基于python开发的,用于批量控制管理服务器 . saltstack与ansible对比
saltstack系统中的角色
salt-master : 管理端
salt-minion : 被管理端
salt-syncdic: salt代理(用于分布式管理)
分布式部署:
认证
saltstack系统中的角色之间采用证书的方式认证(安全)
认证方式:salt-minion向salt-master发送证书申请,salt-master签收证书
部署
sudo rpm --import https://repo.saltproject.io/py3/redhat/8/x86_64/latest/SALTSTACK-GPG-KEY.pub
curl -fsSL https://repo.saltproject.io/py3/redhat/8/x86_64/latest.repo | sudo tee /etc/yum.repos.d/salt.repo
sudo yum clean expire-cache
salt-minion, salt-master, 及其他 Salt 组件
sudo yum install salt-master
sudo yum install salt-minion
sudo yum install salt-ssh
sudo yum install salt-syndic
sudo yum install salt-cloud
sudo yum install salt-api # 提供saltstackt https python 调用
主机安装salt-master,salt-api 被管控机安装salt-minion
若无法安装可使用如下方式安装 依赖地址
yum install https://repo.saltproject.io/py3/redhat/7/x86_64/3001/salt-master-3001.8-1.el7.noarch.rpm
yum install https://repo.saltproject.io/py3/redhat/7/x86_64/3001/salt-api-3001.8-1.el7.noarch.rpm
salt-master.noarch 0:3001.8-1.el7
hwdata.x86_64 0:0.252-9.7.el7 libtirpc.x86_64 0:0.2.4-0.16.el7
pciutils.x86_64 0:3.5.1-3.el7 pciutils-libs.x86_64 0:3.5.1-3.el7
python3.x86_64 0:3.6.8-18.el7 python3-libs.x86_64 0:3.6.8-18.el7
python3-pip.noarch 0:9.0.3-8.el7 python3-setuptools.noarch 0:39.2.0-10.el7
python36-PyYAML.x86_64 0:3.13-1.el7 python36-chardet.noarch 0:3.0.4-12.el7
python36-distro.noarch 0:1.5.0-1.el7 python36-idna.noarch 0:2.10-1.el7
python36-jinja2.noarch 0:2.11.1-1.el7 python36-m2crypto.x86_64 0:0.35.2-5.el7
python36-markupsafe.x86_64 0:0.23-4.el7 python36-msgpack.x86_64 0:0.6.2-2.el7
python36-psutil.x86_64 0:5.6.7-1.el7 python36-pycurl.x86_64 0:7.43.0-8.el7
python36-pysocks.noarch 0:1.6.8-7.el7 python36-requests.noarch 0:2.14.2-2.el7
python36-six.noarch 0:1.14.0-3.el7 python36-urllib3.noarch 0:1.25.6-2.el7
python36-zmq.x86_64 0:17.0.0-5.el7 salt.noarch 0:3001.8-1.el7
systemd-python.x86_64 0:219-78.el7_9.5
yum install pyOpenSSL # salt-api 使用,用于提供https
日志位置:
/var/log/salt
启动 salt-master:
systemctl start salt-master.service
salt-master 默认使用的端口: 4505(用于内部通信),4506(用于与minion通信)
启动 salt-minion:
修改minion配置文件 vim /etc/salt/minion ,配置主机信息
master: 主机IP
id: minion自己的IP
启动 minion:systemctl start salt-minion.service
证书签收
minion启动后会向master发送证书,master需要签收证书才能实现对minion的管控
master查看证书信息: salt-key -L
Accepted Keys: # 已经接收的
Denied Keys: # 已经拒绝的
Unaccepted Keys:# 未接收的
Rejected Keys:
签收证书: salt-key -A -y
salt-minion 和salt-master 认证机制如下:
- minion端生成一个秘钥对,并产生一个ID值,minion服务会安装ID值命名的公钥发送给 master ,直到接受为止
- master认证完毕后,会将minion 端发送来的,以ID值命名的公钥存放在 /etc/salt/pki/master/minions 目录中
- master认证完毕后,会将自身的公钥发送给 minion,并存储为 /etc/salt/pki/minion/minion_master.pub.
