others linux服务器运维 django3 监控 k8s golang 数据库 大数据 前端 devops 理论基础 java oracle 运维日志

saltstack 文档

访问量:1385 创建时间:2020-11-18

官方文档:https://docs.saltstack.com/en/latest/contents.html

Salt产品介绍

一段三十秒的简介 Salt是这样的一个软件:

Centos7 Installation SaltStack安装指南

ip 角色
192.168.98.129 master
192.168.98.128 minion
192.168.98.66 minion

配置yum源,也可以使用阿里源

[root@localhost ~]# cat /etc/yum.repos.d/saltstack.repo
[saltstack-repo]
name=SaltStack repo for Red Hat Enterprise Linux $releasever
baseurl=https://repo.saltstack.com/yum/redhat/$releasever/$basearch/latest
enabled=1
gpgcheck=1
gpgkey=https://repo.saltstack.com/yum/redhat/$releasever/$basearch/latest/SALTSTACK-GPG-KEY.pub
       https://repo.saltstack.com/yum/redhat/$releasever/$basearch/latest/base/RPM-GPG-KEY-CentOS-7

128机器

yum -y install salt-master
systemctl enable salt-master.service
systemctl start salt-master.service

129,66机器

yum -y install salt-minion
systemctl enable salt-minion.service
systemctl start salt-minion.service

配置129,66 minion

vim /etc/salt/minion
master: 192.168.98.128

systemctl restart salt-minion.service

在128机器上执行

#查看未接受的minoin
[root@localhost ~]# salt-key -F
Local Keys:
master.pem:  4e:ce:10:9e:80:5c:d4:c9:da:93:77:c7:df:f9:58:26:a3:b2:a1:fc:cd:05:79:82:e8:de:8d:63:6f:3d:84:d6
master.pub:  78:1d:af:24:50:da:d5:89:0d:b9:d5:98:62:f1:5b:58:c1:a4:4d:83:1b:e7:6e:74:76:89:fa:59:f6:fb:6e:bc
Unaccepted Keys:
192.168.98.129:  1f:dd:cc:9a:56:ad:96:95:03:e7:6c:92:d6:0e:a4:5d:35:25:b3:f0:5d:80:46:18:cb:dd:d8:89:ae:86:f7:a0
#接受129主机(也可以用-A不跟主机参数接受所有主机,-d删除minoin)
[root@localhost ~]# salt-key -a 192.168.98.129
The following keys are going to be accepted:
Unaccepted Keys:
192.168.98.129
Proceed? [n/Y] y
Key for minion 192.168.98.129 accepted
[root@localhost ~]# salt-key 
Accepted Keys:
192.168.98.129
Denied Keys:
Unaccepted Keys:
Rejected Keys:
#测试ping
[root@localhost ~]# salt '*' test.ping
192.168.98.129:
    True
192.168.98.66:
    True
[root@localhost ~]# salt '*' cmd.run   'free -m' 
192.168.98.129:
                  total        used        free      shared  buff/cache   available
    Mem:            972         232         408           7         331         584
    Swap:          2047           0        2047

Salt Master 配置文件参数介绍:CONFIGURING THE SALT MASTER Salt Minion 配置文件参数介绍:Configuring the Salt Minion Salt Proxy Minion 参数介绍: Configuring the Salt Proxy Minion

Job作业管理

当管理的机器很多需要执行的job很多,分散管理会显得比较乱,在saltmaster集中管理, 既可以实现复用(例如校正时间),又不散乱。在saltstack中每次按时执行job会有对应的job id ,简称jid,master发送给minion要执行的job,minion缓存要执行的任务,执行后返回结果给master,master缓存结果在/var/cache/salt/master/jobs/中(默认保存24小时)。

#配置pillar_roots
[root@localhost ~]# vim /etc/salt/master
pillar_roots:
  base:
    - /srv/salt/pillar/
[root@localhost ~]# mkdir -pv /srv/salt/pillar/
[root@localhost ~]# cat /srv/salt/pillar/top.sls
base:
  "*":
    - schedule

[root@localhost ~]# cat /srv/salt/pillar/schedule.sls
schedule:
  testcase:
    function: cmd.run
    seconds: 10
    args:
      - 'date >> /tmp/test.cmd.log'
    kwargs:
      stateful: False

