构建任何特定基础设施或机器的关键基本单元之一。它们主要用于建模和维护系统配置。Puppet 具有多种类型的资源，可用于定义系统架构或用户具有构建和定义新资源的杠杆。

Resources are one of the key fundamental units of Puppet used to design and build any particular infrastructure or a machine. They are mainly used for modeling and maintaining system configurations. Puppet has multiple type of resources, which can be used to define the system architecture or the user has the leverage to build and define a new resource.

清单文件或任何其他文件中的 Puppet 代码块称为资源声明。该代码块是用一种称为声明建模语言 (DML) 的语言编写的。以下是如何介绍它的示例。

The block of Puppet code in manifest file or any other file is called a resource declaration. The block of code is written in a language called Declarative Modelling Language (DML). Following is an example of how it looks like.

user { 'vipin':
   ensure => present,
   uid    => '552',
   shell  => '/bin/bash',
   home   => '/home/vipin',
}

在 Puppet 中，对任何特定资源类型的资源声明都在代码块中完成。在下面的示例中，用户主要由四个预定义的参数组成。

In Puppet, resource declaration for any particular resource type is done in code block. In the following example, the user is made up of mainly four pre-defined parameters.

  1. Resource Type − In the above code snippet, it is the user.

  2. Resource Parameter − In the above code snippet, it is Vipin.

  3. Attributes − In the above code snippet, it is ensure, uid, shell, home.

  4. Values − These are the values that correspond to each property.

每种资源类型都有它自己定义定义和参数的一种方式，并且用户享有选择他希望其资源看起来像哪种方式的权利。

Each resource type has its own way of defining definitions and parameters, and the user has the privilege to pick and choose the way he wants his resource to look like.

Resource Type

Puppet 中有不同类型的可用资源，这些资源有它们自己可供使用的功能的方式。这些资源类型可以使用 “描述” 命令与 “-list” 选项一起被查看。

There are different types of resources available in Puppet which have their own way of functionality. These resource types can be viewed using the “describe” command along with the “-list” option.

[root@puppetmaster ~]# puppet describe --list
These are the types known to puppet:
augeas          - Apply a change or an array of changes to the  ...
computer        - Computer object management using DirectorySer ...
cron            - Installs and manages cron jobs
exec            - Executes external commands
file            - Manages files, including their content, owner ...
filebucket      - A repository for storing and retrieving file  ...
group           - Manage groups
host            - Installs and manages host entries
interface       - This represents a router or switch interface
k5login         - Manage the ‘.k5login’ file for a user
macauthorization - Manage the Mac OS X authorization database
mailalias       - .. no documentation ..
maillist        - Manage email lists
mcx             - MCX object management using DirectoryService  ...
mount           - Manages mounted filesystems, including puttin ...
nagios_command  - The Nagios type command
nagios_contact  - The Nagios type contact
nagios_contactgroup - The Nagios type contactgroup
nagios_host     - The Nagios type host
nagios_hostdependency - The Nagios type hostdependency
nagios_hostescalation - The Nagios type hostescalation
nagios_hostextinfo - The Nagios type hostextinfo
nagios_hostgroup - The Nagios type hostgroup

nagios_service  - The Nagios type service
nagios_servicedependency - The Nagios type servicedependency
nagios_serviceescalation - The Nagios type serviceescalation
nagios_serviceextinfo - The Nagios type serviceextinfo
nagios_servicegroup - The Nagios type servicegroup
nagios_timeperiod - The Nagios type timeperiod
notify          - .. no documentation ..
package         - Manage packages
resources       - This is a metatype that can manage other reso ...
router          - .. no documentation ..
schedule        - Define schedules for Puppet
scheduled_task  - Installs and manages Windows Scheduled Tasks
selboolean      - Manages SELinux booleans on systems with SELi ...
service         - Manage running services
ssh_authorized_key - Manages SSH authorized keys
sshkey          - Installs and manages ssh host keys
stage           - A resource type for creating new run stages
tidy            - Remove unwanted files based on specific crite ...
user            - Manage users
vlan            - .. no documentation ..
whit            - Whits are internal artifacts of Puppet's curr ...
yumrepo         - The client-side description of a yum reposito ...
zfs             - Manage zfs
zone            - Manages Solaris zones
zpool           - Manage zpools