- master 秘钥对默认存储在/etc/salt/pki/master/master.pub /etc/salt/pki/master/master.pem(salt master私钥)
- master 端认证的公钥存储在:/etc/salt/pki/master/minions/
- minion 秘钥对默认存储在/etc/salt/pki/minion/minion.pub /etc/salt/pki/minion/minion.pem(salt minion私钥)
- minion 存放的master公钥/etc/salt/pki/minion/minion_master.pub
grains 用于保存minion的信息(系统版本,内存大小,CPU个数等信息)
salt '192.168.3.44' grains.items
常用模块
查看所有模块:
salt '192.168.3.44' sys.list_modules
acl, aliases, alternatives, apache, archive, artifactory, blockdev, btrfs, buildout, cloud, cmd, composer, config, container_resource, cp, cron, data, defaults, devmap, dig, disk, django, dnsmasq, dnsutil, drbd, elasticsearch, environ, etcd, event, extfs, file, gem, genesis, git, grains, group, grub, hashutil, hg, hipchat, hosts, http, img, incron, ini, introspect, ip, iptables, jboss7, jboss7_cli, key, kmod, locale, locate, logrotate, lowpkg, match, mine, modjk, mount, network, openstack_config, pagerduty, pillar, pip, pkg, pkg_resource, postfix, publish, puppet, pyenv, raid, random, random_org, rbenv, ret, rsync, runit, rvm, s3, saltutil, schedule, scsi, sdb, seed, selinux, serverdensity_device, service, shadow, slack, smtp, sqlite3, ssh, state, status, supervisord, sys, sysctl, syslog_ng, system, test, timezone, user, vbox_guest, virtualenv, webutil, xfs
查看模块提供的常用方法:
salt '192.168.3.44' sys.list_functions user #查看user模块提供的方法
查看具体方法的使用说明:
salt '192.168.3.44' sys.doc user.add
test.ping 测试minion通信
salt '*' test.ping
cmd.run 执行命令
salt '*' cmd.run 'df -h'
salt '*' cmd.run 'netstat -antp |grep python'
salt '*' cmd.run 'rpm -q vsftpd'
...
pkg 软件管理模块
salt '*' pkg.install vsftpd # 安装vsftpd
服务管理模块 sevice
salt '*' service.start vsftpd
salt '*' service.stop vsftpd
salt '*' service.status vsftpd
salt-api
生成https秘钥
cd /etc/pki/tls/certs/
[root@localhost certs]# make testcert # 生成证书
umask 77 ; \
/usr/bin/openssl genrsa -aes128 2048 > /etc/pki/tls/private/localhost.key
Generating RSA private key, 2048 bit long modulus
................................+++
.+++
e is 65537 (0x10001)
Enter pass phrase: # 密码
Verifying - Enter pass phrase: # 确认密码
umask 77 ; \
/usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt
Enter pass phrase for /etc/pki/tls/private/localhost.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:bj
Locality Name (eg, city) [Default City]:bj
Organization Name (eg, company) [Default Company Ltd]:bj
Organizational Unit Name (eg, section) []:bj
Common Name (eg, your name or your server's hostname) []:salt-master
Email Address []:bj@qq.com
将有密码秘钥改完无密码可使用
cd /etc/pki/tls/private
[root@localhost private]# openssl rsa -in localhost.key -out localhost-nopass.key
Enter pass phrase for localhost.key: # 上一步设置的密码
writing RSA key
chmod 644 /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key /etc/pki/tls/private/localhost-nopass.key
创建salt-api的系统用户,用来认证
useradd -M -s /sbin/nologin saltapi
passwd saltapi
编辑salt-api相关配置文件