[root@localhost ~]# systemctl restart salt-master.service
#saltutil.refresh_pillar 刷新pillar,
[root@localhost ~]# salt "*" saltutil.refresh_pillar
192.168.98.66:
    True
192.168.98.129:
    True
#查看定义的schedule
[root@localhost ~]# salt "*" pillar.get schedule
#可以在minion机器查看 /tmp/test.cmd.log 
#查看job 历史
[root@localhost ~]# salt-run jobs.list_jobs
#saltutil.running 返回在proc目录中找到的所有正在运行的作业的数据。
#saltutil.find_job 根据作业ID返回有关某个作业的特定数据
[root@localhost ~]# salt '*' saltutil.find_job 20201201024000105125
#saltutil.signal_job ##给指定的jid进程发送single信号
#saltutil.term_job 发送终止信号(SIGTERM,15)到控制指定作业的进程。
#saltutil.kill_job 向控制指定作业的进程发送终止信号(SIGKILL,9)。

#salt-run jobs.list_jobs用于在查看具体job前找到此job的id
[root@localhost ~]# salt-run jobs.list_jobs | grep 2020 | tail -n5
        2020, Dec 01 02:48:50.138113
20201201024859907830:
        2020, Dec 01 02:48:59.907830
20201201024900161459:
        2020, Dec 01 02:49:00.161459
# salt-run jobs.lookup_jid <job id number> 查看具体job的返回结果
[root@localhost ~]# salt-run jobs.lookup_jid 20201201024900161459
192.168.98.129:

job 结果缓存24小时,如果是大规模的salt集群,可以设置job_cache为False,或者keep_jobs为1,来减少存储时间,keep_jobs设为0,不会清理缓存。

将salt任务结果保存到外部系统mysql

官方文档

作业执行后,每个Salt Minion将作业结果返回给Salt Master。这些结果存储在 默认作业缓存中。 除默认作业缓存外,Salt还提供了两种其他机制将作业结果发送到其他系统(数据库,本地syslog等): - 外部作业缓存(minions将结果保存到数据库) - 主作业缓存(minions将结果范围master,master将结果保存到数据库)

将salt结果保存到mysql中(主作业缓存),在128机器安装mysql并配置

[root@localhost ~]# yum install -y MySQL-python mariadb mariadb-server
[root@localhost ~]# systemctl start mariadb
[root@localhost ~]# systemctl enable mariadb
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
[root@localhost ~]# mysql_secure_installation
Enter current password for root (enter for none): 
Set root password? [Y/n] Y
New password: 
Re-enter new password: 
Remove anonymous users? [Y/n] Y
Disallow root login remotely? [Y/n] n
Remove test database and access to it? [Y/n] Y
Reload privilege tables now? [Y/n] Y
#配置mariadb字符集
[root@localhost ~]# vi /etc/my.cnf
[mysqld]
character-set-server=utf8 
[root@localhost ~]# systemctl restart mariadb

创建salt数据库与表,创建用户并授权

CREATE DATABASE  `salt`
  DEFAULT CHARACTER SET utf8
  DEFAULT COLLATE utf8_general_ci;

USE `salt`;

--
-- Table structure for table `jids`
--

DROP TABLE IF EXISTS `jids`;
CREATE TABLE `jids` (
  `jid` varchar(255) NOT NULL,
  `load` mediumtext NOT NULL,
  UNIQUE KEY `jid` (`jid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--
-- Table structure for table `salt_returns`
--

DROP TABLE IF EXISTS `salt_returns`;
CREATE TABLE `salt_returns` (
  `fun` varchar(50) NOT NULL,
  `jid` varchar(255) NOT NULL,
  `return` mediumtext NOT NULL,
  `id` varchar(255) NOT NULL,
  `success` varchar(10) NOT NULL,
  `full_ret` mediumtext NOT NULL,
  `alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  KEY `id` (`id`),
  KEY `jid` (`jid`),
  KEY `fun` (`fun`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--
-- Table structure for table `salt_events`
--

DROP TABLE IF EXISTS `salt_events`;
CREATE TABLE `salt_events` (
`id` BIGINT NOT NULL AUTO_INCREMENT,
`tag` varchar(255) NOT NULL,
`data` mediumtext NOT NULL,
`alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
`master_id` varchar(255) NOT NULL,
PRIMARY KEY (`id`),
KEY `tag` (`tag`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

grant all privileges on salt.* to salt@'%' identified by "salt";

配置salt master

[root@localhost ~]# vim /etc/salt/master
master_job_cache: mysql
mysql.host: '192.168.98.128'
mysql.user: 'salt'
mysql.pass: 'salt'
mysql.db: 'salt'
mysql.port: 3306
[root@localhost ~]# systemctl restart salt-master.service
#测试:在master运行命令,查看数据库存储的内容(测试过程省略)

