• Puppet扩展篇4-如何扩展master的SSL传输性能（nginx）
  • 1、安装编译nginx所需要的开发包
  • 2、安装passenger（将gem软件包copy到本地）
  • 3、解压nginx、pcre源码包
  • 4、编译并安装nginx
  • 5、与passenger结合
  • 6、复制启动脚本到
  • 7、配置nginx
  • 8、配置puppet.conf
  • 8、启动nginx
  • 9、测试

    Puppet扩展篇4-如何扩展master的SSL传输性能（nginx）

    描述：puppet使用SSL(https)协议来进行通讯，默认情况下，puppet server端使用基于Ruby的WEBRick HTTP服务器。由于WEBRick HTTP服务器在处理agent端的性能方面并不是很强劲，因此需要扩展puppet，搭建nginx或者其他强劲的web服务器来处理客户的https请求。

    需要解决的问题：

    • 扩展传输方式：提高性能并增加Master和agent之间的并发连接数量。
    • 扩展SSL：采用良好的SSL证书管理方法来加密Master和agent之间的通讯。

    Nginx+Passenger方式：

    1、安装编译nginx所需要的开发包

    1. [root@TKPUPT-M1 ~]# groupadd -g 3001 nginx
    2. [root@TKPUPT-M1 ~]# useradd -u 3001 -g 3001 nginx
    3. [root@TKPUPT-M1 ~]# yum install ruby-devel gcc make pcre-devel zlib-devel openssl-devel pam-devel curl-devel rpm-build

    2、安装passenger（将gem软件包copy到本地）

    备注：需要先将gem包下载到本地，当然也可以联网安装，会非常慢。

    1. [root@TKPUPT-M1 gem]# gem install --localhost rake rack passenger --no-rdoc --no-ri

    3、解压nginx、pcre源码包

    1. [root@TKPUPT-M1 gem]# tar xf pcre-8.32.tar.gz -C /usr/local/src/
    2. [root@TKPUPT-M1 gem]# tar xf nginx-1.4.2.tar.gz -C /usr/local/src/

    4、编译并安装nginx

    备注：主要是为了将模块passenger-config编译进来。

    1. [root@TKPUPT-M1 ~]# cd /usr/local/src/nginx-1.4.2/
    2. [root@TKPUPT-M1 nginx-1.4.2]# ./configure --user=nginx --group=nginx --prefix=/etc/nginx --with-http_stub_status_module --with-http_ssl_module --with-pcre=/usr/local/src/pcre-8.32 --add-module=`passenger-config --root`/ext/nginx
    3. [root@TKPUPT-M1 nginx-1.4.2]# make && make install

    5、与passenger结合

    备注：注意config.ru的属主和属组应该为puppet

    1. [root@TKPUPT-M1 nginx-1.4.2]# mkdir  -p /etc/puppet/rack/public
    2. [root@TKPUPT-M1 nginx-1.4.2]# cp /usr/share/puppet/ext/rack/config.ru  /etc/puppet/rack/
    3. [root@TKPUPT-M1 nginx-1.4.2]# chown -R puppet. /etc/puppet/rack/

    6、复制启动脚本到

    1. [root@TKPUPT-M1 init.d]# cp /root/gem/nginx /etc/init.d/
    2. [root@TKPUPT-M1 ~]# chmod a+x /etc/init.d/nginx

    7、配置nginx

    备注：注意和puppet结合的证书名称及路径

    1. [root@TKPUPT-M1 gem]# vim /etc/nginx/conf/nginx.conf
    2. user  nginx nginx;
    3. worker_processes  1;
    4. pid        /var/run/nginx.pid;
    6. events {
    7.     worker_connections  1024;
    8. }
    10. http {
    11.     passenger_root /usr/lib/ruby/gems/1.8/gems/passenger-4.0.19;
    12.     passenger_ruby /usr/bin/ruby;
    14.     include       mime.types;
    15.     default_type  application/octet-stream;
    17.     sendfile        on;
    18.     keepalive_timeout  65;
    20.     server {
    21.         listen 8140                ssl;
    22.     server_name                puppetmaster;
    24.     passenger_enabled          on;
    25.     passenger_set_cgi_param    HTTP_X_CLIENT_DN $ssl_client_s_dn;
    26.     passenger_set_cgi_param    HTTP_X_CLIENT_VERIFY $ssl_client_verify;
    27.     proxy_buffer_size 4000k;
    28.     proxy_buffering on;
    29.     proxy_buffers 32 1280k;
    30.     proxy_busy_buffers_size 17680k;
    31.     client_max_body_size 10m;
    32.     client_body_buffer_size 4096k;
    34.     access_log /var/log/nginx/puppet_access.log;
    35.     error_log /var/log/nginx/puppet_error.log;
    37.     root /etc/puppet/rack/public;
    39.     ssl off;
    40.     ssl_session_timeout 5m;
    41.     ssl_certificate /var/lib/puppet/ssl/certs/puppetmaster.pem;
    42.     ssl_certificate_key /var/lib/puppet/ssl/private_keys/puppetmaster.pem;
    43.     ssl_client_certificate /var/lib/puppet/ssl/certs/ca.pem;
    44.     ssl_crl /var/lib/puppet/ssl/ca/ca_crl.pem;
    45.     ssl_verify_client optional;
    47.     ssl_ciphers SSLv2:-LOW:-EXPORT:RC4+RSA;
    48.     ssl_prefer_server_ciphers on;
    49.     ssl_verify_depth 1;
    50.     ssl_session_cache shared:SSL:128m;
    52.     # File sections
    53.     location /production/file_content/files/ {
    54.       types { }
    55.       default_type application/x-raw;
    56.       alias /etc/puppet/files/;
    57.   }
    58.  }
    59. }

    8、配置puppet.conf

    1. [root@TKPUPT-M1 ~]# vim /etc/puppet/puppet.conf 
    2. [master]
    3.     certname = puppetmaster
    4.     ca       = false
    5.     ssl_client_verify_header = HTTP_X_CLIENT_VERIFY
    6.     ssl_client_header = HTTP_X_CLIENT_DN

    8、启动nginx

    1. [root@TKPUPT-M1 gem]# mkdir /var/log/nginx/
    2. [root@TKPUPT-M1 nginx-1.4.2]# /etc/init.d/puppetmaster stop
    3. [root@TKPUPT-M1 nginx-1.4.2]# chkconfig puppetmaster off
    4. [root@TKPUPT-M1 nginx-1.4.2]# /etc/init.d/nginx start
    5. [root@TKPUPT-M1 nginx-1.4.2]# chkconfig nginx on

    9、测试

    在多个节点发起puppet agent -t命令动作，查看nginx日志看nginx+passenger是否代理成功。

    1. [root@TKPUPT-CA ~]# puppet  agent -t
    2. [root@TKPUPT-M1 ~]# tailf  /var/log/nginx/puppet_access.log

    参考：http://projects.puppetlabs.com/projects/1/wiki/Using_Passenger