Puppet-resource
提供：Dev Guides
Puppet-リソース
リソースは、特定のインフラストラクチャまたはマシンを設計および構築するために使用されるPuppetの主要な基本ユニットの1つです。 これらは主に、システム構成のモデリングと保守に使用されます。 Puppetには複数のタイプのリソースがあり、それらを使用してシステムアーキテクチャを定義したり、ユーザーが新しいリソースを構築および定義したりできます。
マニフェストファイルまたはその他のファイル内のPuppetコードのブロックは、リソース宣言と呼ばれます。 コードのブロックは、宣言型モデリング言語（DML）と呼ばれる言語で記述されています。 以下は、どのように見えるかの例です。
user { 'vipin':
ensure => present,
uid => '552',
shell => '/bin/bash',
home => '/home/vipin',
}Puppetでは、特定のリソースタイプのリソース宣言はコードブロックで行われます。 次の例では、ユーザーは主に4つの事前定義されたパラメーターで構成されています。
- リソースタイプ-上記のコードスニペットでは、ユーザーです。
- リソースパラメータ-上記のコードスニペットでは、Vipinです。
- 属性-上記のコードスニペットでは、uid、shell、homeが確認されています。
- 値-これらは各プロパティに対応する値です。
各リソースタイプには、定義とパラメータを定義する独自の方法があり、ユーザーには、リソースの外観を選択する権限があります。
リソースタイプ
Puppetにはさまざまな種類のリソースがあり、それぞれ独自の機能を備えています。 これらのリソースタイプは、「describe」コマンドと「-list」オプションを使用して表示できます。
[root@puppetmaster ~]# puppet describe --list
These are the types known to puppet:
augeas - Apply a change or an array of changes to the ...
computer - Computer object management using DirectorySer ...
cron - Installs and manages cron jobs
exec - Executes external commands
file - Manages files, including their content, owner ...
filebucket - A repository for storing and retrieving file ...
group - Manage groups
host - Installs and manages host entries
interface - This represents a router or switch interface
k5login - Manage the ‘.k5login’ file for a user
macauthorization - Manage the Mac OS X authorization database
mailalias - .. no documentation ..
maillist - Manage email lists
mcx - MCX object management using DirectoryService ...
mount - Manages mounted filesystems, including puttin ...
nagios_command - The Nagios type command
nagios_contact - The Nagios type contact
nagios_contactgroup - The Nagios type contactgroup
nagios_host - The Nagios type host
nagios_hostdependency - The Nagios type hostdependency
nagios_hostescalation - The Nagios type hostescalation
nagios_hostextinfo - The Nagios type hostextinfo
nagios_hostgroup - The Nagios type hostgroup
nagios_service - The Nagios type service
nagios_servicedependency - The Nagios type servicedependency
nagios_serviceescalation - The Nagios type serviceescalation
nagios_serviceextinfo - The Nagios type serviceextinfo
nagios_servicegroup - The Nagios type servicegroup
nagios_timeperiod - The Nagios type timeperiod
notify - .. no documentation ..
package - Manage packages
resources - This is a metatype that can manage other reso ...
router - .. no documentation ..
schedule - Define schedules for Puppet
scheduled_task - Installs and manages Windows Scheduled Tasks
selboolean - Manages SELinux booleans on systems with SELi ...
service - Manage running services
ssh_authorized_key - Manages SSH authorized keys
sshkey - Installs and manages ssh host keys
stage - A resource type for creating new run stages
tidy - Remove unwanted files based on specific crite ...
user - Manage users
vlan - .. no documentation ..
whit - Whits are internal artifacts of Puppet's curr ...
yumrepo - The client-side description of a yum reposito ...
zfs - Manage zfs
zone - Manages Solaris zones
zpool - Manage zpoolsリソースタイトル
上記のコードスニペットでは、コードの同じファイルで使用される各リソースに固有のvipinとしてリソースタイトルがあります。 これは、このユーザーリソースタイプの一意のタイトルです。 競合が発生するため、同じ名前のリソースを持つことはできません。
リソースコマンドを使用すると、タイプuserを使用してすべてのリソースのリストを表示できます。
[root@puppetmaster ~]# puppet resource user
user { 'abrt':
ensure => 'present',
gid => '173',
home => '/etc/abrt',
password => '!!',
password_max_age => '-1',
password_min_age => '-1',
shell => '/sbin/nologin',
uid => '173',
}
user { 'admin':
ensure => 'present',
comment => 'admin',
gid => '444',
groups => ['sys', 'admin'],
home => '/var/admin',
password => '*',
password_max_age => '99999',
password_min_age => '0',
shell => '/sbin/nologin',
uid => '55',
}
user { 'tomcat':
ensure => 'present',
comment => 'tomcat',
gid => '100',
home => '/var/www',
password => '!!',
password_max_age => '-1',
password_min_age => '-1',
shell => '/sbin/nologin',
uid => '100',
}特定のユーザーのリソースの一覧表示
[root@puppetmaster ~]# puppet resource user tomcat
user { 'apache':
ensure => 'present',
comment => 'tomcat',
gid => '100',
home => '/var/www',
password => '!!',
password_max_age => '-1',
password_min_age => '-1',
shell => '/sbin/nologin',
uid => '100’,
}属性と値
リソースの本体は、属性と値のペアのコレクションで構成されています。 ここで、特定のリソースのプロパティの値を指定できます。 各リソースタイプには、キーと値のペアで設定できる独自の属性セットがあります。
特定のリソース属性に関する詳細を取得するために使用できるサブコマンドを説明します。 次の例では、ユーザーリソースに関する詳細と、その構成可能なすべての属性があります。
[root@puppetmaster ~]# puppet describe user
user
====
Manage users. This type is mostly built to manage system users,
so it is lacking some features useful for managing normal users.
