SaltStack
1. 什么是SaltStack
是基于Python开发的一套C/S架构配置管理工具(不仅仅是配置管理: 如使用salt-cloud配置AWS EC2), 它的底层使用ZeroMQ消息队列pub/sub方式通信, 使用SSL证书签发的方式进行认证管理.
号称世界上最快的消息队列ZeroMQ使得SaltStack能快速在成千上万机器上进行各种操作, 而且采用RSA Key方式确认身份, 传输采用AES加密, 这使得它的安全性得到保障.
SaltStack 经常被描述为 Func加强版+Puppet精简版.
2. 为什么选择SaltStack?
目前市场上主流的开源自动化配置管理工具有puppet, chef, saltstack等等. 到底选择那个比较好? 可以从以下几方面考虑:
1). 开发语言的选择(puppet/chef vs ansible/saltstack)
Puppet, Chef基于Ruby开发, ansible/saltstack基于Python开发
运维开发语言热衷于Python(后期可做二次开发), 排除Puppet, Chef
2). 速度的选择( ansible vs saltstack)
ansible基于ssh协议传输数据, SaltStack使用消息队列zeroMQ传输数据. 从网卡数据来看, saltstack比ansible快大约40倍...
对比ansible, saltstack 缺点是需要安装客户端. 为了速度建议选择 saltstack.
saltstack github
saltstack官方文档地址
3. saltstack架构
在 saltstack 架构中服务端叫Master, 客户端叫 Minion, 都是以守护进程的模式运行, 一直监听配置文件中定义的ret_port(saltstack客户端与服务端通信的端口, 负责接收客户端发送过来的结果, 默认4506端口)和pulish_port(saltstack 消息发布系统, 默认4505端口)的端口. 当Minion运行时会自动连接到配置文件中定义的 Master地址 ret_port端口进行连接认证.
1). Master: 控制中心, salt命令运行和资源状态管理.
2). Minion: 需要管理的客户端机器, 会主动去连接 Master端, 并从 Master端得到资源状态信息, 同步资源管理信息.
3). States: 配置管理的指令集.
4). Modules: 在命令行中和配置文件中使用的指令模块, 可以在命令行中运行.
5). Grains: minion端是变量,静态的.
6). Pillar: minion端的变量, 动态的比较私密的变量, 可以通过配置文件实现同步minion定义.
7). highstate: 为minion端下发永久添加状态, 从sls配置文件读取, 即同步状态配置.
8). salt_schedule: 会自动保持客户端配置.
4. saltstack安装配置
以CentOS6为例安装minion,
CentOS7.5安装master, 采用yum 安装,
还有其它安装方式, 如pip, 源码, salt-booststrap
安装, 配置管理端(master): 以CentOS7.5为例:**
[root@localhost utils]# yum -y install salt-master
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
epel/x86_64/metalink | 8.6 kB 00:00:00
* base: mirrors.tuna.tsinghua.edu.cn
* epel: mirrors.tuna.tsinghua.edu.cn
* extras: mirrors.neusoft.edu.cn
* updates: mirrors.tuna.tsinghua.edu.cn
epel | 3.2 kB 00:00:00
(1/3): epel/x86_64/group_gz | 88 kB 00:00:00
(2/3): epel/x86_64/updateinfo | 935 kB 00:00:00
(3/3): epel/x86_64/primary | 3.6 MB 00:00:00
epel 12738/12738
Resolving Dependencies
--> Running transaction check
---> Package salt-master.noarch 0:2015.5.10-2.el7 will be installed
--> Processing Dependency: salt = 2015.5.10-2.el7 for package: salt-master-2015.5.10-2.el7.noarch
--> Running transaction check
---> Package salt.noarch 0:2015.5.10-2.el7 will be installed
--> Processing Dependency: python-zmq for package: salt-2015.5.10-2.el7.noarch
--> Processing Dependency: python-msgpack for package: salt-2015.5.10-2.el7.noarch
--> Processing Dependency: python-jinja2 for package: salt-2015.5.10-2.el7.noarch
--> Processing Dependency: python-crypto for package: salt-2015.5.10-2.el7.noarch
--> Running transaction check
---> Package python-jinja2.noarch 0:2.7.2-2.el7 will be installed
--> Processing Dependency: python-babel >= 0.8 for package: python-jinja2-2.7.2-2.el7.noarch
---> Package python-zmq.x86_64 0:14.3.1-1.el7 will be installed
--> Processing Dependency: libzmq.so.3()(64bit) for package: python-zmq-14.3.1-1.el7.x86_64
---> Package python2-crypto.x86_64 0:2.6.1-15.el7 will be installed
--> Processing Dependency: libtomcrypt.so.0()(64bit) for package: python2-crypto-2.6.1-15.el7.x86_64
---> Package python2-msgpack.x86_64 0:0.5.6-4.el7 will be installed
--> Running transaction check
---> Package libtomcrypt.x86_64 0:1.17-26.el7 will be installed
