文章目录
1. saltstack简介
官网安装：http://repo.saltstack.com/
模块-官网文档：docs.saltstack.cn
- SaltStack是一个服务器基础架构集中化管理平台，具备配置管理、远程执行、监控等功能，一般可以理解为简化版的puppet和加强版的func。SaltStack基于Python语言实现，结合轻量级消息队列（ZeroMQ）与Python第三方模块（Pyzmq、PyCrypto、Pyjinjia2、python-msgpack和PyYAML等）构建。通过部署SaltStack环境，我们可以在成千上万台服务器上做到批量执行命令，根据不同业务特性进行配置集中化管理、分发文件、采集服务器数据、操作系统基础及软件包管理等，SaltStack是运维人员提高工作效率、规范业务配置与操作的利器。
特点
- 基于python开发的C/S架构配置管理工具
- 底层使用ZeroMQ消息队列pub/sub方式通信
- 使用SSL证书签发的方式进行认证管理，传输采用AES加密
服务架构
- 服务器端：Master
- 客户端：Minion
功能
- 远程执行
- 配置管理/状态管理
- 云管理(cloud)
- 事件驱动
运行方式
- local本地运行
- Master/Minion传统方式
- Syndic分布式
- Salt ssh
配置文件
- /etc/salt/master：主控端（控制端）配置文件
- /etc/salt/minion：受控端配置文件
2. 安装与配置
master端：
server1：192.168.17.1
minion端：
server2：192.168.17.2
server3:192.168.17.3
2.1 minion端配置
- 配置软件仓库
vim /etc/yum.repos.d/salt-3000.repo
[salt-3000]
name=SaltStack 3000 Release Channel for Python 2 RHEL/Centos $releasever
baseurl=https://mirrors.aliyun.com/saltstack/yum/redhat/7/$basearch/3000
failovermethod=priority
enabled=1
gpgcheck=0
gpgkey=file:///etc/pki/rpm-gpg/saltstack-signing-key, file:///etc/pki/rpm-gpg/centos7-signing-key
- 安装salt-minion
yum install -y salt-minion
- 设置对应的master端
vim /etc/salt/minion
16 master: 192.168.17.1
- 开启服务
systemctl enable --now salt-minion
- 每次修改主机名后，都要删除/etc/salt/minion_id此文件，并修改解析
2.2 master端配置
- 配置软件仓库
yum install -y https://repo.saltstack.com/yum/redhat/salt-repo-3000.el7.noarch.rpm
sed -i "s/repo.saltstack.com/mirrors.aliyun.com\/saltstack/g" /etc/yum.repos.d/salt-latest.repo
cat /etc/yum.repos.d/salt-3000.repo
[salt-3000]
name=SaltStack 3000 Release Channel for Python 2 RHEL/Centos $releasever
baseurl=https://mirrors.aliyun.com/saltstack/yum/redhat/7/$basearch/3000
failovermethod=priority
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/saltstack-signing-key, file:///etc/pki/rpm-gpg/centos7-signing-key
- 安装salt-master
yum install -y salt-master
- 开启服务
systemctl enable --now salt-master
- 认证
salt-key -A：接受所有minion等待认证的key
salt-key -L：列出所有公钥信息
-a minion#接受指定minion等待认证的key
-r minion#拒绝指定minion等待认证的key
-R#拒绝所有minion等待认证的key
2.3 远程测试
- 查看端口及进程
yum install -y lsof#可以显示监听端口详细信息
yum install -y python-setproctitle#可以显示进程详细信息
systemctl restart salt-master.service
- 测试
salt '*' test.ping
salt '*' cmd.run hostname
salt '*' cmd.run 'uname -a'
3. 远程执行shell命令
salt 'server2' sys.doc pkg：查看模块文档
- 测试httpd
#安装httpd
salt server2 pkg.install httpd
#列出安装包
salt server2 cmd.run 'rpm -q httpd'
##开启服务
salt server2 service.start httpd
- 复制文件
echo server2 > index.html
salt-cp server2 index.html /var/www/html/
4. 编写.sls文件
- 有apache.sls和apache目录，先匹配apache.sls
- 调用时不加.sls后缀
mkdir -p /srv/salt/apache/files
- 关于httpd的不同书写方式
执行 salt minion主机 state.sls apache.install 运行
#apache/install.sls
httpd:
pkg.installed
#apache/install.sls
apache:
pkg.installed:
- pkgs:
