1
2
3
4
5
6
7
8
9
10
11
12
13
14

|------------------+------------------------------------+-----------------------------------------------------------------------|
| 比较             | Puppet                             | Chef                                                                  |
|------------------+------------------------------------+-----------------------------------------------------------------------|
| 历史             | 有一些                             | 还年轻                                                                |
| 用户             | 多,有名的公司也在用                | 还比较少，但我认为有37signals在使用                                   |
| 开发的活跃度     | 中等                               | 活跃（感觉正在旺季）                                                  |
| 文档             | 多                                 | 也足够了                                                              |
| 设定文件         | 用专用的文法书写（外部DSL）        | 用Ruby书写（内部DSL）                                                 |
| 设定的构成       | 有点难懂                           | 相对容易理解,命名等很合适                                             |
| 依存关系的处理   | 运行次序是根据状况由系统端决定的。 | 好像Makefile 基本上是书写顺序。相比Puppet更具脚本风格                 |
| 必要的中间软件   | 没有                               | 服务端需要有CouchDB、RabbitMQ                                         |
| 安装             | 简单，用gem的安装就可以            | 服务端容易死。没有加入包中的话比较困难。客户端的话简单，只要gem就可以 |
| 和其他系统的协作 | 感觉基本上没有                     | 因为使用RESTful的服务API，用JSON可以取值，所以好像能做许多事          |
|------------------+------------------------------------+-----------------------------------------------------------------------|

1

debian ubuntu centos suse fedora redhat scientific amazon freebsd windows

1
2
3

package "vim" do
  action :install
end

1
2
3

service "ntpd" do
  action[:enable,:start]
end

1
2
3
4
5
6
7

user "random" do
  comment "Random User"
  uid 1000
  gid "users"
  home "/home/random"
  shell "/bin/zsh"
end

1
2
3
4
5
6
7

file "/tmp/something" do
  owner "root"
  group "root"
  mode "0755"
  action :create
  content "just test"
end

1
2
3
4
5
6

template "/tmp/config.conf" do
  source "config.conf.erb"
  variables(
    :config_var => node[:configs][:config_var]
  )
end

1
2
3
4
5
6
7
8
9
10
11

package "ntp" do
  action [:install]
end

template "/etc/ntp.conf" do
  source "ntp.conf.erb"   variables( :ntp_server => "time.nist.gov" )
end

service "ntpd" do
  action[:enable,:start]
end

1
2
3
4
5
6
7

include_recipe "ntp::default" package "mysql-server" do
  action :install
end

service "mysql-server" do
  action :start
end

1
2
3
4
5
6
7
8
9
10
11

knife node show client1.chefdemo.com

# here is output
Node Name:   client1.chefdemo.com
Environment: _default
FQDN:        client1.chefdemo.com
IP:          192.168.122.10
Run List:    recipe[ntp::default], recipe[mysql::default]
Roles:
Recipes:     ntp::default, mysql::default
Platform:    centos 6.2

1
2
3
4
5
6
7
8
9
10
11
12
13

knife role show mysql

# here is output
chef_type:            role
default_attributes:
description:
env_run_lists:
json_class:           Chef::Role
name:                 mysql
override_attributes:
run_list:
    recipe[ntp::default]
    recipe[mysql::default]

1
2
3
4
5
6
7

package "ntp" do
  action [:install]
end # 后面把这一条Resource简称为: 安装ntp的Resource

service "ntpd" do
  action[:enable,:start]
end # 后面把这一条Resource简称为: 启动ntp的Resource 

1
2
3
4
5
6
7

package "mysql-server" do
  action :install
end # 后面把这一条Resource简称为: 安装mysql-server的Resource 

service "mysql-server" do
  action :start
end # 后面把这一条Resource简称为: 启动mysql-server的Resource 

1

EDITOR=vim knife role create ntp_and_mysql

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

{
  "override_attributes": {
  },
  "chef_type": "role",
  "env_run_lists": {
  },
  "json_class": "Chef::Role",
  "name": "ntp_and_mysql",
  "run_list": [
    "recipe[ntp::default]",
    "recipe[mysql::default]"
  ],
  "default_attributes": {
  },
  "description": ""
}

1

knife node run list add client1.chefdemo.com 'role[ntp_and_mysql]' 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

tree /var/chef/cookbooks/ntp/

/var/chef/cookbooks/ntp/
├── attributes
├── definitions
├── files
│   └── default
├── libraries
├── metadata.rb
├── providers
├── README.md
├── recipes
│   ├── default.rb
│   └── ntp.rb
├── resources
└── templates
    └── default
        └── ntp.conf.erb

10 directories, 5 files

1

knife data bag create admin

1
2
3
4
5
6
7
8
9

mkdir -p /var/chef/data_bags/admin
vim /var/chef/data-bags/admin/william.json

{
    "id": "william",
    "shell": "/bin/bash",
    "comment": "william",
    "action": "create",
}

1
2

cd /var/chef
knife data bag from file admin william.json

1

data_bag("admin")# => ["william"] 

