puppet: facter实现Hierarchy查找

cat hiera.yaml 
---
:backends:
  - eyaml
:eyaml:
  :datadir: /etc/puppet/hieradata
  :gpg_gnupghome: /var/lib/puppet/gnupg
  :extension: yaml
:yaml:
  :datadir: /etc/puppet/hieradata
:hierarchy:
  - "%{::environment}/%{::clientcert}"
  - "%{::environment}/%{::role}-%{::tag}"
  - "%{::environment}/%{::role}-%{::datacenter}"
  - "%{::environment}/%{::tag}"
  - "%{::environment}/%{::role}"
  - "%{::environment}/%{::datacenter}"
  - "%{::environment}/common"
  - "%{::datacenter}"
  - "%{::role}"
  - global
:logger: console
# requires deep_merge Ruby gem
:merge_behavior: deeper  

# 作为facter来读取node的信息。
modules/common/lib/facter/company.rb 
# This facter fetch all user defined tags for current node.
# Fetch local file /etc/facter/facts.d/company.txt.

if Facter.value(:operatingsystem) == "windows"
  company_facts = 'c:\company.facts'
else
  company_facts = '/etc/facter/facts.d/company.txt'
end

if File.exist?(company_facts)
  File.readlines(company_facts).each do |line|
    if line =~ /^(.+)=(.+)$/
      key = $1.strip
      value = $2.strip
      Facter.add(key) do
        setcode { value }
      end
    end
  end
end

[!21 19:26:17 [e-mail] ~]$ cat /etc/facter/facts.d/company.txt 
datacenter=slv
role=multi_mysql

现在来测试一下结果，
[!26 19:27:09 [e-mail] ~]$ sudo facter|grep role # datacenter
role => multi_mysql
datacenter =>slv

此时得到了2个fact，然后传递给Master

cat  manifests/nodes.pp 

hiera_include('classes', [])

node default {

  include ntp

  include ulimits

  include etcdefaults

  include ossec

  include yumdownload

  include yum

  include ssh

  $packages = [

    'nc',

    'telnet',

    'screen',

    'tcpdump',

  ]

  package { $packages:

    ensure  => installed,

  }

}

node common {

  include profile::base

}

node dbserver inherits common {

  include selinux

  ......
 # Because logcheck doesn't works, remove it from cron job.

  # File /var/log/messages cannot be read: Permission denied

  file { '/etc/cron.d/logcheck':

    ensure  => absent;

  }

}

cat manifests/production.pp

node /21.db.*/ inherits dbserver {

  include splunkforwarder

  perconaserver::instance { '08':

    binlog_format             => 'STATEMENT',

    long_query_time           => '2',

    mysql_buffer_pool         => '50G',

    mysql_host                => 'localhost',

    mysql_root_password       => 'centos',

    mysql_server_id           => '210801',

    mount_dir                 => '/data/m08',

  }

}
添加module，名字为slow_log_converter, 

ls -l  module/slow_query_converter/

......

cat hieradata/production/multi_mysql.yaml 

---

classes:

  - role::multi_mysql

  - slow_query_converter

测试一下：
puppet agent -t --noop --tags slow_log_converter

    总结： hiear到底解决了什么问题？

    第一，也是比较常见的安全问题。比如
   node 1.xxx.com {
      class my_test_class {‘test':
         xxx           =>YYY,
        password   =>hiera('your_pwd'), #把密码放到yaml里面即便共享代码也没关系，也实现了代码和数据分离。
        }
    }
  
   第二，实现代码和数据分离，比如production和staging2个环境某些class和模块不同，可以定义在hiera,比如：
#production.yaml
---
ntp_server: '10.10.10.10'

#staging.yaml
---
ntp_server: '20.20.20.20'

# puppet.conf如下

[production]

    manifest   = $confdir/manifests/production.pp

    modulepath = $confdir/modules/
[staging]
......

#production.pp和staging.pp部分代码如下：
node default {
class my_test {'test':
    $ntp_server = hiera('ntp_server'),
......}
此时staging和production的结果不同，以后ntp服务器地址变了，可以只更新yaml文件。