目录
masterless
应用场景
- master 与 minion 网络不通或通信有延迟,即网络不稳定
- 想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理,但是当网络不稳定的时候,当想在minion本地执行状态的时候,当在只有一台主机的时候,想执行状态该怎么办呢?这就需要用到 masterless 了。
有了masterless,即使你只有一台主机,也能玩saltstack,而不需要你有N台主机架构。
masterless配置
修改minion配置文件
- 注释master行
- 取消注释file_client并设其值为local
- 设置file_roots
- 设置pillar_roots
[root@node3 ~]# vim /etc/salt/minion
···
#master: 192.168.8.130
···
file_client: local
···
file_roots:
base:
- /srv/salt
关闭salt-minion服务
使用 masterless 模式时是不需要启动任何服务的,包括salt-master和salt-minion。
[root@node3 ~]# systemctl stop salt-minion.service
salt-call
masterless模式执行模块或状态时需要使用salt-call命令,而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。
[root@node3 ~]# salt-call --local cmd.run "date"
local:
Mon Nov 29 14:21:40 CST 2021
[root@node3 ~]# salt-call --local pkg.install 'httpd'
local:
----------
apr:
----------
new:
1.6.3-12.el8
old:
apr-util:
----------
new:
1.6.1-6.el8
old:
······
salt-master高可用
涉及到高可用时,数据的同步是个永恒的话题,我们必须保证高可用的2个master间使用的数据是一致的,包括:
- /etc/salt/master配置文件
- /etc/salt/pki目录下的所有key
- /srv/下的salt和pillar目录下的所有文件
保障这些数据同步的方案有:
- nfs挂载
- rsync同步
- 使用gitlab进行版本控制
安全相关:
为保证数据的同步与防止丢失,可将状态文件通过gitlab进行版本控制管理。
同步master数据
- 创建备机master
- 将主机master密钥复制到备机master上
- 启动备机master
- 配置minion连接到备机master
- 重启minion
- 接受备机master上的密钥
同步master配置文件和所有的key
[root@master ~]# scp /etc/salt/master 192.168.8.133:/etc/salt/master
root@192.168.8.133's password:
master 100% 52KB 17.0MB/s 00:00
[root@master ~]#
[root@master2 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
└── minion
[root@master ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│ ├── master.pem
│ ├── master.pub
│ ├── minions
│ │ ├── node1
│ │ ├── node2
│ │ └── node3
│ ├── minions_autosign
│ ├── minions_denied
│ ├── minions_pre
│ │ └── 192.168.8.130
│ ├── minions_rejected
│ └── ssh
│ ├── salt-ssh.rsa
│ └── salt-ssh.rsa.pub
└── minion
├── minion_master.pub
├── minion.pem
└── minion.pub
[root@master ~]# scp /etc/salt/pki/master/master.p* 192.168.8.133:/etc/salt/pki/master/
root@192.168.8.133's password:
master.pem 100% 1675 973.9KB/s 00:00
master.pub 100% 451 470.6KB/s 00:00
[root@master ~]#
[root@master2 pki]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│ ├── master.pem
│ └── master.pub
└── minion
[root@master2 pki]# systemctl start salt-master.service
[root@master2 pki]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│ ├── master.pem
│ ├── master.pub
│ ├── minions
│ ├── minions_autosign
│ ├── minions_denied
│ ├── minions_pre
│ └── minions_rejected
└── minion
7 directories, 2 files
配置minion连接备机master
[root@node1 ~]# vim /etc/salt/minion
master: 192.168.8.133
[root@node1 ~]# systemctl restart salt-minion.service
[root@master2 pki]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
Rejected Keys:
[root@master2 pki]# salt-key -ya node1
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@master2 pki]# salt node1 test.ping
node1:
True
修改minion配置文件实现高可用
[root@node1 ~]# vim /etc/salt/minion
···
master_type: failover
···
master_alive_interval: 3
···
master:
- 192.168.8.130
- 192.168.8.133
[root@node1 ~]# systemctl restart salt-minion.service
[root@master ~]# salt node1 test.ping
node1:
True
[root@master2 pki]# salt node1 test.ping
node1:
Minion did not return. [No response]
The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:
salt-run jobs.lookup_jid 20211129072727657662
#关闭主节点salt-master
[root@master ~]# systemctl stop salt-master.service
[root@master2 pki]# salt node1 test.ping
node1:
True
salt-syndic分布式架构
salt-syndic架构
salt-syndic的优劣势
优势:
- 可以通过syndic实现更复杂的salt架构
- 减轻master的负担
劣势:
- syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致,所以要进行数据同步,同步方案同salt-master高可用
- 最顶层的master不知道自己有几个syndic,它只知道自己有多少个minion,并不知道这些minion是由哪些syndic来管理的
salt-syndic部署
环境:
ip | 主机 | 应用 |
---|---|---|
192.168.8.130 | master | salt-master |
192.168.8.133 | syndic | salt-master salt-syndic |
192.168.8.131 | node1 | salt-minion |
在syndic主机上安装salt-master和salt-synidc
[root@syndic ~]# dnf -y install salt-master salt-syndic
修改master配置
[root@master ~]# vim /etc/salt/master
···
order_masters: True
[root@master ~]# systemctl restart salt-master.service
配置syndic
[root@syndic ~]# vim /etc/salt/master
···
syndic_master: 192.168.8.130 #指向masterIP
···
file_roots:
base:
- /srv/salt/base
prod:
- /srv/salt/prod
···
pillar_roots:
base:
- /srv/pillar/base
prod:
- /srv/pillar/prod
[root@syndic ~]# systemctl enable --now salt-master.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.
[root@syndic ~]# systemctl enable --now salt-syndic.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-syndic.service → /usr/lib/systemd/system/salt-syndic.service.
[root@syndic ~]#
配置minion
[root@node1 ~]# vim /etc/salt/minion
master: 192.168.8.133 #指向syndicIP
[root@node1 ~]# systemctl enable --now salt-minion.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.
[root@node1 ~]#
同步master和syndic的/srv
[root@master ~]# scp -r /srv/* 192.168.8.133:/srv/
root@192.168.8.133's password:
在syndic上接受minion的key
[root@syndic ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
Rejected Keys:
[root@syndic ~]# salt-key -ya node1
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@syndic ~]# salt-key -L
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
Rejected Keys:
在master上接受syndic主机的key
[root@master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
192.168.8.130
syndic
Rejected Keys:
[root@master ~]# salt-key -ya syndic
The following keys are going to be accepted:
Unaccepted Keys:
syndic
Key for minion syndic accepted.
[root@master ~]# salt-key -L
Accepted Keys:
syndic
Denied Keys:
Unaccepted Keys:
192.168.8.130
Rejected Keys:
在master上执行模块
[root@master ~]# salt '*' test.ping
node1:
True
[root@master init]# salt '*' state.sls init.history.main
node1:
----------
ID: /etc/profile
Function: file.line
Result: True
Comment: Changes were made
Started: 12:01:33.723117
Duration: 14.84 ms
Changes:
----------
diff:
---
+++
@@ -1,5 +1,6 @@
# /etc/profile
+export HISTTIMEFORMAT="%F %T `whoami` "
# System wide environment and startup programs, for login setup
# Functions and aliases go in /etc/bashrc
Summary for node1
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 14.840 ms