--> Processing Dependency: libtommath >= 0.42.0 for package: libtomcrypt-1.17-26.el7.x86_64
--> Processing Dependency: libtommath.so.0()(64bit) for package: libtomcrypt-1.17-26.el7.x86_64
---> Package python-babel.noarch 0:0.9.6-8.el7 will be installed
---> Package zeromq3.x86_64 0:3.2.5-1.el7 will be installed
--> Processing Dependency: libpgm-5.2.so.0()(64bit) for package: zeromq3-3.2.5-1.el7.x86_64
--> Running transaction check
---> Package libtommath.x86_64 0:0.42.0-6.el7 will be installed
---> Package openpgm.x86_64 0:5.2.122-2.el7 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
======================================================================================================
Package Arch Version Repository Size
======================================================================================================
Installing:
salt-master noarch 2015.5.10-2.el7 epel 1.0 M
Installing for dependencies:
libtomcrypt x86_64 1.17-26.el7 extras 224 k
libtommath x86_64 0.42.0-6.el7 extras 36 k
openpgm x86_64 5.2.122-2.el7 epel 171 k
python-babel noarch 0.9.6-8.el7 base 1.4 M
python-jinja2 noarch 2.7.2-2.el7 base 515 k
python-zmq x86_64 14.3.1-1.el7 epel 468 k
python2-crypto x86_64 2.6.1-15.el7 extras 477 k
python2-msgpack x86_64 0.5.6-4.el7 epel 64 k
salt noarch 2015.5.10-2.el7 epel 4.1 M
zeromq3 x86_64 3.2.5-1.el7 epel 344 k
Transaction Summary
======================================================================================================
Install 1 Package (+10 Dependent packages)
Total download size: 8.7 M
Installed size: 33 M
Is this ok [y/d/N]: y
Downloading packages:
(1/11): libtommath-0.42.0-6.el7.x86_64.rpm | 36 kB 00:00:04
(2/11): libtomcrypt-1.17-26.el7.x86_64.rpm | 224 kB 00:00:05
(3/11): python-jinja2-2.7.2-2.el7.noarch.rpm | 515 kB 00:00:04
(4/11): python-babel-0.9.6-8.el7.noarch.rpm | 1.4 MB 00:00:05
warning: /var/cache/yum/x86_64/7/epel/packages/openpgm-5.2.122-2.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 352c64e5: NOKEY
Public key for openpgm-5.2.122-2.el7.x86_64.rpm is not installed
(5/11): openpgm-5.2.122-2.el7.x86_64.rpm | 171 kB 00:00:05
(6/11): python-zmq-14.3.1-1.el7.x86_64.rpm | 468 kB 00:00:00
(7/11): python2-msgpack-0.5.6-4.el7.x86_64.rpm | 64 kB 00:00:00
(8/11): python2-crypto-2.6.1-15.el7.x86_64.rpm | 477 kB 00:00:00
(9/11): salt-2015.5.10-2.el7.noarch.rpm | 4.1 MB 00:00:00
(10/11): salt-master-2015.5.10-2.el7.noarch.rpm | 1.0 MB 00:00:00
(11/11): zeromq3-3.2.5-1.el7.x86_64.rpm | 344 kB 00:00:00
------------------------------------------------------------------------------------------------------
Total 1.2 MB/s | 8.7 MB 00:00:07
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
Importing GPG key 0x352C64E5:
Userid : "Fedora EPEL (7) <epel@fedoraproject.org>"
Fingerprint: 91e9 7d7c 4a5e 96f1 7f3e 888f 6a2f aea2 352c 64e5
Package : epel-release-7-11.noarch (@extras)
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
Is this ok [y/N]: y
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : python-babel-0.9.6-8.el7.noarch 1/11
Installing : python-jinja2-2.7.2-2.el7.noarch 2/11
Installing : python2-msgpack-0.5.6-4.el7.x86_64 3/11
Installing : libtommath-0.42.0-6.el7.x86_64 4/11
Installing : libtomcrypt-1.17-26.el7.x86_64 5/11
Installing : python2-crypto-2.6.1-15.el7.x86_64 6/11
