☰

为什么这个 nginx/thin run puppet master 对路径的解释与单独的 puppetmasterd 不同？

tag-icon • tag-icon debian nginx puppet thin
为什么这个 nginx/thin run puppet master 对路径的解释与单独的 puppetmasterd 不同？

为了回答这个问题，我需要区分我的生产 Puppet Master 和开发 Puppet Master。无论哪种情况，我的 /etc/puppet/puppet.conf 都是：

[main]
ssldir=$vardir/ssl

[master]
certname=puppet

开发 Puppet Master 正在运行：

# puppetmasterd --debug --no-daemonize

生产 puppet master 是 thin/nginx 的事情。相关的 nginx 配置文件：

# /etc/nginx/sites-enabled/default
upstream puppet-production {
    server   unix:/var/run/puppet/master.00.sock;
    server   unix:/var/run/puppet/master.01.sock;
    server   unix:/var/run/puppet/master.02.sock;
}

server {
    listen puppet:8140;
    include conf.d/puppet_ssl.conf;
    include conf.d/puppet_proxy_set_header.conf;

    default_type application/x-raw;

    location /production/file_content/ {
        rewrite ^/production/file_content/([^/]+)/(.*) /$1/files/$2;
        break;
        root /etc/puppet/modules/;
    }
    location / {
        proxy_pass http://puppet-production;
    }
}

和

# /etc/nginx/conf.d/puppet_proxy_set_header.conf 
proxy_redirect         off; 
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $remote_addr;
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header    X-Client-Verify  $ssl_client_verify;
proxy_set_header    X-Client-Verify  SUCCESS;
proxy_set_header    X-Client-DN $ssl_client_s_dn;
proxy_set_header    X-SSL-Subject    $ssl_client_s_dn;
proxy_set_header    X-SSL-Issuer     $ssl_client_i_dn;

和

# /etc/nginx/conf.d/puppet_ssl.conf

ssl on; 
ssl_certificate /var/lib/puppet/ssl/certs/puppet.pem;
ssl_certificate_key /var/lib/puppet/ssl/private_keys/puppet.pem;
ssl_ciphers ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;
ssl_client_certificate  /var/lib/puppet/ssl/ca/ca_crt.pem;
ssl_verify_client       on;

相关的精简配置文件：

#/etc/puppet/config.ru 

# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.

# if puppet is not in your RUBYLIB:
# $:.unshift('/opt/puppet/lib')

$0 = "master"

# if you want debugging:
# ARGV << "--debug"

ARGV << "--rack"
require 'puppet/application/master'
# we're usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Application[:master].run

和

# /etc/supervisor/conf.d/puppetmaster.conf 

# This file is autogenerated by Puppet. Manual changes will be overwritten!
[program:puppetmaster]
command=/usr/bin/thin start -e development --socket /var/run/puppet/master.%(process_num)02d.sock --user puppet --group puppet --chdir /etc/puppet -R /etc/puppet/config.ru
process_name=%(program_name)s_%(process_num)02d
numprocs=3
priority=999
autostart=true
autorestart=unexpected
startsecs=3
startretries=3
exitcodes=0,2
stopsignal=TERM
stopwaitsecs=10
redirect_stderr=false
stdout_logfile=/var/log/supervisor/puppetmaster/puppetmaster.out
stdout_logfile_maxbytes=250MB
stdout_logfile_backups=10
stderr_logfile=/var/log/supervisor/puppetmaster/puppetmaster.err
stderr_logfile_maxbytes=250MB
stderr_logfile_backups=10

使用puppet 模块主管我发现manifests/init.pp在生产模式下运行时，源行路径会导致 404：

'/etc/logrotate.d/supervisor':
 source => 'puppet:///modules/supervisor/logrotate',
 require => Package[$supervisor::params::package];

但如果我修改路径为简单，puppet:///supervisor/logrotate 一切就都好了。第一种和第二种形式在开发模式下成功。我的理解是第一种形式是正确的并且我生产模式应该不会出现任何问题。

puppet agent --test当 master 配置为生产模式时运行会导致：

# puppet agent --test
info: Caching catalog for puppet.troutwine.us
info: Applying configuration version '1327957286'
err: /Stage[main]/Supervisor/File[/etc/logrotate.d/supervisor]/ensure: change from absent to file failed: Could not set 'file on ensure: Error 404 on SERVER: <html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>nginx/1.1.8</center>
</body>
</html>
 at /etc/puppet/modules/supervisor/manifests/init.pp:32
notice: Finished catalog run in 1.65 seconds

以及来自/var/log/nginx/access.log

# cat /var/log/nginx/{access,error}.log
127.0.1.1 - - [30/Jan/2012:20:50:58 +0000] "POST /production/catalog/puppet.troutwine.us HTTP/1.1" 200 13290 "-" "Ruby"
127.0.1.1 - - [30/Jan/2012:20:51:00 +0000] "GET  /production/file_metadata/modules/supervisor/logrotate? HTTP/1.1" 200 308 "-" "Ruby"
127.0.1.1 - - [30/Jan/2012:20:51:00 +0000] "GET /production/file_content/modules/supervisor/logrotate HTTP/1.1" 404 168 "-" "Ruby"
127.0.1.1 - - [30/Jan/2012:20:51:01 +0000] "PUT /production/report/puppet.troutwine.us HTTP/1.1" 200 14 "-" "Ruby"

2012/01/30 20:51:00 [error] 10716#0: *222 open() "/etc/puppet/modules/modules/files/supervisor/logrotate" failed (2: No such file or directory), client: 127.0.1.1, server: , request: "GET /production/file_content/modules/supervisor/logrotate HTTP/1.1", host: "puppet:8140"

有关我的环境的详细信息：

# puppet --version
2.7.9
# cat /etc/debian_version
6.0.3
# ruby -v
ruby 1.9.2p0 (2010-08-18 revision 29036) [i486-linux]

谁知道出了什么问题？

答案1

客户端节点请求的路径是：

/production/file_content/modules/supervisor/logrotate

虽然 nginx 配置似乎预期：

/production/file_content/supervisor/logrotate

因此，modules被第一次捕获捕获，并被supervisor/logrotate第二次捕获捕获；files需要放在模块名称和文件名之间的不在正确的位置并且modules被重复：

"/etc/puppet/modules/modules/files/supervisor/logrotate" failed (2: No such file or directory)

似乎您只需将重写规则更改为：

rewrite ^/production/file_content/modules/([^/]+)/(.*) /$1/files/$2;

相关内容