Ubuntu Server上Puppet、Chef、SaltStack的深度实践与对比

# 用户资源管理示例
user { 'nginx':
  ensure     => present,
  uid        => '1001',
  gid        => 'nginx',
  shell      => '/bin/false',
  home       => '/var/lib/nginx',
  managehome => false,
  comment    => 'Nginx service user',
}

# 文件资源管理示例  
file { '/etc/nginx/nginx.conf':
  ensure  => file,
  owner   => 'root',
  group   => 'root',
  mode    => '0644',
  source  => 'puppet:///modules/nginx/nginx.conf',
  require => Package['nginx'],
}

# 服务资源管理示例
service { 'nginx':
  ensure    => running,
  enable    => true,
  subscribe => File['/etc/nginx/nginx.conf'],
}

# Nginx服务配置类示例
class nginx (
  String $version = 'present',
  Hash $virtual_hosts = {},
  Boolean $gzip = true,
) {
  # 软件包管理
  package { 'nginx':
    ensure => $version,
  }
  
  # 配置文件管理
  file { '/etc/nginx/nginx.conf':
    ensure  => file,
    content => template('nginx/nginx.conf.erb'),
    notify  => Service['nginx'],
  }
  
  # 服务管理
  service { 'nginx':
    ensure    => running,
    enable    => true,
    hasstatus => true,
    require   => Package['nginx'],
  }
  
  # 虚拟主机管理
  create_resources('nginx::virtual_host', $virtual_hosts)
}

# 添加Puppet官方仓库
wget https://apt.puppet.com/puppet7-release-focal.deb
sudo dpkg -i puppet7-release-focal.deb
sudo apt-get update

# 安装Puppet Server
sudo apt-get install puppetserver

# 配置JVM堆内存（根据服务器内存调整）
sudo sed -i 's/-Xms2g -Xmx2g/-Xms1g -Xmx1g/' /etc/default/puppetserver

# 配置puppet.conf
sudo tee /etc/puppetlabs/puppet/puppet.conf << EOF
[master]
dns_alt_names = puppet,puppetmaster.example.com
certname = puppetmaster.example.com
server = puppetmaster.example.com
environment = production
runinterval = 30m
EOF

# 启动Puppet Server服务
sudo systemctl enable puppetserver
sudo systemctl start puppetserver

# 配置防火墙规则
sudo ufw allow 8140/tcp

# 在目标节点上安装Puppet Agent
wget https://apt.puppet.com/puppet7-release-focal.deb
sudo dpkg -i puppet7-release-focal.deb
sudo apt-get update
sudo apt-get install puppet-agent

# 配置puppet.conf
sudo tee /etc/puppetlabs/puppet/puppet.conf << EOF
[agent]
server = puppetmaster.example.com
certname = agent01.example.com
environment = production
runinterval = 30m
EOF

# 首次运行Puppet Agent
sudo /opt/puppetlabs/bin/puppet agent --test --waitforcert 60

# 在Puppet Master上查看待签署的证书请求
sudo /opt/puppetlabs/bin/puppetserver ca list

# 签署特定节点证书
sudo /opt/puppetlabs/bin/puppetserver ca sign --certname agent01.example.com

# 签署所有待处理证书
sudo /opt/puppetlabs/bin/puppetserver ca sign --all

/etc/puppetlabs/code/
├── environments/           # 环境目录
│   └── production/        # 生产环境
│       ├── manifests/     # Manifest文件
│       │   └── site.pp    # 入口文件
│       ├── modules/       # 模块目录
│       └── data/          # Hiera数据目录
├── modules/               # 全局模块目录
└── puppetdb/

# 包资源示例
package 'nginx' do
  action :install
  version '1.18.0'
end

# 文件资源示例
file '/etc/nginx/sites-available/default' do
  content 'server { listen 80; server_name example.com; }'
  owner 'root'
  group 'root'
  mode '0644'
  notifies :restart, 'service[nginx]'
end