Installing : openpgm-5.2.122-2.el7.x86_64 7/11
Installing : zeromq3-3.2.5-1.el7.x86_64 8/11
Installing : python-zmq-14.3.1-1.el7.x86_64 9/11
Installing : salt-2015.5.10-2.el7.noarch 10/11
Installing : salt-master-2015.5.10-2.el7.noarch 11/11
Verifying : openpgm-5.2.122-2.el7.x86_64 1/11
Verifying : python-jinja2-2.7.2-2.el7.noarch 2/11
Verifying : salt-master-2015.5.10-2.el7.noarch 3/11
Verifying : salt-2015.5.10-2.el7.noarch 4/11
Verifying : zeromq3-3.2.5-1.el7.x86_64 5/11
Verifying : libtommath-0.42.0-6.el7.x86_64 6/11
Verifying : python2-msgpack-0.5.6-4.el7.x86_64 7/11
Verifying : python2-crypto-2.6.1-15.el7.x86_64 8/11
Verifying : python-zmq-14.3.1-1.el7.x86_64 9/11
Verifying : python-babel-0.9.6-8.el7.noarch 10/11
Verifying : libtomcrypt-1.17-26.el7.x86_64 11/11
Installed:
salt-master.noarch 0:2015.5.10-2.el7
Dependency Installed:
libtomcrypt.x86_64 0:1.17-26.el7 libtommath.x86_64 0:0.42.0-6.el7
openpgm.x86_64 0:5.2.122-2.el7 python-babel.noarch 0:0.9.6-8.el7
python-jinja2.noarch 0:2.7.2-2.el7 python-zmq.x86_64 0:14.3.1-1.el7
python2-crypto.x86_64 0:2.6.1-15.el7 python2-msgpack.x86_64 0:0.5.6-4.el7
salt.noarch 0:2015.5.10-2.el7 zeromq3.x86_64 0:3.2.5-1.el7
Complete!
[root@localhost utils]#
注: 需要iptables开启master端 4505, 4506端口
iptables -A INPUT -p tcp -m multiport --dports 4505,4506 -j ACCEPT
systemctl stop firewalld.service # 关闭防火墙: 也可以只开放特定的端口.
systemctl start salt-master # 启动master服务
systemctl enable salt-master # 将salt master服务加入开机启动项
安装被管理端(minion) CentOS6.10
[root@localhost ~]# yum -y install salt-minion
Loaded plugins: fastestmirror, refresh-packagekit, security
Setting up Install Process
Loading mirror speeds from cached hostfile
* base: mirrors.neusoft.edu.cn
* epel: fedora.cs.nctu.edu.tw
* extras: mirrors.tuna.tsinghua.edu.cn
* updates: mirrors.tuna.tsinghua.edu.cn
Resolving Dependencies
--> Running transaction check
---> Package salt-minion.noarch 0:2015.5.10-2.el6 will be installed
--> Processing Dependency: salt = 2015.5.10-2.el6 for package: salt-minion-2015.5.10-2.el6.noarch
--> Running transaction check
---> Package salt.noarch 0:2015.5.10-2.el6 will be installed
--> Processing Dependency: python-zmq for package: salt-2015.5.10-2.el6.noarch
--> Processing Dependency: python-requests for package: salt-2015.5.10-2.el6.noarch
--> Processing Dependency: python-msgpack for package: salt-2015.5.10-2.el6.noarch
--> Processing Dependency: python-jinja2 for package: salt-2015.5.10-2.el6.noarch
--> Processing Dependency: m2crypto for package: salt-2015.5.10-2.el6.noarch
--> Processing Dependency: PyYAML for package: salt-2015.5.10-2.el6.noarch
--> Running transaction check
---> Package PyYAML.x86_64 0:3.10-3.1.el6 will be installed
--> Processing Dependency: libyaml-0.so.2()(64bit) for package: PyYAML-3.10-3.1.el6.x86_64
---> Package m2crypto.x86_64 0:0.20.2-9.el6 will be installed
---> Package python-jinja2.x86_64 0:2.2.1-3.el6 will be installed
--> Processing Dependency: python-babel >= 0.8 for package: python-jinja2-2.2.1-3.el6.x86_64
---> Package python-msgpack.x86_64 0:0.4.6-1.el6 will be installed
---> Package python-requests.noarch 0:2.6.0-4.el6 will be installed
--> Processing Dependency: python-urllib3 >= 1.10.2-1 for package: python-requests-2.6.0-4.el6.noarch