Salt文件服务器 cp模块

salt通过内置的无状态的ZeroMQ(Salt文件服务器) 将文件从msater传输到minions. salt:// 路径等于/srv/salt,/srv/salt目录如果不存在,自己创建。

#在128机器操作
[root@localhost ~]# cat /etc/hosts > /srv/salt/hosts
[root@localhost ~]# salt '*' cp.get_file salt://hosts /root/hosts
192.168.98.129:
    /root/hosts
192.168.98.66:
    /root/hosts
#在129 minions机器查看
[root@localhost ~]# cat /root/hosts 
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
#在命令中使用template,
#salt '*' cp.get_file "salt://{{grains.os}}/vimrc" /etc/vimrc template=jinja
#使用gzip压缩
# salt '*' cp.get_file salt://vimrc /etc/vimrc gzip=5
#如果目标目录不存在,用makedirs创建目录
#salt '*' cp.get_file salt://vimrc /etc/vim/vimrc makedirs=True
salt '*' cp.get_dir salt://etc/apache2 /etc
#修改master上的配置文件
[root@localhost ~]# vim /etc/salt/master
file_recv: True
file_recv_max_size: 1000000
fileserver_backend:
  - roots
  - minionfs
[root@localhost ~]# systemctl restart salt-master.service
#测试cp.push
[root@localhost ~]# salt '*' cp.push /etc/hosts
192.168.98.129:
    True
192.168.98.66:
    True
[root@localhost ~]# ls /var/cache/salt/master/minions/192.168.98.66/files/etc/hosts 
/var/cache/salt/master/minions/192.168.98.66/files/etc/hosts

Grains 静态数据

静态数据,当Minion启动的时候收集的MInion本地的相关信息。(包含操作系统版本、内核版本、CPU、内存、硬盘、设备型号等,也可以在minion端自定义数据,一般很少使用)

列出所有的minion支持的数据 - grains.ls

[root@localhost ~]# salt '192.168.98.66' grains.ls

列出所有的grains数据 - grains.items

[root@localhost ~]# salt '192.168.98.66' grains.items

查看某个grain,返回键值对 - grains.item

[root@localhost ~]# salt '*' grains.item os
192.168.98.66:
    ----------
    os:
        CentOS
192.168.98.129:
    ----------
    os:
        CentOS

查看某个grain,返回值, grains.get os

[root@localhost ~]# salt '*' grains.get os
192.168.98.66:
    CentOS
192.168.98.129:
    CentOS
[root@localhost ~]# salt '*' grains.get ip_interfaces
192.168.98.129:
    ----------
    eth0:
        - 192.168.98.129
        - fe80::20c:29ff:fe1d:7fa4
    lo:
        - 127.0.0.1
        - ::1
192.168.98.66:
    ----------
    bond0:
        - 192.168.98.66
        - fe80::20c:29ff:fe20:b213
    eth0:
    eth1:
    lo:
        - 127.0.0.1
        - ::1

grains应用场景一: 通过-G 匹配特定主机

[root@localhost ~]# salt -G 'os:CentOS' test.ping
192.168.98.66:
    True
192.168.98.129:
    True

grains应用场景二: 在Pillar或Highstate中使用

#配置minion的grains,需要重启
[root@localhost ~]# vim /etc/salt/minion
grains:
  roles:
    - webserver
    - memcache
  deployment: datacenter4
  cabinet: 13
  cab_u: 14-15
[root@localhost ~]# systemctl restart salt-minion.service
#在salt master上查看minion上的grain
[root@localhost ~]# salt '192.168.98.129' grains.get roles
192.168.98.129:
    - webserver
    - memcache
[root@localhost ~]# salt '192.168.98.129' grains.get deployment
192.168.98.129:
    datacenter4

在salt state 中使用 {{ grains['key'] }}访问对应的值

Pillar 静态数据

pillar 存储位置:master端(grains是在minion端),数据类型:动态数据 ,数据采集方式:在master端定义,指定给对应的minion。可以使用saltuitl.refresh_pillar刷新。

配置pillar

[root@localhost ~]# vim /etc/salt/master
pillar_roots:
  base:
    - /srv/salt/pillar/
[root@localhost ~]# mkdir -pv /srv/salt/pillar/
[root@localhost ~]# vim /srv/salt/pillar/top.sls
base:
  "*":
    - packages

