Saltstack 比 Puppet 出来晚几年,是基于Python 开发的,也是基于 C/S 架构,服务端 master 和客户端 minions ;Saltstack 和 Puppet 很像,可以说 Saltstatck 整合了 Puppet 和 Chef 的功能,更加强大,更适合大规模批量管理服务器,并且它比 Puppet 更容易配置。
三大功能: 远程命令执行,配置管理(服务,文件,cron,用户,组),云管理。
什么是saltstack
• Saltstack是基于python开发的一套C/S架构配置管理工具
• 使用SSL证书签方的方式进行认证管理
• 底层使用ZeroMQ消息队列pub/sub方式通信
– 号称世界上最快的消息队列ZeroMQ能快速在成千上万台主机上进行各种操作
– 采用RSA Key方式确认身份
主要功能
• Saltstack最主要的两个功能是:配置管理与远程执行
• Saltstack不只是一个配置管理工具,还是一个云计算与数据中心架构编排的利器
• Saltstack已经支持Docker相关模块
• 在友好地支持各大云平台之后,配合Saltstack的Mine实时发现功能可以实现各种云平台业务的自动扩展
Saltstack架构
• Saltstack基于C/S架构
– 服务器端称作Master
– 客户端称作Minion
• 可以实现传统处理方式,即:客户端发送请求给服务器,服务器收到请求后处理请求,再将结果返回
• 也可以使用消息队列中的发布与订阅(pub/sub)服务模式
• Master和Minion都以守护进程的方式运行
• Master监听配置文件里定义的ret_port(接收minion请求),和publish_port(发布消息)的端口
• 当Minion运行时,它会自动连接到配置文件里定义的Master地址ret_port端口进行连接认证
• 当Master和Minion可以正常通信后,就可以进行各种各样的配置管理工作了
Saltstack安装
依赖:
1. python2.6 ~ python3.0
2. ZeroMQ or RAET
3. mako(可选):一个可选的Salt States解析器
4. gcc(可选)
实验环境
Redhat 6.5
Server1 master 172.25.53.1
Server2 minion 172.25.53.2
配置saltstack所需的yum源
[root@foundation53 html]# ls
mysqlamdin rhel6 rhel6.5 rhel7.3
[root@foundation53 html]# cd rhel6
[root@foundation53 rhel6]# ls
libyaml-0.1.3-4.el6.x86_64.rpm
python-babel-0.9.4-5.1.el6.noarch.rpm
python-backports-1.0-5.el6.x86_64.rpm
python-backports-ssl_match_hostname-3.4.0.2-2.el6.noarch.rpm
python-chardet-2.2.1-1.el6.noarch.rpm
python-cherrypy-3.2.2-4.el6.noarch.rpm
python-crypto-2.6.1-3.el6.x86_64.rpm
python-crypto-debuginfo-2.6.1-3.el6.x86_64.rpm
python-enum34-1.0-4.el6.noarch.rpm
python-futures-3.0.3-1.el6.noarch.rpm
python-impacket-0.9.14-1.el6.noarch.rpm
python-jinja2-2.8.1-1.el6.noarch.rpm
python-msgpack-0.4.6-1.el6.x86_64.rpm
python-ordereddict-1.1-2.el6.noarch.rpm
python-requests-2.6.0-3.el6.noarch.rpm
python-setproctitle-1.1.7-2.el6.x86_64.rpm
python-six-1.9.0-2.el6.noarch.rpm
python-tornado-4.2.1-1.el6.x86_64.rpm
python-urllib3-1.10.2-1.el6.noarch.rpm
python-zmq-14.5.0-2.el6.x86_64.rpm
PyYAML-3.11-1.el6.x86_64.rpm
repodata
salt-2016.11.3-1.el6.noarch.rpm
salt-api-2016.11.3-1.el6.noarch.rpm
salt-cloud-2016.11.3-1.el6.noarch.rpm
salt-master-2016.11.3-1.el6.noarch.rpm
salt-minion-2016.11.3-1.el6.noarch.rpm
salt-ssh-2016.11.3-1.el6.noarch.rpm
salt-syndic-2016.11.3-1.el6.noarch.rpm
zeromq-4.0.5-4.el6.x86_64.rpm
配置master minion的yum源 两边操作相同
[root@server1 ~]# vim /etc/yum.repos.d/rhel-source.repo
[rhel-source]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=http://172.25.53.250/rhel6.5
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
[salt]
name=saltstack
baseurl=http://172.25.53.250/rhel6
enabled=1
gpgcheck=0