This resource type uses the prescribed native tools for creating groups
and generally uses POSIX APIs for retrieving information about them.
It does not directly modify ‘/etc/passwd’ or anything.
**Autorequires:* *If Puppet is managing the user's primary group
(as provided in the ‘gid’ attribute),
the user resource will autorequire that group.
If Puppet is managing any role accounts corresponding to the user's roles,
the user resource will autorequire those role accounts.
Parameters
----------
-* *allowdupe* *
Whether to allow duplicate UIDs. Defaults to ‘false’.
Valid values are ‘true’, ‘false’, ‘yes’, ‘no’.
-* *attribute_membership* *
Whether specified attribute value pairs should be treated as the
* *complete list* *(‘inclusive’) or the* *minimum list* *(‘minimum’) of
attribute/value pairs for the user. Defaults to ‘minimum’.
Valid values are ‘inclusive’, ‘minimum’.
-* *auths* *
The auths the user has. Multiple auths should be
specified as an array.
Requires features manages_solaris_rbac.
-* *comment* *
A description of the user. Generally the user's full name.
-* *ensure* *
The basic state that the object should be in.
Valid values are ‘present’, ‘absent’, ‘role’.
-* *expiry**
The expiry date for this user. Must be provided in
a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
If you want to make sure the user account does never
expire, you can pass the special value ‘absent’.
Valid values are ‘absent’. Values can match ‘/^\d{4}-\d{2}-\d{2}$/’.
Requires features manages_expiry.
- **forcelocal* *
Forces the mangement of local accounts when accounts are also
being managed by some other NSS
-* *gid* *
The user's primary group. Can be specified numerically or by name.
This attribute is not supported on Windows systems; use the ‘groups’
attribute instead. (On Windows, designating a primary group is only
meaningful for domain accounts, which Puppet does not currently manage.)
-* *groups* *
The groups to which the user belongs. The primary group should
not be listed, and groups should be identified by name rather than by
GID. Multiple groups should be specified as an array.
-* *home* *
The home directory of the user. The directory must be created
separately and is not currently checked for existence.
-* *ia_load_module* *
The name of the I&A module to use to manage this user.
Requires features manages_aix_lam.
-* *iterations* *
This is the number of iterations of a chained computation of the
password hash (http://en.wikipedia.org/wiki/PBKDF2). This parameter
is used in OS X. This field is required for managing passwords on OS X
>= 10.8.
Requires features manages_password_salt.
-* *key_membership* *
-* *managehome* *
Whether to manage the home directory when managing the user.
This will create the home directory when ‘ensure => present’, and
delete the home directory when ‘ensure => absent’. Defaults to ‘false’.
Valid values are ‘true’, ‘false’, ‘yes’, ‘no’.
-* *membership* *
Whether specified groups should be considered the* *complete list* *
(‘inclusive’) or the* *minimum list* *(‘minimum’) of groups to which
the user belongs. Defaults to ‘minimum’.
Valid values are ‘inclusive’, ‘minimum’.
-* *name* *
The user name. While naming limitations vary by operating system,
it is advisable to restrict names to the lowest common denominator,
which is a maximum of 8 characters beginning with a letter.
Note that Puppet considers user names to be case-sensitive, regardless
of the platform's own rules; be sure to always use the same case when
referring to a given user.
-* *password* *
The user's password, in whatever encrypted format the local
system requires.
* Most modern Unix-like systems use salted SHA1 password hashes. You can use
Puppet's built-in ‘sha1’ function to generate a hash from a password.
*Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
Windows API
for setting the password hash.
[stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
Be sure to enclose any value that includes a dollar sign ($) in single
quotes (') to avoid accidental variable interpolation.
Requires features manages_passwords.
-* *password_max_age* *
The maximum number of days a password may be used before it must be changed.
Requires features manages_password_age.
-* *password_min_age* *
The minimum number of days a password must be used before it may be changed.
Requires features manages_password_age.
-* *profile_membership* *
Whether specified roles should be treated as the* *complete list* *
(‘inclusive’) or the* *minimum list* *(‘minimum’) of roles
of which the user is a member. Defaults to ‘minimum’.
Valid values are ‘inclusive’, ‘minimum’.
-* *profiles* *
The profiles the user has. Multiple profiles should be
specified as an array.
Requires features manages_solaris_rbac.
-* *project* *
The name of the project associated with a user.
Requires features manages_solaris_rbac.
-* *uid**
The user ID; must be specified numerically. If no user ID is
specified when creating a new user, then one will be chosen
automatically. This will likely result in the same user having
different UIDs on different systems, which is not recommended. This is
especially noteworthy when managing the same user on both Darwin and
other platforms, since Puppet does UID generation on Darwin, but
the underlying tools do so on other platforms.
On Windows, this property is read-only and will return the user's
security identifier (SID).