#packages.sls这个文件中使用了grains项目的值进行判断
[root@localhost ~]# vim /srv/salt/pillar/packages.sls
{% if grains['deployment'] == 'datacenter4' %}
webserver: httpd
{% elif %}
webserver: nginx
{% endif %}
[root@localhost ~]# systemctl restart salt-master.service
#刷新数据
[root@localhost ~]# salt '*' saltutil.refresh_pillar
192.168.98.66:
    True
192.168.98.129:
    True
[root@localhost ~]# salt '*'  pillar.get webserver
192.168.98.129:
    httpd
192.168.98.66:
#通过pillar匹配salt 目标
[root@localhost ~]# salt -I 'webserver:httpd' cmd.run 'uptime'
192.168.98.129:
     16:08:34 up  7:39,  2 users,  load average: 0.00, 0.01, 0.05

对以上2个文件进行解读:top.sls的base是个标识符,'*'表示所有机器, - packages表示本目录的packages.sls文件,结果就是将packages.sls文件定义的pillar数据应用到所有的minions上去

minion target

官方地址

基于grains

salt -G 'os:Centos' test.version

基于正则表达式 -E

salt -E 'virtmach[0-9]' test.version

列表 -L

salt -L 'foo,bar,baz,quo' test.version

组合 -C

salt -C 'G@os:Ubuntu and webser* or E@database.*' test.versio

salt States 配置管理

在master端,通过states文件来描述、配置minions的主机状态,例如:安装程序包、创建用户、传输文件、启动服务等。可以与pillar、grains结合

[root@localhost ~]# vim /etc/salt/master
#定义对应环境的目录
file_roots:
  base:
    - /srv/salt/
  dev:
    - /srv/salt/dev/
  prod:
    - /srv/salt/prod/
[root@localhost ~]# mkdir -pv /srv/salt/dev/
[root@localhost ~]# mkdir -pv /srv/salt/prod/
[root@localhost ~]# systemctl restart salt-master.service
[root@localhost ~]#mkdir /srv/salt/init/files -pv
[root@localhost salt]# cat /etc/hosts > /srv/salt/init/files/hosts
[root@localhost salt]# vim /srv/salt/init/files/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.98.128 master
[root@localhost ~]# cd /srv/salt/init/
#hosts.sls解析:第一行表示文件的目标位置,source表示从master的哪里来的,file.managed表示这个配置使用的的模块,user\group\mode,默认就是这样可以省略
[root@localhost init]# vim hosts.sls解析:第一行表示文件的目标位置,source表示从master的哪里来的,
/etc/hosts:
  file.managed:
    - source: salt://init/files/hosts
    - user: root
    - group: root
    - mode: 644
#手动推送配置测试:env=base可以省略,如果是dev或者prod环境不能省略
[root@localhost salt]# salt '192.168.98.129' state.sls init.hosts env=base
192.168.98.129:
----------
          ID: /etc/hosts
    Function: file.managed
      Result: True
     Comment: File /etc/hosts updated
     Started: 10:06:36.148114
    Duration: 110.967 ms
     Changes:   
              ----------
              diff:
                  --- 
                  +++ 
                  @@ -1,2 +1,3 @@
                   127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
                   ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
                  +192.168.98.128 master

Summary for 192.168.98.129
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time: 110.967 ms

#在129机器查看文件
[root@localhost ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.98.128 master

#通过state.highstate,同步所有机器状态
[root@localhost salt]# pwd
/srv/salt
#top.sls 文件解析,第一行base环境,第二行'*'所有目标机器,第三行应用init下的hosts配置
[root@localhost salt]# vim top.sls 
base:
  '*':
    - init.hosts
[root@localhost salt]# salt '*' state.highstate

Jinja 模板

模板系统,模板变量占位,在使用时对占位变量按要求进行替换为具体的值(例如对配置文件端口等各种参数进行配置)。

以下内容仅用于演示(对目标主机安装httpd,并对其端口进行修改):

[root@localhost salt]# yum install -y httpd
[root@localhost salt]# mkdir -pv /srv/salt/dev/files
mkdir: created directory ‘/srv/salt/dev/files’
[root@localhost salt]# cp /etc/httpd/conf/httpd.conf /srv/salt/dev/files
[root@localhost salt]# vim /srv/salt/dev/files/httpd.conf 
Listen {{ PORT }}
[root@localhost salt]# vim dev/httpd.sls 

httpd-install:
  pkg.installed:
    - name: httpd

httpd-files:
  file.managed:
    - name: /etc/httpd/conf/httpd.conf
    - source: salt://files/httpd.conf
    - requrie:
      - pkg: httpd-install
    - template: jinja
    - defaults:
      PORT: 8000

httpd-service:
  service.running:
    - name: httpd
    - enable: True
    - reload: True
[root@localhost salt]# salt '192.168.98.129' state.sls httpd saltenv='dev'
#在129机器验证httpd是否启动,端口是否对应