# 服务资源示例
service 'nginx' do
  action [:enable, :start]
  supports status: true, restart: true, reload: true
end

# 安装和配置Nginx的Recipe示例
node.default['nginx']['version'] = '1.18.0'

package "nginx-#{node['nginx']['version']}" do
  action :install
end

directory '/etc/nginx/conf.d' do
  owner 'root'
  group 'root'
  mode '0755'
end

template '/etc/nginx/nginx.conf' do
  source 'nginx.conf.erb'
  variables(
    worker_processes: node['cpu']['total'],
    worker_connections: 1024
  )
  notifies :reload, 'service[nginx]'
end

service 'nginx' do
  action [:enable, :start]
end

cookbook-name/
├── attributes/          # 属性文件
├── definitions/         # 轻量级资源定义
├── files/              # 静态文件
├── libraries/          # Ruby库文件
├── providers/          # 重量级资源Provider
├── recipes/            # Recipe文件
├── resources/          # 重量级资源定义
├── templates/          # 模板文件
├── metadata.rb         # Cookbook元数据
└── spec/               # 测试文件

# 下载并安装Chef Server
wget https://packages.chef.io/files/stable/chef-server/14.1.0/ubuntu/20.04/chef-server-core_14.1.0-1_amd64.deb
sudo dpkg -i chef-server-core_14.1.0-1_amd64.deb

# 执行配置命令
sudo chef-server-ctl reconfigure

# 创建管理用户和组织
sudo chef-server-ctl user-create chefadmin Chef Admin admin@example.com 'password' --filename /tmp/chefadmin.pem
sudo chef-server-ctl org-create exampleorg 'Example Organization' --association_user chefadmin --filename /tmp/exampleorg-validator.pem

# 安装Web管理界面（可选）
sudo chef-server-ctl install chef-manage
sudo chef-server-ctl reconfigure
sudo chef-manage-ctl reconfigure

# 下载并安装Chef Workstation
wget https://packages.chef.io/files/stable/chef-workstation/21.10.640/ubuntu/20.04/chef-workstation_21.10.640-1_amd64.deb
sudo dpkg -i chef-workstation_21.10.640-1_amd64.deb

# 配置Knife
mkdir -p ~/.chef
cat > ~/.chef/config.rb << EOF
current_dir = File.dirname(__FILE__)
log_level                :info
log_location             STDOUT
node_name                'chefadmin'
client_key               '#{current_dir}/chefadmin.pem'
validation_client_name   'exampleorg-validator'
validation_key           '#{current_dir}/exampleorg-validator.pem'
chef_server_url          'https://chef-server.example.com/organizations/exampleorg'
syntax_check_cache_path  '#{current_dir}/syntaxcache'
cookbook_path            ['#{current_dir}/../cookbooks']
EOF

# 将证书文件从服务器复制到Workstation的~/.chef目录
scp user@chef-server:/tmp/*.pem ~/.chef/

# 使用Knife引导Ubuntu节点
knife bootstrap ubuntu-node.example.com \
  --ssh-user ubuntu \
  --sudo \
  --identity-file ~/.ssh/id_rsa \
  --node-name node01 \
  --run-list 'recipe[apt],recipe[nginx]'

# 创建新的Cookbook
chef generate cookbook nginx

# 编辑recipes/default.rb
cd nginx
vi recipes/default.rb

# 上传Cookbook到Server
knife cookbook upload nginx

# 将Recipe添加到节点的run_list
knife node run_list add node01 'recipe[nginx]'

# 在Cookbook的属性文件中定义默认值
default['nginx']['worker_processes'] = 4
default['nginx']['worker_connections'] = 768
default['nginx']['keepalive_timeout'] = 65

# 在Recipe中使用属性
template '/etc/nginx/nginx.conf' do
  source 'nginx.conf.erb'
  variables(
    worker_processes: node['nginx']['worker_processes'],
    worker_connections: node['nginx']['worker_connections']
  )
end

# 创建数据包
knife data bag create users

# 将数据项添加到数据包
knife data bag from file users alice.json

# 在Recipe中使用数据包
user_secrets = data_bag_item('users', 'alice')

user alice['username'] do
  comment alice['comment']
  uid alice['uid']
  home alice['home']
  shell alice['shell']
  password alice['password']
end

# Web服务器角色定义
name "webserver"
description "Web Server Role"
run_list "recipe[apt]", "recipe[nginx]"
default_attributes(
  "nginx" => {
    "worker_processes" => 8,
    "worker_connections" => 1024
  }
)

# 生产环境定义
name "production"
description "Production Environment"
override_attributes(
  "nginx" => {
    "gzip" => "on",
    "keepalive_timeout" => 65
  }
)