[root@server1 ~]# yum repolist
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
rhel-source | 3.9 kB 00:00
salt | 2.9 kB 00:00
salt/primary_db | 16 kB 00:00
repo id repo name status
rhel-source Red Hat Enterprise Linux 6Server - x86_64 - Source 3,690
salt saltstack 29
repolist: 3,719
Master和minion分别安装相应软件
[root@server1 ~]# yum install -y salt-master
[root@server2 ~]# yum install -y salt-minion
Minion端更改配置文件指向master端
[root@server2 ~]# cd /etc/salt/
[root@server2 salt]# vim minion
16 master: 172.25.53.1
两边开启服务
[root@server1 ~]# /etc/init.d/salt-master start
Starting salt-master daemon: [ OK ]
[root@server2 salt]# /etc/init.d/salt-minion start
Starting salt-minion:root:server2 daemon: OK
sat-key的帮助文件中文信息:
[root@localhost ~]# salt-key --help
Usage: salt-key [options]
Salt key 用于管理认证key
Options:
--version 显示版本号后退出
--versions-report 显示程序的所有依赖包版本号,并退出
-h, --help 帮助信息
-c CONFIG_DIR, --config-dir=CONFIG_DIR
指定配置目录,默认 :/etc/salt/
-q, --quiet 安静模式,不输出信息到控制台
-y, --yes 对所有询问是否继续,回答yes,默认:false
Logging Options:
设置loggin选项会覆盖掉配置文件中对日志的配置.
--log-file=LOG_FILE
指定日志文件路径,默认: /var/log/salt/key.
--log-file-level=LOG_LEVEL_LOGFILE
日志文件等级,可设置下面中的一个值 'all', 'garbage',
'trace', 'debug', 'info', 'warning', 'error', 'quiet'.
默认: 'warning'.
--key-logfile=KEY_LOGFILE
将所有的输出发送到指定的文件,默认: '/var/log/salt/key'
Output Options:
配置输出格式
--out=OUTPUT, --output=OUTPUT
把salt-key命令的输出信息发送给指定的outputer.
可设置为下面参数值 'no_return', 'virt_query'.
'grains', 'yaml', 'overstatestage', 'json', 'pprint',
'nested', 'raw', 'highstate', 'quiet', 'key', 'txt',
--out-indent=OUTPUT_INDENT, --output-indent=OUTPUT_INDENT
设置输出行缩进的空格数.
负数取消输出缩进编排.仅对使用的outputer有效.
--out-file=OUTPUT_FILE, --output-file=OUTPUT_FILE
把显示输出到指定的文件
--no-color, --no-colour
关闭字体颜色
--force-color, --force-colour
强制开启输出颜色渲染
Actions:
-l ARG, --list=ARG
打印公钥key. 可设置下面三个值
"pre", "un", and "unaccepted" 会显示 不许可/未签名 keys.
"acc" or "accepted"会显示 许可/已签名 keys.
"rej" or "rejected"会显示拒绝的 keys.
"all" 会显示所有 keys.
-L, --list-all 会显示所有公钥,相当月: "--list all"
-a ACCEPT, --accept=ACCEPT
许可指定的公钥(使用--include-all选项
可以指定除了挂起的key外的所有reject状态的公钥)
-A, --accept-all 许可所有pending的公钥
-r REJECT, --reject=REJECT
拒绝指定的公钥 (使用--include-all选项
可以指定除了挂起的key外的所有accept状态的公钥)
-R, --reject-all 拒接所有pending的公钥
--include-all 配合 accepting/rejecting 选项使用,指定所有非pending状态的公钥
-p PRINT, --print=PRINT
打印指定的公钥
-P, --print-all Print all public keys
-d DELETE, --delete=DELETE
根据公钥的名称删除公钥
-D, --delete-all 删除所有 keys
-f FINGER, --finger=FINGER
打印指定key的指纹信息
-F, --finger-all 打印所有key的指纹信息
Key 常用选项:
--gen-keys=GEN_KEYS
对生成的key配置设置一个salt使用的名称。
--gen-keys-dir=GEN_KEYS_DIR
设置生成key对的放置目录,默认当前目录。default=.