- httpd
- php
#apache/install.sls
apache:
pkg.installed:
- pkgs:
- httpd
- php
file.managed:
- source: salt://apache/files/index.html#此文件内容一修改，运行时就会显示有改变，因为有md5sum码
- name: /var/www/html/index.html
#apache/install.sls
apache:
pkg.installed:
- pkgs:
- httpd
- php
/var/www/html/index.html:
file.managed:
- source: salt://apache/files/index.html
httpd:
service.running
#apache/install.sls
apache:
pkg.installed:
- pkgs:
- httpd
- php
file.managed:
- source: salt://apache/files/index.html
- name: /var/www/html/index.html
service.running:
- name: httpd
- 修改端口
cp /etc/httpd/conf/httpd.conf apache/files/：复制模板文件
vim apache/files/httpd.conf：修改端口检测
salt server2 state.sls apache.install
#apache/install.sls
apache:
pkg.installed:
- pkgs:
- httpd
- php
file.managed:
- source: salt://apache/files/index.html
- name: /var/www/html/index.html
service.running:
- name: httpd
- enable: true
- reload: true
- watch:
- file: /etc/httpd/conf/httpd.conf
/etc/httpd/conf/httpd.conf:
file.managed:
- source: salt://apache/files/httpd.conf
#apache/install.sls
apache:
pkg.installed:
- pkgs:
- httpd
- php
file.managed:
- source: salt://apache/files/httpd.conf
- name: /etc/httpd/conf/httpd.conf
service.running:
- name: httpd
- enable: true
- watch:
- file: apache
5. 编写远程执行模块 _modules
-
mkdir /srv/salt/_modules：创建模块目录 -
vim _modules/mydisk.py：编写模块
def df():
return __salt__['cmd.run']('df -h')
salt server2 cmd.run df
salt server2 saltutil.sync_modules：同步模块
- 同步后可在minion主机的 /var/cache/salt/minion/extmods/modules/ 查看到
6. grains配置（存放在minion端）
-
Grains是SaltStack的一个组件，存放在SaltStack的minion端。
-
当salt-minion启动时会把收集到的数据静态存放在Grains当中，只有当minion重启时才会进行数据的更新。
-
由于grains是静态数据，因此不推荐经常去修改它。
-
应用场景:
- 信息查询，可用作CMDB
- 在target中使用，匹配minion
- 在state系统中使用，配置管理模块。
-
master端查看信息
#列出每一项
salt server2 grains.ls
#查看每一项的具体值
salt server2 grains.items
#查看单项的值
salt server2 grains.item ipv4
salt server2 grains.item fqdn
6.1 minion端添加grains
server2
[root@server2 ~]# vim /etc/salt/minion
129 grains:
130 roles:
131 - apache
[root@server2 ~]# systemctl restart salt-minion
server3
[root@server3 ~]# vim /etc/salt/minion
129 grains:
130 roles:
131 - nginx
[root@server3 ~]# systemctl restart salt-minion.service
在master端查看
salt server2 grains.item roles
salt server3 grains.item roles
6.2 编写grains模块
- 编写
mkdir /srv/salt/_grains
vim /srv/salt/_grains/mygrains.py
def my_grains():
grains = {
}
grains['salt'] = 'stack'
grains['hello'] = 'world'
return grains
- 同步grains模块到minion端
salt '*' saltutil.sync_grains
可以在minion端查看到 /var/cache/salt/minion/files/base/_grains/mygrains.py
- 列出grains
salt '*' grains.item salt
salt '*' grains.item hello
6.3 grains匹配运用
- 在target中匹配minion
salt -G roles:apache cmd.run hostname
salt -G roles:nginx test.ping
salt -G salt:stack test.ping
salt -G hello:world test.ping
- top.sls文件匹配