vim /etc/salt/master
default_include: master.d/*.conf
vim /etc/salt/master.d/eauth.conf
external_auth:
pam: # 使用pam模块认证
saltapi: # 认证用户
- .* # 认证用户saltapi可使用的模块
vim /etc/salt/master.d/api.conf
rest_cherrypy:
port: 8001 # salt-api使用的端口
ssl_crt: /etc/pki/tls/certs/localhost.crt
ssl_key: /etc/pki/tls/private/localhost-nopass.key
启动salt-api
systemctl restart salt-master.service
systemctl start salt-api.service
salt-api 基于https协议提供两个url地址:
- https://x.x.x.x:port/login # 调用saltAPI,实现用户认证,返回用户令牌
- https://x.x.x.x:port # 调用saltmaster的功能模块
验证是否启动:
# 验证登录:
curl -k https://192.168.3.46:8001/login -H "Accept: application/x-yaml" -d username="saltapi" -d password="123456" -d eauth="pam"
# 返回:
return:
- eauth: pam
expire: 1648217755.235411
perms:
- .*
start: 1648174555.2354097
token: 3f21964714ff7300d4b0dd4d8e5f410019eb1871
user: saltapi
# 验证test.ping
curl -k https://192.168.3.46:8001/ -H "Accept: application/x-yaml" -H "X-Auth-Token:3f21964714ff7300d4b0dd4d8e5f410019eb1871" -d client="local" -d tgt="*" -d fun="test.ping"
# 返回:
return:
- 192.168.3.44: false
192.168.3.47: true
python调用
import requests
import json
salt_api_url = 'https://192.168.3.46:8001'
salt_api_url_login = 'https://192.168.3.46:8001/login'
salt_api_user = 'saltapi'
salt_api_passwd = '123456'
requests.packages.urllib3.disable_warnings()
def get_salt_api_token():
data = {
'username': salt_api_user,
'password': salt_api_passwd,
'eauth': 'pam' # 选择的认证模块
}
head = {
'Content-Type': 'application/json' # 接收json数据
}
res = requests.post(
url=salt_api_url_login,
data=json.dumps(data),
headers=head,
verify=False # 向https发送请求会验证证书,此参数是取消验证证书
)
salt_api_token = json.loads(res.text).get('return')[0].get('token')
return salt_api_token
# 调用models模块
# 1.无参数模块
# test.ping 模块
def test_ping(salt_api_token):
head = {
'Content-Type': 'application/json',
'X-Auth-Token': salt_api_token
}
data = {
'client': 'local_async', # client 表示调用方式, local:同步调用
'tgt': '*', # tgt 表示要操作的minion, 值为minion_id
'fun': 'test.ping', # 调用的模块方法名
# 'arg': '' # 模块需要用的参数
}
res = requests.post(url=salt_api_url, data=json.dumps(data), headers=head, verify=False)
print(json.loads(res.text)) # {'return': [{'192.168.3.47': True, '192.168.3.44': False}]}
# 2.调用有参模块
def cmd_run(salt_api_token):
head = {
'Content-Type': 'application/json',
'X-Auth-Token': salt_api_token
}
data = {
'client': 'local', # client 表示调用方式, local:同步调用
'tgt': '192.168.3.47', # tgt 表示要操作的minion, 值为minion_id
'fun': 'cmd.run', # 调用的模块方法名
'arg': 'df -h' # 模块需要用的参数
}
res = requests.post(url=salt_api_url, data=json.dumps(data), headers=head, verify=False)
print(json.loads(res.text))
if __name__ == '__main__':
# get_salt_api_token()
token = '7fe67213e4821a82f905292bb56c5ffa2a36faf5'
test_ping(token)
# cmd_run(token)
saltstack的rest接口salt-api开发使用指南_峰云,就她了。的技术博客_51CTO博客
Saltstack异步执行命令(十三) - shhnwangjian - 博客园
Salt Master报错:Minion did not return. [No response]_东城绝神的博客-CSDN博客