# ChefSpec单元测试示例
require 'chefspec'

describe 'nginx::default' do
  let(:chef_run) { ChefSpec::SoloRunner.converge(described_recipe) }

  it 'installs nginx package' do
    expect(chef_run).to install_package('nginx')
  end

  it 'enables and starts nginx service' do
    expect(chef_run).to enable_service('nginx')
    expect(chef_run).to start_service('nginx')
  end
end

# /srv/salt/top.sls
base:
  'web*':
    - webserver.nginx
  'db*':
    - database.mysql
  'proxy*':
    - proxy.haproxy

# 测试Minion连通性
salt '*' test.ping

# 在所有节点上执行shell命令
salt '*' cmd.run 'hostname -f'

# 检查磁盘使用情况
salt '*' disk.usage

# 安装软件包
salt 'web*' pkg.install nginx

# 管理服务状态
salt 'web*' service.start nginx
salt 'web*' service.enable nginx

# 通配符匹配
salt 'web*.example.com' test.ping

# 正则表达式匹配
salt -E 'web[0-9]+' test.ping

# 节点组匹配（预定义分组）
salt -N 'web-servers' test.ping

# Grains系统属性匹配
salt -G 'os:Ubuntu' test.ping

# 复合匹配
salt -C 'G@os:Ubuntu and web*' test.ping

# /srv/salt/webserver/nginx.sls
nginx_pkg:
  pkg.installed:
    - name: nginx

nginx_config:
  file.managed:
    - name: /etc/nginx/nginx.conf
    - source: salt://webserver/files/nginx.conf
    - user: root
    - group: root
    - mode: 644
    - template: jinja
    - require:
      - pkg: nginx_pkg

nginx_service:
  service.running:
    - name: nginx
    - enable: True
    - watch:
      - file: nginx_config

# 基础状态
base_nginx:
  pkg.installed:
    - name: nginx
  service.running:
    - name: nginx
    - enable: True

# 扩展状态
extended_nginx:
  file.managed:
    - name: /etc/nginx/conf.d/custom.conf
    - source: salt://webserver/files/custom.conf
    - require:
      - pkg: base_nginx

# 添加SaltStack官方仓库
curl -L https://bootstrap.saltstack.com -o install_salt.sh
sudo sh install_salt.sh -P -M

# 或者使用APT仓库安装
wget -O - https://repo.saltproject.io/py3/ubuntu/20.04/amd64/latest/SALTSTACK-GPG-KEY.pub | sudo apt-key add -
echo "deb http://repo.saltproject.io/py3/ubuntu/20.04/amd64/latest focal main" | sudo tee /etc/apt/sources.list.d/saltstack.list

sudo apt-get update
sudo apt-get install salt-master

# 配置Master主配置文件
sudo tee /etc/salt/master << EOF
interface: 192.168.1.100
auto_accept: False

file_roots:
  base:
    - /srv/salt

pillar_roots:
  base:
    - /srv/pillar

log_level: info
EOF

# 创建必要的目录
sudo mkdir -p /srv/salt /srv/pillar

# 启动Salt Master服务
sudo systemctl enable salt-master
sudo systemctl start salt-master

# 在目标节点上安装Salt Minion
curl -L https://bootstrap.saltstack.com -o install_salt.sh
sudo sh install_salt.sh -P

# 配置Minion
sudo tee /etc/salt/minion << EOF
master: 192.168.1.100
id: web01.example.com
ipv6: False

log_level: info
EOF

# 启动Salt Minion服务
sudo systemctl enable salt-minion
sudo systemctl start salt-minion

# 在Master上列出待接受的Minion密钥
salt-key -L

# 接受指定Minion的密钥
salt-key -a web01.example.com

# 接受所有待处理的Minion密钥
salt-key -A

# 拒绝特定Minion的密钥
salt-key -r malicious-minion

# 在Minion上配置自定义Grains
# /etc/salt/grains
role: webserver
environment: production
datacenter: us-east-1

# 查看所有Grains数据
salt 'web01' grains.items

# 查看特定Grain值
salt 'web01' grains.get os

# 设置Grains数据
salt 'web01' grains.setval role webserver

# /srv/pillar/top.sls
base:
  'web*':
    - webserver
  'db*':
    - database

# /srv/pillar/webserver.sls
webserver:
  version: 1.18.0
  config:
    worker_processes: 4
    worker_connections: 1024
  ssl:
    enabled: true
    certificate: /etc/ssl/certs/example.com.crt
    key: /etc/ssl/private/example.com.key