mkdir -p /srv/salt/nginx/files/
[root@server1 salt]# ls nginx/files/
nginx-1.18.0.tar.gz
vim /srv/salt/top.sls
base:
'roles:apache':
- match: grain
- apache
'roles:nginx':
- match: grain
- nginx
vim /srv/salt/nginx/init.sls
nginx:
file.managed:
- source: salt://nginx/files/nginx-1.18.0.tar.gz
- name: /mnt/nginx-1.18.0.tar.gz
salt '*' state.highstate：读取所有环境的top.sls文件
7. nginx应用
cd /src/salt/
vim nginx/files/nginx.service
[Unit]
Description=The NGINX HTTP and reverse proxy server
After=syslog.target network.target remote-fs.target nss-lookup.target
[Service]
Type=forking
PIDFile=/usr/local/nginx/logs/nginx.pid
ExecStartPre=/usr/local/nginx/sbin/nginx -t
ExecStart=/usr/local/nginx/sbin/nginx
ExecReload=/usr/local/nginx/sbin/nginx -s reload
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true
[Install]
WantedBy=multi-user.target
vim nginx/install.sls
nginx-install:
pkg.installed:
- pkgs:
- gcc
- pcre-devel
- openssl-devel
file.managed:
- source: salt://nginx/files/nginx-1.18.0.tar.gz
- name: /mnt/nginx-1.18.0.tar.gz
cmd.run:
- name: cd /mnt && tar zxf nginx-1.18.0.tar.gz && cd nginx-1.18.0 && ./configure --prefix=/usr/local/nginx --with-http_ssl_module &> /dev/null && make &> /dev/null && make install &> /dev/null
- creates: /usr/local/nginx
vim nginx/init.sls
include:
- nginx.install
/usr/local/nginx/conf/nginx.conf:
file.managed:
- source: salt://nginx/files/nginx.conf
nginx-service:
user.present:
- name: nginx
- shell: /sbin/nologin
- home: /usr/local/nginx
- createhome: false
file.managed:
- source: salt://nginx/files/nginx.service
- name: /usr/lib/systemd/system/nginx.service
service.running:
- name: nginx
- enable: true
- reload: true
- watch:
- file: /usr/local/nginx/conf/nginx.conf
salt server3 state.sls nginx.installscp server3:/usr/local/nginx/conf/nginx.conf nginx/files/vim nginx/files/nginx.conf
user nginx;
salt server3 state.sls nginx
8. jinja模板
- 定义：
{% XXX %} - 引用：
{ { XXX }}
8.1 示例1
vim test.sls
/mnt/testfile:
file.append:
{
% if grains['fqdn'] == 'server2' %}
- text: server2
{
% elif grains['fqdn'] == 'server3' %}
- text: server3
{
% endif %}
salt '*' state.sls test- 查看实验结果
8.2 apache结合jinja模板
cd /src/salt/
vim apache/init.sls
apache:
pkg.installed:
- pkgs:
- httpd
file.managed:
- source: salt://apache/files/httpd.conf
- name: /etc/httpd/conf/httpd.conf
- template: jinja
- context:
port: 80
bind: {
{
grains['ipv4'][-1] }}
service.running:
- name: httpd
- enable: true
- watch:
- file: apache
/var/www/html/index.html:
file.managed:
- source: salt://apache/files/index.html
- template: jinja
- context:
NAME: {
{
grains['ipv4'][-1] }}
vim apache/files/index.html
{
{
grains['os'] }} - {
{
grains['fqdn'] }}
{
{
NAME }}
vim apache/files/httpd.conf
Listen {
{
bind }}:{
{
port }}
salt server2 state.sls apache- 在minion端查看实验结果