--keysize=KEYSIZE
为生成key设置位数, 仅跟--gen-keys选项配合时有效,
数值大小必须大于2048,否则会被提升至2048位,默认2048
default=2048
Master与Minion互信
[root@server1 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
server2
Rejected Keys:
-L: 列出密钥
-a: 接受一个密钥
-A: 接受全部密钥
-D: 删除全部密钥
[root@server1 ~]# salt-key -A
The following keys are going to be accepted:
Unaccepted Keys:
server2
Proceed? [n/Y] y
Key for minion server2 accepted.
[root@server1 ~]# salt-key -L
Accepted Keys:
server2
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@server1 ~]# salt server2 test.ping
server2:
True
salt命令的帮助信息翻译:
###
[root@localhost salt]# salt --help
Usage: salt [options] '<target>' <function> [arguments]
Options:
--version 版本号
--versions-report 依赖包版本号
-h, --help 显示帮助信息
-c CONFIG_DIR, --config-dir=CONFIG_DIR
指定配置文件目录.
默认: /etc/salt
-t TIMEOUT, --timeout=TIMEOUT
指定命令超时时间
建议默认:5秒
-s, --static 等到所有minions都执行完了再一起显示数据
--async 运行所有的salt命令不等待返回结果
--state-output=STATE_OUTPUT, --state_output=STATE_OUTPUT
覆盖掉配置文件中对minion输出内容所定义的 state_output 值
默认: full
--subset=SUBSET 对目标minions的随机子集执行程序.
minions在执行前会先验证是否存在该命名的函数,再去执行
-v, --verbose 可以查看详细的命令执行情况
--show-timeout 显示命令执行超时的 minions
-b BATCH, --batch=BATCH, --batch-size=BATCH
开启salt命令批量执行模式, 既可以指定一批minions,
也可以用指定百分比的方式确定多少minions批量执行
-a EAUTH, --auth=EAUTH, --eauth=EAUTH, --extended-auth=EAUTH
指定一个扩展的认证系统.
-T, --make-token 创建并保存一个认证token用于重用.
生成的token确保Salt Master在指定的周期内有效.
--return=RETURNER 设置一个其它的返回方法.
默认情况下,salt查询后结果会返回给master,
指定return后,数据可以重定向其它的任意数量的系统,数据库或应用.
-d, --doc, --documentation
返回指定模块的文档说明,不指定特定的模块则返回全部
--args-separator=ARGS_SEPARATOR
指定发送命令跟命令参数的分隔符.
当用户想把一个命令当作参数发送给另一个命令执行时,
是个很好用的选项.
Logging Options:
指定下面的配置选项会覆盖掉配置文件中对应的配置信息.
-l LOG_LEVEL, --log-level=LOG_LEVEL
日志等级.
其中一个: 'all', 'garbage', 'trace',
'debug', 'info', 'warning', 'error', 'quiet'.
默认: 'warning'.
--log-file=LOG_FILE
日志文件路径. 默认: /var/log/salt/master.
--log-file-level=LOG_LEVEL_LOGFILE
日志文件记录等级. 其中一个 'all', 'garbage',
'trace', 'debug', 'info', 'warning', 'error', 'quiet'.
默认: 'warning'.
Target Options:
Target Selection Options
-E, --pcre 使用pcre(perl)的正则表达式规则匹配目标
-L, --list 列出一组用逗号或空格隔开的minions id作为执行目标.
-G, --grain 使用grain信息中指定的机器作为目标
例如: "os:Arch*" 'os:CentOS'
--grain-pcre 使用基于pcre正则式规则的grain匹配目录
例如: "os:Arch.*"
-N, --nodegroup 使用预先定义的节点组作为匹配目标.
-R, --range 使用一个范围表达式去查找目标.