1

username=data_bag("admin")

1

data_bag_item('admins', 'charlie')# => {"id"=>"william", "shell"=>"/bin/bash", "comment"=>"william", "action"=>"create"} 

1
2
3
4
5

template "/etc/ntp.conf" do
  source "ntp.conf.erb"   variables(
    :ntp_server => node[:ntp_server]
  )
end

1
2
3
4
5
6
7

# generated by Chef. restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict -6 ::1
server <%= @ntp_server %>
server  127.127.1.0     # local clock driftfile /var/lib/ntp/drift
keys /etc/ntp/keys

1
2
3
4

.../template/host-client1.chefdemo.com/ntp.conf.erb
.../template/centos-6.2/ntp.conf.erb
.../template/centos/ntp.conf.erb
.../template/default/ntp.conf.erb

1
2
3
4

.../template/host-client1.chefdemo.com/ntp.conf.erb
.../template/ubuntu-12.04/ntp.conf.erb
.../template/ubuntu/ntp.conf.erb
.../template/default/ntp.conf.erb

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

### ssh ###

if platform?("redhat", "centos", "fedora")
    ssh_server = "sshd"
else
    ssh_server = "ssh"
end

service ssh_server do
    action :nothing
end

template "/etc/ssh/sshd_config" do
    source "sshd_config.erb"
    notifies :restart, resources(:service => ssh_server), :immediately
end

template "/etc/ssh/ssh_config" do
    source "ssh_config.erb"
    notifies :restart, resources(:service => ssh_server), :immediately
end

# generate ssh key, create /root/.ssh
execute "ssh-keygen" do
    command "ssh-keygen -t dsa -f /root/.ssh/id_rsa -N \"\""
    if File.exists?("/root/.ssh/id_rsa")
        action :nothing
    end
end

# add admins' keys
template "/root/.ssh/.keys" do
    source "keys.erb"
    owner "root"
    group "root"
    mode "0600"
end

# add group cyops and add root to it
group "cyops" do
    system true
    members "root"
end

# packages
package "vim" do
    action :install
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

users = data_bag('admin')

users.each do |login|
    # 每次处理一个用户,利用下面的方法得到一个用户的数据
    username = data_bag_item('admin', login)
    _action = username['action']

    # 利用user这个Resource添加删除用户
    user(login) do
        shell     username['shell']
        comment   username['comment']

        home      "/home/#{login}"
        supports  :manage_home => true
        if _action == "delete"
            action :remove
        end
    end

    # 创建.ssh目录,将key放里面
    if _action != "delete"
        directory "/home/#{login}/.ssh" do
            owner "#{login}"
        end

        file "/home/#{login}/.ssh/.keys" do
            content username['keys']
            owner "#{login}"
        end
    end
end

1
2
3

mv user.sh /usr/local/bin/user
chmod +x /usr/local/bin/user
user add admin william /home/william/.ssh/id_rsa.pub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

#!/bin/bash

chef_dir='/var/chef'
echo $#

function usage()
{
    echo "two few args"
    echo -e "Usage: \nuser add user_type user_name path_of_users_key"
    echo "user del user_type user_name"
    echo "user list user_type"
    echo "user list"
    exit
}

action=$1

if [ "$action" == "add" ]; then
    usertype=$2
    username=$3
    keypath=$4

    ls ${chef_dir}/data_bags/${usertype} &> /dev/null
    if [ "$?" != "0" ]; then
        echo "${usertype} doesn't exist"
        exit
    fi
    cat > ${chef_dir}/data_bags/${usertype}/${username}.json << EOF
{
    "id": "${username}",
    "shell": "/bin/bash",
    "comment": "${username}",
    "action": "create",
    "keys": "`cat ${keypath}`"
}
EOF

    cd $chef_dir
    knife data bag from file ${usertype} ${username}.json

    cd -
    cp ${keypath} ${chef_dir}/cookbooks/user/templates/default/${usertype}/${username}.key
    knife cookbook upload user
elif [ "$action" == "del" ]; then
    usertype=$2
    username=$3
    keypath=$4
    sed -i -e 's/create/delete/' ${chef_dir}/data_bags/${usertype}/${username}.json
    cd $chef_dir
    knife data bag from file ${usertype} ${username}.json
elif [ "$action" == "list" ]; then
    if [ "$2" != "" ]; then
        user_type=$2
        echo "Users in ${user_type}":
        echo '---------------------------'
        for i in `grep -R 'create' /var/chef/data_bags/${user_type}/ | awk '{print $1}' | sed -e "s/.*${user_type}\///" -e 's/\.json://'`
        do
            echo $i
        done
    else
        for i in `cd /var/chef/data_bags/; ls`
        do
            user_type=$i
            echo "Users in ${user_type}":
            echo '---------------------------'
            for i in `grep -R 'create' /var/chef/data_bags/${user_type}/ | awk '{print $1}' | sed -e "s/.*${user_type}\///" -e 's/\.json://'`
            do
                echo $i
            done
            echo
        done
    fi

else
    usage
fi