辅助模块

https://github.com/duritong/puppet-sysctl

下载方法

利用上面网站, 通过连接 clone or download 利用 download zip 按钮进行下载 把下载的 zip 文件直接解压到服务器端 /etc/puppet/modules/sysctl/ 目录下

文件结构

如下

[root@terry-test-uq2pu ~]# ls /etc/puppet/modules/sysctl/ Gemfile lib manifests Modulefile Rakefile README.md spec

可以通过查询 README.md 文件查询使用方法

puppet 调用顺序

/etc/puppet/puppet.conf |-> /etc/puppet/manifests/main-site.pp |-> /etc/puppet/manifests/terry/terry-parameter.pp |-> /etc/puppet/manifests/terry/terry-site.pp |-> /etc/puppet/manifests/terry/terry-sysctl.pp

说明一下:

1. /etc/puppet/puppet.conf 中通过下面配置执行下一个文件 manifest = /etc/puppet/manifests/main-site.pp 2. /etc/puppet/manifests/main-site.pp 通过下面配置执行下一个文件 import 'terry/terry-parameter.pp' import 'terry-site.pp' 3. /etc/puppet/manifests/terry/terry-parameter.pp (用于定了了全局变量) 下一章说明 /etc/puppet/manifests/terry/terry-site.pp 定义了主机需要执行那些自定义行为, 使用那些资源, 当前以调用了 sysctl 模块功能 import 'terry/terry-sysctl.pp' 4. /etc/puppet/manifests/terry/terry-sysctl.pp 定义了 sysctl 配置

sysctl 控制说明

主要由 /etc/puppet/manifests/terry/terry-site.pp 控制整个客户端的行为 为了能够更加好地进行主机管理, 我们为每个功能都独立地存放到一个 pp (模板) 文件中 (terry-sysctl.pp)

文件例:

sysctl::value { 'net.ipv4.ip_forward': value => '1', } sysctl::value { 'net.ipv4.tcp_max_syn_backlog': value => '4096', } sysctl::value { 'net.core.netdev_max_backlog' : value => '2048', } sysctl::value { 'net.ipv4.tcp_fin_timeout': value => '15', } sysctl::value { 'net.ipv4.tcp_tw_reuse': value => '1', } sysctl::value { 'net.ipv4.tcp_tw_recycle': value => '1', }

客户端配置

[main] logdir = /var/log/puppet rundir = /var/run/puppet ssldir = $vardir/ssl server = terry-test-uq2pu.vclound.com [agent] classfile = $vardir/classes.txt localconfig = $vardir/localconfig

客户端连接服务器方法

[root@terryzeng-gz-qa-dns-d4yzu ~]# puppet agent -t Warning: Setting modulepath is deprecated in puppet.conf. See http://links.puppetlabs.com/env-settings-deprecations (at /usr/lib/ruby/site_ruby/1.8/puppet/settings.rb:1095:in `issue_deprecations') Info: Retrieving pluginfacts Info: Retrieving plugin Info: Loading facts in /var/lib/puppet/lib/facter/root_home.rb Info: Loading facts in /var/lib/puppet/lib/facter/pe_version.rb Info: Loading facts in /var/lib/puppet/lib/facter/puppet_vardir.rb Info: Loading facts in /var/lib/puppet/lib/facter/facter_dot_d.rb Info: Caching catalog for terryzeng-gz-qa-dns-d4yzu.vclound.com Info: Applying configuration version '1485076119' Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_max_syn_backlog]/Sysctl[net.ipv4.tcp_max_syn_backlog]/ensure: created Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_max_syn_backlog]/Exec[exec_sysctl_net.ipv4.tcp_max_syn_backlog]/returns: executed successfully Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_tw_recycle]/Sysctl[net.ipv4.tcp_tw_recycle]/ensure: created Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_tw_recycle]/Exec[exec_sysctl_net.ipv4.tcp_tw_recycle]/returns: executed successfully Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_tw_reuse]/Sysctl[net.ipv4.tcp_tw_reuse]/ensure: created Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_tw_reuse]/Exec[exec_sysctl_net.ipv4.tcp_tw_reuse]/returns: executed successfully Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.ip_forward]/Sysctl[net.ipv4.ip_forward]/val: val changed '0' to '1' Notice: /Stage[main]/Main/Sysctl::Value[net.core.netdev_max_backlog]/Sysctl[net.core.netdev_max_backlog]/ensure: created Notice: /Stage[main]/Main/Sysctl::Value[net.core.netdev_max_backlog]/Exec[exec_sysctl_net.core.netdev_max_backlog]/returns: executed successfully Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_fin_timeout]/Sysctl[net.ipv4.tcp_fin_timeout]/ensure: created Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.tcp_fin_timeout]/Exec[exec_sysctl_net.ipv4.tcp_fin_timeout]/returns: executed successfully Notice: /Stage[main]/Main/Sysctl::Value[net.ipv4.ip_forward]/Exec[exec_sysctl_net.ipv4.ip_forward]/returns: executed successfully Notice: Finished catalog run in 0.98 seconds

验证客户端 sysctl.conf 配置

验证配置文件

[root@terryzeng-gz-qa-dns-d4yzu ~]# grep -v "#" /etc/sysctl.conf | grep -v ^$ net.ipv4.ip_forward=1 net.ipv4.conf.default.rp_filter=1 net.ipv4.conf.default.accept_source_route=0 kernel.sysrq=0 kernel.core_uses_pid=1 net.ipv4.tcp_syncookies=1 net.bridge.bridge-nf-call-ip6tables=0 net.bridge.bridge-nf-call-iptables=0 net.bridge.bridge-nf-call-arptables=0 kernel.msgmnb=65536 kernel.msgmax=65536 kernel.shmmax=68719476736 kernel.shmall=4294967296 net.ipv4.tcp_max_syn_backlog=4096 net.ipv4.tcp_tw_recycle=1 net.ipv4.tcp_tw_reuse=1 net.core.netdev_max_backlog=2048 net.ipv4.tcp_fin_timeout=15

说明:

服务器端 terry-sysctl.pp 已经定义的配置 对客户端 sysctl.conf 中原来没有的配置项会进行新增动作 对客户端 sysctl.conf 中原来已经的配置项会进行修改动作 服务器端 terry-sysctl.pp 没有定义的配置 对客户端 sysctl.conf 中原来已经拥有的配置, 不进行任何修改操作

验证客户端内核当前配置

[root@terryzeng-gz-qa-dns-d4yzu ~]# cat /proc/sys/net/ipv4/ip_forward 1 [root@terryzeng-gz-qa-dns-d4yzu ~]# cat /proc/sys/net/core/netdev_max_backlog 2048 [root@terryzeng-gz-qa-dns-d4yzu ~]# cat /proc/sys/net/ipv4/tcp_fin_timeout 15

说明

在修改 /etc/sysctl.conf 配置同时也一并对内核当前配置进行修改