Resource Title

在以上代码片段中，我们有唯一资源标题，它在代码的相同文件中用于每个资源，该标题是唯一的。这对于此用户资源类型来说是唯一标题。我们无法拥有一个名称相同资源，因为它会引起冲突。

In the above code snippet, we have resource title as vipin which is unique for each resource used in the same file of the code. This is a unique title for this user resource type. We cannot have a resource with the same name because it will cause conflicts.

可以将资源命令用于查看所有资源的列表，其中包括类型用户。

Resource command can be used to view the list of all the resources using type user.

[root@puppetmaster ~]# puppet resource user
user { 'abrt':
   ensure           => 'present',
   gid              => '173',
   home             => '/etc/abrt',
   password         => '!!',
   password_max_age => '-1',
   password_min_age => '-1',
   shell            => '/sbin/nologin',
   uid              => '173',
}

user { 'admin':
   ensure           => 'present',
   comment          => 'admin',
   gid              => '444',
   groups           => ['sys', 'admin'],
   home             => '/var/admin',
   password         => '*',
   password_max_age => '99999',
   password_min_age => '0',
   shell            => '/sbin/nologin',
   uid              => '55',
}

user { 'tomcat':
   ensure           => 'present',
   comment          => 'tomcat',
   gid              => '100',
   home             => '/var/www',
   password         => '!!',
   password_max_age => '-1',
   password_min_age => '-1',
   shell            => '/sbin/nologin',
   uid              => '100',
}

Listing the Resources of a Particular User

[root@puppetmaster ~]# puppet resource user tomcat
user { 'apache':
   ensure           => 'present',
   comment          => 'tomcat',
   gid              => '100',
   home             => '/var/www',
   password         => '!!',
   password_max_age => '-1',
   password_min_age => '-1',
   shell            => '/sbin/nologin',
   uid              => '100’,
}

Attributes & Values

任何资源的主体是由一系列的属性-值对组成的。这里可以指定一个给定资源属性的值。每个资源类型都有它自己的一组属性，这些属性可以由键值对来配置。

The main body of any resource is made up of a collection of attribute-value pairs. Here one can specify the values for a given resource’s property. Each resource type has its own set of attributes that can be configured with the key-value pairs.

描述子命令可以用来获取关于特定资源属性的更多细节。在以下示例中，我们有关用户资源的详细信息及其所有可配置属性。

Describe the sub-command that can be used to get more details about a particular resources attribute. In the following example, we have the details about the user resource along with all its configurable attributes.

[root@puppetmaster ~]# puppet describe user
user
====
Manage users.  This type is mostly built to manage system users,
so it is lacking some features useful for managing normal users.

This resource type uses the prescribed native tools for creating groups
and generally uses POSIX APIs for retrieving information about them.
It does not directly modify ‘/etc/passwd’ or anything.

**Autorequires:** If Puppet is managing the user's primary group
(as provided in the ‘gid’ attribute),
the user resource will autorequire that group.
If Puppet is managing any role accounts corresponding to the user's roles,
the user resource will autorequire those role accounts.

Parameters
----------
- **allowdupe**
   Whether to allow duplicate UIDs. Defaults to ‘false’.
   Valid values are ‘true’, ‘false’, ‘yes’, ‘no’.

- **attribute_membership**
   Whether specified attribute value pairs should be treated as the
   **complete list** (‘inclusive’) or the **minimum list** (‘minimum’) of
   attribute/value pairs for the user. Defaults to ‘minimum’.
   Valid values are ‘inclusive’, ‘minimum’.