--> Processing Dependency: python-chardet >= 2.2.1-1 for package: python-requests-2.6.0-4.el6.noarch
---> Package python-zmq.x86_64 0:14.3.1-1.el6 will be installed
--> Processing Dependency: libzmq.so.3()(64bit) for package: python-zmq-14.3.1-1.el6.x86_64
--> Running transaction check
---> Package libyaml.x86_64 0:0.1.3-4.el6_6 will be installed
---> Package python-babel.noarch 0:0.9.4-5.1.el6 will be installed
---> Package python-chardet.noarch 0:2.2.1-1.el6 will be installed
---> Package python-urllib3.noarch 0:1.10.2-3.el6 will be installed
--> Processing Dependency: python-six for package: python-urllib3-1.10.2-3.el6.noarch
--> Processing Dependency: python-backports-ssl_match_hostname for package: python-urllib3-1.10.2-3.el6.noarch
---> Package zeromq3.x86_64 0:3.2.5-1.el6 will be installed
--> Processing Dependency: libpgm-5.1.so.0()(64bit) for package: zeromq3-3.2.5-1.el6.x86_64
--> Running transaction check
---> Package openpgm.x86_64 0:5.1.118-3.el6 will be installed
---> Package python-backports-ssl_match_hostname.noarch 0:3.4.0.2-5.el6 will be installed
--> Processing Dependency: python-backports for package: python-backports-ssl_match_hostname-3.4.0.2-5.el6.noarch
---> Package python-six.noarch 0:1.9.0-2.el6 will be installed
--> Running transaction check
---> Package python-backports.x86_64 0:1.0-5.el6 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
======================================================================================================================================================================================================
Package Arch Version Repository Size
======================================================================================================================================================================================================
Installing:
salt-minion noarch 2015.5.10-2.el6 epel 27 k
Installing for dependencies:
PyYAML x86_64 3.10-3.1.el6 base 157 k
libyaml x86_64 0.1.3-4.el6_6 base 52 k
m2crypto x86_64 0.20.2-9.el6 base 471 k
openpgm x86_64 5.1.118-3.el6 epel 165 k
python-babel noarch 0.9.4-5.1.el6 base 1.4 M
python-backports x86_64 1.0-5.el6 base 5.5 k
python-backports-ssl_match_hostname noarch 3.4.0.2-5.el6 base 12 k
python-chardet noarch 2.2.1-1.el6 base 230 k
python-jinja2 x86_64 2.2.1-3.el6 base 466 k
python-msgpack x86_64 0.4.6-1.el6 epel 69 k
python-requests noarch 2.6.0-4.el6 base 96 k
python-six noarch 1.9.0-2.el6 base 28 k
python-urllib3 noarch 1.10.2-3.el6 base 103 k
python-zmq x86_64 14.3.1-1.el6 epel 467 k
salt noarch 2015.5.10-2.el6 epel 4.2 M
zeromq3 x86_64 3.2.5-1.el6 epel 338 k
Transaction Summary
======================================================================================================================================================================================================
Install 17 Package(s)
Total download size: 8.3 M
Installed size: 33 M
Downloading Packages:
(1/17): PyYAML-3.10-3.1.el6.x86_64.rpm | 157 kB 00:00
(2/17): libyaml-0.1.3-4.el6_6.x86_64.rpm | 52 kB 00:00
(3/17): m2crypto-0.20.2-9.el6.x86_64.rpm | 471 kB 00:00
(4/17): openpgm-5.1.118-3.el6.x86_64.rpm | 165 kB 00:00
(5/17): python-babel-0.9.4-5.1.el6.noarch.rpm | 1.4 MB 00:00