状态管理关系

unless

require 我依赖谁 require_in 谁依赖我

watch 我监控的状态,对方变化,我跟着变动 watch_in 我被某个状态监控

saltstack api

官方文档 通过python调用saltstack,在128机器安装salt模块

[root@localhost ~]# yum -y  install epel-release
[root@localhost ~]# yum -y install python-pip
[root@localhost ~]# pip install salt
[root@localhost ~]# python
Python 2.7.5 (default, Oct 14 2020, 14:45:30) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-44)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import salt.client
>>> client = salt.client.LocalClient()
>>> ret = client.cmd('*','test.ping')
>>> print ret
{u'192.168.98.129': True}
>>> client.cmd('*','cmd.run',['free -m'])
{u'192.168.98.129': u'              total        used        free      shared  buff/cache   available\nMem:            972         233         472           7         265         589\nSwap:          2047           0        2047'}
>>> 

官方文档

在salt master上安装

[root@localhost ~]# yum -y install salt-api salt-minion
[root@localhost ~]# pip install PyOpenSSL

生成自签证书

[root@localhost ~]# salt-call --local tls.create_self_signed_cert
[WARNING ] /usr/lib64/python2.7/site-packages/OpenSSL/crypto.py:14: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in a future release.
  from cryptography import utils, x509

local:
    Created Private Key: "/etc/pki/tls/certs/localhost.key." Created Certificate: "/etc/pki/tls/certs/localhost.crt."

配置master

[root@localhost ~]# vim /etc/salt/master
default_include: master.d/*.conf

#配置rest_cherrypy server文件
[root@localhost ~]# vim /etc/salt/master.d/api.conf
rest_cherrypy:
  host: 192.168.98.128
  port: 8000
  ssl_crt: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/certs/localhost.key

#认证配置文件
[root@localhost ~]# vim /etc/salt/master.d/auth.conf

external_auth:
  pam:
    saltapi:
      - .*
      - '@wheel'
      - '@runner'
      - '@jobs'

#创建认证用户,并设置密码
[root@localhost ~]# echo 'saltapi' | passwd --stdin saltapi
Changing password for user saltapi.

启动服务

[root@localhost ~]# systemctl restart salt-master.service
[root@localhost ~]# systemctl start salt-api

获取token

[root@localhost ~]# curl -sSk https://192.168.98.128:8000/login  -H 'Accept: application/x-yaml'   -d username=saltapi   -d password=saltapi  -d eauth=pam
return:
- eauth: pam
  expire: 1606931435.40494
  perms:
  - .*
  - '@wheel'
  - '@runner'
  - '@jobs'
  start: 1606888235.404939
  token: c3976482b5c0869ea6315a119fd52ec5b5517d19
  user: saltapi

test.ping测试

[root@localhost ~]# curl -sSk https://192.168.98.128:8000  -H 'Accept: application/x-yaml'   -H 'X-Auth-Token: c3976482b5c0869ea6315a119fd52ec5b5517d19'   -d client=local   -d tgt='*'  -d fun=test.ping
return:
- 192.168.98.129: true

cmd.run测试

[root@localhost ~]# curl -sSk https://192.168.98.128:8000 -H 'Accept: application/x-yaml'  -H 'X-Auth-Token: c3976482b5c0869ea6315a119fd52ec5b5517d19'   -d client=local  -d tgt='*'    -d fun='cmd.run' -d arg='uptime'
return:
- 192.168.98.129: ' 13:53:11 up  5:08,  2 users,  load average: 0.00, 0.01, 0.05'

获取json格式的grains

[root@localhost ~]# curl -sSk https://192.168.98.128:8000/minions/192.168.98.129 -H 'Accept: application/json' -H 'X-Auth-Token: c3976482b5c0869ea6315a119fd52ec5b5517d19'
{"return": [{"192.168.98.129": {"biosversion": "6.00", "kernel": "Linux", "domain": "localdomain", "uid": 0, "zmqversion": "4.1.4", "kernelrelease": "3.10.0-1160.el7.x86_64", "selinux": {"enforced": "Disabled", "enabled": false}, "serialnumber": "VMware-56 4d f5 b2 4f 22 1f 83-30 4e 73 f0 7b 1d 7f a4", "pid": 1207, "fqdns": [], "ip_interfaces": {"lo": ["127.0.0.1", "::1"]...省略部分输出...
登陆评论: 使用GITHUB登陆