如何利用Puppet按先BACKUP后MASTER顺序部署主备VM节点？

针对你这种需要先部署BACKUP节点、再部署MASTER节点的Keepalived主备场景，我分享一套兼顾复用性、顺序控制和可靠性的实践方案：

1. 构建参数化的Keepalived Puppet类 #

首先把主备节点的配置差异抽象成参数，这样同一个类可以复用在两个节点，避免重复代码。核心思路是用参数区分state（MASTER/BACKUP）、priority（优先级，MASTER设更高值）等关键配置，配合EPP模板生成配置文件。

Puppet类代码示例 #

class keepalived::instance (
  String $state,
  Integer $priority,
  String $vip,
  String $interface,
  String $router_id = '51',
  String $auth_pass = '1111',
) {
  # 安装Keepalived包
  package { 'keepalived':
    ensure => installed,
  }

  # 生成主配置文件（使用EPP模板）
  file { '/etc/keepalived/keepalived.conf':
    content => epp('keepalived/keepalived.conf.epp', {
      state     => $state,
      priority  => $priority,
      vip       => $vip,
      interface => $interface,
      router_id => $router_id,
      auth_pass => $auth_pass,
    }),
    require => Package['keepalived'],
    notify  => Service['keepalived'],
  }

  # 确保Keepalived服务运行并开机自启
  service { 'keepalived':
    ensure => running,
    enable => true,
  }
}

对应的EPP模板（templates/keepalived/keepalived.conf.epp） #

global_defs {
  router_id <%= $router_id %>
}

vrrp_instance VI_1 {
    state <%= $state %>
    interface <%= $interface %>
    virtual_router_id 51
    priority <%= $priority %>
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass <%= $auth_pass %>
    }
    virtual_ipaddress {
        <%= $vip %>
    }
}

2. 用节点定义或Hiera区分主备角色 #

接下来给两个VM分配不同的参数，明确谁是BACKUP、谁是MASTER：

方式1：直接在site.pp中定义节点 #

# BACKUP节点配置
node 'backup-vm.example.com' {
  class { 'keepalived::instance':
    state     => 'BACKUP',
    priority  => 90,
    vip       => '192.168.1.200/24',
    interface => 'eth0',
  }
}

# MASTER节点配置
node 'master-vm.example.com' {
  class { 'keepalived::instance':
    state     => 'MASTER',
    priority  => 100,
    vip       => '192.168.1.200/24',
    interface => 'eth0',
  }
}

方式2：用Hiera实现更灵活的配置（推荐） #

如果你的环境用Hiera做配置管理，可以给每个节点创建对应的yaml文件：

• hieradata/backup-vm.example.com.yaml：

  keepalived::instance::state: 'BACKUP'
  keepalived::instance::priority: 90
  keepalived::instance::vip: '192.168.1.200/24'
  keepalived::instance::interface: 'eth0'
  

• hieradata/master-vm.example.com.yaml：

  keepalived::instance::state: 'MASTER'
  keepalived::instance::priority: 100
  keepalived::instance::vip: '192.168.1.200/24'
  keepalived::instance::interface: 'eth0'
  

3. 严格控制部署顺序的核心手段 #

Puppet默认是节点独立执行的，所以要确保BACKUP先部署完成，再部署MASTER，这里有两种常用方式：

方式1：手动触发执行顺序（适合小型环境） #

1. 先登录BACKUP节点，手动执行Puppet Agent同步配置：

   puppet agent -t
   

2. 确认BACKUP节点的Keepalived服务正常运行（systemctl status keepalived），并且VRRP监听正常（可以用tcpdump ip proto 112验证）。
3. 再登录MASTER节点执行puppet agent -t，完成MASTER节点的部署。

方式2：用Puppet Orchestrator自动化编排（适合企业级环境） #

如果使用Puppet Enterprise，Orchestrator可以帮你自动化控制节点部署顺序：

1. 创建一个编排任务，先执行BACKUP节点的Puppet run，设置任务依赖为“BACKUP执行成功后再执行MASTER”。
2. 通过CLI或控制台触发任务，全程自动化完成顺序部署。

可选：添加MASTER节点的前置检查 #

如果需要完全自动化且确保BACKUP已就绪，可以在MASTER节点的Puppet类中添加检查逻辑，确认BACKUP节点的Keepalived服务已运行：

# 在MASTER节点的类中添加（需确保PuppetDB可用）
exec { 'verify_backup_keepalived_ready':
  command => '/usr/bin/puppet query "nodes { certname = \'backup-vm.example.com\' and resources { type = \'Service\' and title = \'keepalived\' and parameters.ensure = \'running\' } }" | grep -q running',
  unless  => '/usr/bin/puppet query "nodes { certname = \'backup-vm.example.com\' and resources { type = \'Service\' and title = \'keepalived\' and parameters.ensure = \'running\' } }" | grep -q running',
  before  => Service['keepalived'],
  require => Package['puppet-agent'],
}

4. 部署后的验证 #

1. BACKUP节点部署完成后，检查是否未持有VIP（默认情况下，BACKUP节点在没有MASTER时会自动提升为MASTER，这是正常的，MASTER部署后会自动抢占）。
2. MASTER节点部署完成后，用ip addr查看VIP是否绑定在MASTER节点的网卡上。
3. 测试故障切换：停止MASTER节点的Keepalived服务，确认VIP自动切换到BACKUP节点；恢复MASTER服务后，VIP回到MASTER节点（如果未设置nopreempt参数）。

内容的提问来源于stack exchange，提问作者bilgo