(6/17): python-backports-1.0-5.el6.x86_64.rpm | 5.5 kB 00:00
(7/17): python-backports-ssl_match_hostname-3.4.0.2-5.el6.noarch.rpm | 12 kB 00:00
(8/17): python-chardet-2.2.1-1.el6.noarch.rpm | 230 kB 00:00
(9/17): python-jinja2-2.2.1-3.el6.x86_64.rpm | 466 kB 00:00
(10/17): python-msgpack-0.4.6-1.el6.x86_64.rpm | 69 kB 00:00
(11/17): python-requests-2.6.0-4.el6.noarch.rpm | 96 kB 00:00
(12/17): python-six-1.9.0-2.el6.noarch.rpm | 28 kB 00:00
(13/17): python-urllib3-1.10.2-3.el6.noarch.rpm | 103 kB 00:00
(14/17): python-zmq-14.3.1-1.el6.x86_64.rpm | 467 kB 00:00
(15/17): salt-2015.5.10-2.el6.noarch.rpm | 4.2 MB 00:02
(16/17): salt-minion-2015.5.10-2.el6.noarch.rpm | 27 kB 00:00
(17/17): zeromq3-3.2.5-1.el6.x86_64.rpm | 338 kB 00:00
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 797 kB/s | 8.3 MB 00:10
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : python-backports-1.0-5.el6.x86_64 1/17
Installing : python-backports-ssl_match_hostname-3.4.0.2-5.el6.noarch 2/17
Installing : openpgm-5.1.118-3.el6.x86_64 3/17
Installing : zeromq3-3.2.5-1.el6.x86_64 4/17
Installing : python-zmq-14.3.1-1.el6.x86_64 5/17
Installing : python-babel-0.9.4-5.1.el6.noarch 6/17
Installing : python-jinja2-2.2.1-3.el6.x86_64 7/17
Installing : m2crypto-0.20.2-9.el6.x86_64 8/17
Installing : libyaml-0.1.3-4.el6_6.x86_64 9/17
Installing : PyYAML-3.10-3.1.el6.x86_64 10/17
Installing : python-chardet-2.2.1-1.el6.noarch 11/17
Installing : python-msgpack-0.4.6-1.el6.x86_64 12/17
Installing : python-six-1.9.0-2.el6.noarch 13/17
Installing : python-urllib3-1.10.2-3.el6.noarch 14/17
Installing : python-requests-2.6.0-4.el6.noarch 15/17
Installing : salt-2015.5.10-2.el6.noarch 16/17
Installing : salt-minion-2015.5.10-2.el6.noarch 17/17
Verifying : salt-2015.5.10-2.el6.noarch 1/17
Verifying : PyYAML-3.10-3.1.el6.x86_64 2/17
Verifying : python-jinja2-2.2.1-3.el6.x86_64 3/17
Verifying : python-six-1.9.0-2.el6.noarch 4/17
Verifying : python-msgpack-0.4.6-1.el6.x86_64 5/17
Verifying : python-chardet-2.2.1-1.el6.noarch 6/17
Verifying : libyaml-0.1.3-4.el6_6.x86_64 7/17
Verifying : m2crypto-0.20.2-9.el6.x86_64 8/17
Verifying : python-babel-0.9.4-5.1.el6.noarch 9/17
Verifying : python-urllib3-1.10.2-3.el6.noarch 10/17
Verifying : python-zmq-14.3.1-1.el6.x86_64 11/17
Verifying : python-requests-2.6.0-4.el6.noarch 12/17
Verifying : openpgm-5.1.118-3.el6.x86_64 13/17
Verifying : zeromq3-3.2.5-1.el6.x86_64 14/17
Verifying : salt-minion-2015.5.10-2.el6.noarch 15/17
Verifying : python-backports-ssl_match_hostname-3.4.0.2-5.el6.noarch 16/17
Verifying : python-backports-1.0-5.el6.x86_64 17/17
Installed:
salt-minion.noarch 0:2015.5.10-2.el6
Dependency Installed:
PyYAML.x86_64 0:3.10-3.1.el6 libyaml.x86_64 0:0.1.3-4.el6_6 m2crypto.x86_64 0:0.20.2-9.el6 openpgm.x86_64 0:5.1.118-3.el6
python-babel.noarch 0:0.9.4-5.1.el6 python-backports.x86_64 0:1.0-5.el6 python-backports-ssl_match_hostname.noarch 0:3.4.0.2-5.el6 python-chardet.noarch 0:2.2.1-1.el6
python-jinja2.x86_64 0:2.2.1-3.el6 python-msgpack.x86_64 0:0.4.6-1.el6 python-requests.noarch 0:2.6.0-4.el6 python-six.noarch 0:1.9.0-2.el6
python-urllib3.noarch 0:1.10.2-3.el6 python-zmq.x86_64 0:14.3.1-1.el6 salt.noarch 0:2015.5.10-2.el6 zeromq3.x86_64 0:3.2.5-1.el6
Complete!