# 使用Jinja模板的动态配置
{% set nginx = pillar.get('nginx', {}) %}
nginx_pkg:
  pkg.installed:
    - name: nginx

nginx_config:
  file.managed:
    - name: /etc/nginx/nginx.conf
    - source: salt://webserver/files/nginx.conf
    - template: jinja
    - context:
        worker_processes: {{ nginx.get('worker_processes', 4) }}
        worker_connections: {{ nginx.get('worker_connections', 768) }}
    - require:
      - pkg: nginx_pkg

# 配置Reactor规则
# /etc/salt/master.d/reactor.conf
reactor:
  - 'salt/minion/*/start':
    - '/srv/reactor/startup.sls'
  - 'salt/beacon/*/service/*/status':
    - '/srv/reactor/service_restart.sls'

# Reactor状态文件
# /srv/reactor/startup.sls
highstate_run:
  local.state.apply:
    - tgt: {{ data['id'] }}

# 配置Beacon监控服务状态
beacons:
  service:
    nginx:
      onchangeonly: True

# Puppet声明式示例
package { 'nginx':
  ensure => installed,
}

service { 'nginx':
  ensure    => running,
  enable    => true,
  require   => Package['nginx'],
}

# Chef命令式示例
package 'nginx' do
  action :install
end

service 'nginx' do
  action [:enable, :start]
end

# SaltStack混合式示例
nginx_pkg:
  pkg.installed:
    - name: nginx

nginx_service:
  service.running:
    - name: nginx
    - enable: True
    - require:
      - pkg: nginx_pkg

# SaltStack环境配置示例
# /etc/salt/master
file_roots:
  development:
    - /srv/salt/development
  testing:
    - /srv/salt/testing  
  production:
    - /srv/salt/production

# 典型的配置代码仓库结构
infrastructure-as-code/
├── puppet/
│   ├── environments/
│   ├── modules/
│   └── manifests/
├── chef/
│   ├── cookbooks/
│   ├── data_bags/
│   └── roles/
├── salt/
│   ├── base/
│   ├── environments/
│   └── formulas/
└── scripts/
    ├── deployment/
    └── validation/

# Chef Kitchen测试示例
# .kitchen.yml
driver:
  name: vagrant

provisioner:
  name: chef_zero

platforms:
  - name: ubuntu-20.04

suites:
  - name: default
    run_list:
      - recipe[nginx::default]
    verifier:
      inspec_tests:
        - test/integration/default

# Puppet监控配置示例
class monitoring::puppet {
  cron { 'puppet-agent':
    command => '/opt/puppetlabs/bin/puppet agent --test',
    user    => 'root',
    hour    => '*',
    minute  => '*/30',
  }

  file { '/usr/local/bin/check_puppet_last_run':
    ensure => file,
    mode   => '0755',
    source => 'puppet:///modules/monitoring/check_puppet_last_run',
  }
}

# SaltStack备份脚本示例
#!/bin/bash
BACKUP_DIR="/backup/salt/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR

# 备份配置
cp -r /etc/salt $BACKUP_DIR/
cp -r /srv/salt $BACKUP_DIR/
cp -r /srv/pillar $BACKUP_DIR/

# 备份密钥
tar -czf $BACKUP_DIR/pki.tar.gz /etc/salt/pki

# 备份数据库（如果使用）
sudo -u salt psql -c "pg_dump salt" > $BACKUP_DIR/salt_db.sql

# SaltStack构建Docker镜像示例
docker_image_build:
  docker_image.present:
    - name: myapp:latest
    - dockerfile: |
        FROM ubuntu:20.04
        RUN apt-get update && apt-get install -y nginx
        COPY app.conf /etc/nginx/conf.d/
        EXPOSE 80
    - source: salt://myapp/docker/context
    - build: True

# Chef InSpec合规性检查示例
control 'nginx-01' do
  impact 1.0
  title 'Nginx should be installed and running'
  desc 'Nginx web server should be installed, enabled and running'

  describe package('nginx') do
    it { should be_installed }
    its('version') { should cmp >= '1.18.0' }
  end

  describe service('nginx') do
    it { should be_enabled }
    it { should be_running }
  end
end

# SaltStack自愈规则示例
auto_heal_nginx:
  beacon.present:
    - service:
        nginx:
          onchange: True
    - disable_during_state_apply: True
  
  reactor:
    - salt/beacon/*/service/nginx/stopped:
      - /srv/reactor/restart_nginx.sls