- **auths**
   The auths the user has.  Multiple auths should be
   specified as an array.
   Requires features manages_solaris_rbac.

- **comment**
   A description of the user.  Generally the user's full name.

- **ensure**
   The basic state that the object should be in.
   Valid values are ‘present’, ‘absent’, ‘role’.

- **expiry**
   The expiry date for this user. Must be provided in
   a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
   If you want to make sure the user account does never
   expire, you can pass the special value ‘absent’.
   Valid values are ‘absent’. Values can match ‘/^\d{4}-\d{2}-\d{2}$/’.
   Requires features manages_expiry.

- **forcelocal**
   Forces the mangement of local accounts when accounts are also
   being managed by some other NSS

- **gid**
   The user's primary group. Can be specified numerically or by name.
   This attribute is not supported on Windows systems; use the ‘groups’
   attribute instead. (On Windows, designating a primary group is only
   meaningful for domain accounts, which Puppet does not currently manage.)

- **groups**
   The groups to which the user belongs. The primary group should
   not be listed, and groups should be identified by name rather than by
   GID.  Multiple groups should be specified as an array.

- **home**
   The home directory of the user.  The directory must be created
   separately and is not currently checked for existence.

- **ia_load_module**
   The name of the I&A module to use to manage this user.
   Requires features manages_aix_lam.

- **iterations**
   This is the number of iterations of a chained computation of the
   password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter
   is used in OS X. This field is required for managing passwords on OS X
   >= 10.8.
   Requires features manages_password_salt.

- **key_membership**

- **managehome**
   Whether to manage the home directory when managing the user.
   This will create the home directory when ‘ensure => present’, and
   delete the home directory when ‘ensure => absent’. Defaults to ‘false’.
   Valid values are ‘true’, ‘false’, ‘yes’, ‘no’.

- **membership**
   Whether specified groups should be considered the **complete list**
   (‘inclusive’) or the **minimum list** (‘minimum’) of groups to which
   the user belongs. Defaults to ‘minimum’.
   Valid values are ‘inclusive’, ‘minimum’.

- **name**
   The user name. While naming limitations vary by operating system,
   it is advisable to restrict names to the lowest common denominator,
   which is a maximum of 8 characters beginning with a letter.
   Note that Puppet considers user names to be case-sensitive, regardless
   of the platform's own rules; be sure to always use the same case when
   referring to a given user.

- **password**
   The user's password, in whatever encrypted format the local
   system requires.
   * Most modern Unix-like systems use salted SHA1 password hashes. You can use
      Puppet's built-in ‘sha1’ function to generate a hash from a password.
   * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.

Windows API
   for setting the password hash.
   [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
   Be sure to enclose any value that includes a dollar sign ($) in single
   quotes (') to avoid accidental variable interpolation.
   Requires features manages_passwords.

- **password_max_age**
   The maximum number of days a password may be used before it must be changed.
   Requires features manages_password_age.

- **password_min_age**
   The minimum number of days a password must be used before it may be changed.
   Requires features manages_password_age.

- **profile_membership**
   Whether specified roles should be treated as the **complete list**
   (‘inclusive’) or the **minimum list** (‘minimum’) of roles
   of which the user is a member. Defaults to ‘minimum’.
   Valid values are ‘inclusive’, ‘minimum’.

- **profiles**
   The profiles the user has.  Multiple profiles should be
   specified as an array.
   Requires features manages_solaris_rbac.

- **project**
   The name of the project associated with a user.
   Requires features manages_solaris_rbac.

- **uid**
   The user ID; must be specified numerically. If no user ID is
   specified when creating a new user, then one will be chosen
   automatically. This will likely result in the same user having
   different UIDs on different systems, which is not recommended. This is
   especially noteworthy when managing the same user on both Darwin and
   other platforms, since Puppet does UID generation on Darwin, but
   the underlying tools do so on other platforms.
   On Windows, this property is read-only and will return the user's
   security identifier (SID).