[root@localhost ~]#
sed -i 's@#master:.*@master: master_ipaddress@' /etc/salt/minion #master_ipaddress为管理端IP
echo 192.168.3.233 > /etc/salt/minion_id # 个人习惯使用IP, 默认主机名
service salt-minion start
chkconfig salt-minion on # 将 salt-minion 加入开机启动
service salt-minion start # 启动 minion 服务应该处于运行中
5. Master与Minion认证
Minion在第一次启动时, 会在/etc/salt/pki/minion (该路径在 /etc/salt/minion里面设置)下自动生成minion.pem( private key ) 和 minion.pub ( public key ), 然后将 minion.pub 发送给master. master 在接收到 minion的 public key后, 通过salt-key命令accept minion public key, 这样在 master 的/etc/salt/pki/master/minions 下将会存放以 minion id命名的public key, 然后master就能对minion发送指令了.
认证命令如下:
salt-key -L #查看当前证书签证情况
salt-key -A -y #同意签证所有没有接受的签证情况
saltstack 远程执行
salt '*' test.ping
salt '*' cmd.run 'ls -la'
salt执行命令的格式如下:
salt '<target>' <function> [arguments]
target: 执行 salt命令的minion目标. 可以使用正则表达式
function: 方法, 由moudle提供
arguments: function的参数
target可以是以下内容:
1). 正则表达式
salt -E 'Minion*' test.ping #主机名以Minion开头
2). 列表匹配
salt -L Minion,Minion1 test.ping
3). Grians匹配:
salt -G 'os.CentOS' test.ping
os:CentOS(默认存在)是Grains的键值对, 数据以yaml保存在minion上, 可在 minion端直接编辑 /etc/salt/grains, yaml格式.
或者在 master端执行:
salt '*' grains.setval key "{'sub-key': 'val', 'sub-key2': 'val2' }" # 命令 salt * sys.doc grains 查看文档
4). 组匹配
slat -N groups test.ping
如在master新建 /etc/salt/mater.d/nodegroups.conf, yaml格式
5). 复合匹配
salt -C 'G@os.CentOS or L@Minion' test.ping
6). Pillar值匹配
salt -I 'key:value' test.ping
/etc/salt/master 设置 pillar_roots, 数据以 yaml格式 保存在 master上
7). CIDR匹配:
salt -S '192.168.3.33/333' test.ping
192.168.3.33/333是一个指定的CIDR网段
**function是module提供的方法**
通过下面命令可以查看所有的function:
```bash
salt '192.168.3.333' sys.doc cmd
function可以接受参数:
salt '192.168.3.333' cmd.run 'whoami'
且支持关键字参数: ???
salt '192.168.3.333' cmd.run 'ls -lth' cwd=/ user=root # 以root 查看 / 目录内容
SaltStack配置管理
states文件
slat states的核心是sls文件, 此文件使用yaml语法定义了一些key/value的数据
sls文件存放根路径在master配置文件中定义, 默认为 /srv/salt, 此目录在OS上不存在, 需要手动创建.
mkdir -p /srv/salt
在salt中可以通过 salt://代替根路径, 如: salt://top.sls 其实就是 /srv/salt/top.sls
在states中top文件也由master配置文件定义, 默认为top.sls, 该文件为 states的入口文件.
一个简单的sls文件:
apache:
pkg:
- installed
service:
- running
- require:
- pgk: apache
说明:
此sls数据确保 apache软件包已经安装, 并且此服务正在运行
. 第一行: 被称为 ID说明 (ID Declartion ). ID表明可以操控的名字.
. 第二行和第四行是states说明(state declaration), 它们分别使用了pkg和service states.
pkg state: 通过系统的包管理其关键包.
service state: 管理系统服务(daemon)
在pkg及service列下边是运行的方法. 方法定义包和服务应该怎么做. 此处是软件包应该被安装,服务应该处于运行中.
. 第六行使用require(require statement), 说明只有当 apache安装成功时, 它的服务才启动起来.
state和方法可以通过点连起来, 上面sls文件和下面文件意思相同:
apache:
pkg: installed
serice: running
- require:
- pkg: apache
将此sls保存为init.sls并放在 salt://apache目录下, 结果如下:
/srv/salt
apache
init.sls
top.sls
top.sls定义的内容:
base:
'*':
- apache
说明:
第一行: 声明使用的base环境
第二行: 定义target. *为匹配所有
第三行: 声明使用哪些目录. salt会寻找每个目录下的 init.sls 文件.
master配置文件中定义了三种环境, 每种环境都可以定义多个目录, 但是要避免冲突.如:
#file_roots:
# base:
# - /srv/salt/
dev:
- /srv/salt/dev/services
- /srv/salt/dev/states
prod:
- /srv/salt/prod/services
- /srv/salt/prod/states
运行states
一旦创建完states并修改完top.sls之后, 你可以在master上执行下面命令:
salt '*' state.highstate
此命令会触发所有minion从master下载top.sls文件以及其中定义的states, 然后编译,执行.
执行完后, minion会将执行结果的摘要汇报给master.
特别提醒/警告
- CentOS6.10中 python2.6 的各种坑, 建议绕过 直接使用 CentOS7.5 安装 salt-master, 并用CentOS7.5上的 master 管理 CentOS6.10上的 minion.
yum -y install salt-master
- CentOS7.5中关闭防火墙为:
systemctl stop firewalld.service
- 查看防火墙状态:
firewall-cmd --state
- 启动master服务:
systemctl start salt-master
- 开机启动:
systemctl enable salt-master
[root@localhost utils]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
192.168.3.245
Rejected Keys:
[root@localhost utils]# salt-key -a '*'
The following keys are going to be accepted:
Unaccepted Keys:
192.168.3.245
Proceed? [n/Y] y
Key for minion 192.168.3.245 accepted.
[root@localhost utils]#
[root@localhost utils]# salt-key -L
Accepted Keys:
192.168.3.245
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@localhost utils]#
[root@localhost utils]# salt '*' test.ping
192.168.3.245:
True
[root@localhost utils]#
[root@localhost utils]# salt '*' cmd.run 'whoami'
192.168.3.245:
root
[root@localhost utils]# salt '*' cmd.run 'uname -a'
192.168.3.245:
Linux localhost.localdomain 2.6.32-754.el6.x86_64 #1 SMP Tue Jun 19 21:26:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost utils]# salt '*' cmd.run 'ifconfig'
192.168.3.245:
eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:95:70
inet addr:192.168.3.245 Bcast:192.168.255.255 Mask:255.255.0.0
inet6 addr: fe80::20c:29ff:fee4:9570/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:839289 errors:47 dropped:203 overruns:0 frame:0
TX packets:302427 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:970882269 (925.9 MiB) TX bytes:36745108 (35.0 MiB)
Interrupt:19 Base address:0x2000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:111771 errors:0 dropped:0 overruns:0 frame:0
TX packets:111771 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:13141871 (12.5 MiB) TX bytes:13141871 (12.5 MiB)
[root@localhost utils]#
复制目录到minion:
salt '*' cp.get_dir salt://install /root/salt-install gzip=9 makedir=True