例如: %cluster
-C, --compound 多条件指定目标,根据多个条件筛选匹配目标
类似: salt 'G@os:RedHat and webser* or E@database.*'
-X, --exsel Instead of using shell globs use the return code of a
function.
-I, --pillar 使用一个pillar 的值来筛选目标,
例如: "role:production*"
-S, --ipcidr 基于子网络匹配 (CIDR notation) or IPv4 address.
Output Options:
配置你的完美输出格式
--out=OUTPUT, --output=OUTPUT
指定输出的格式,开发一般用json,默认是yaml
可选如下: 'no_return',
'grains', 'yaml', 'overstatestage', 'json', 'pprint',
'nested', 'raw', 'highstate', 'quiet', 'key', 'txt',
'virt_query'.
--out-indent=OUTPUT_INDENT, --output-indent=OUTPUT_INDENT
指定行缩进的空格数.
负数为取消行缩进.
只有在输出格式适合行缩进,该参数才有效.
--out-file=OUTPUT_FILE, --output-file=OUTPUT_FILE
内容输出到指定的文件
--no-color, --no-colour
关闭颜色显示
--force-color, --force-colour
强制颜色显示
[root@server1 ~]# salt server2 cmd.run hostname
server2:
server2
[root@server1 ~]# salt server2 cmd.run 'df -h'
server2:
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root 19G 972M 17G 6% /
tmpfs 246M 16K 246M 1% /dev/shm
/dev/vda1 485M 33M 427M 8% /boot
[root@server1 ~]# cd /etc/salt/pki/
[root@server1 pki]# cd master/
[root@server1 master]# md5sum master.pub
977c918b46d2ea9dec3826a2dd9021ab master.pub
[root@server1 master]# yum install -y tree
查看saltstack结构
[root@server1 master]# tree .
.
├── master.pem
├── master.pub
├── minions
│ └── server2
├── minions_autosign
├── minions_denied
├── minions_pre
└── minions_rejected
[root@server1 master]# cd minions
[root@server1 minions]# ls
server2
[root@server1 minions]# md5sum server2
9dd67ca1673e0442b14fd19aabb03e35 server2
[root@server2 salt]# cd /etc/salt/pki/
[root@server2 pki]# cd minion/
[root@server2 minion]# md5sum minion.pub
9dd67ca1673e0442b14fd19aabb03e35 minion.pub
[root@server2 minion]# md5sum minion_master.pub
977c918b46d2ea9dec3826a2dd9021ab minion_master.pub
[root@server1 minions]# yum install -y lsof
[root@server1 minions]# lsof -i :4505
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
salt-mast 1417 root 16u IPv4 14100 0t0 TCP *:4505 (LISTEN)
salt-mast 1417 root 18u IPv4 17037 0t0 TCP server1:4505->server2:55420 (ESTABLISHED)
[root@server1 minions]# lsof -i :4506
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
salt-mast 1424 root 24u IPv4 14111 0t0 TCP *:4506 (LISTEN)
[root@server1 minions]# yum install -y python-setproctitle
[root@server1 minions]# /etc/init.d/salt-master restart
Stopping salt-master daemon: [ OK ]
Starting salt-master daemon: [ OK ]
[root@server1 minions]# cd /etc/salt/
[root@server1 salt]# vim master
• YAML:YAML Ain't Markup Language
• YAML的结构通过空格来展示
• 项目使用"-"来表示
• 键值对使用":"来表示
• Master和Minion的配置文件均采用YAML语法
• YAML使用一个固定的缩进风格表示数据层级结构关
• 一般每个缩进级别由两个空格组成
• 注意不要使用tab
• 缩进是初学者容易出错的地方之一
• YAML的键值对采用冒号分隔
• YAML键值对对应python的字典
• YAML表示形式
name: test
或
name:
test
• Python字典
{'name': 'test'}
• 字典可以嵌套
hosts:
name: test
• 字典表示形式为
{
'hosts': {
'name': 'test'
}
}
• 列表项使用一个短横杠加一个空格
- test1
- test2
• 列表可以作为一个键值对的value
pkg-http:
- httpd
- php
• Python语法
{'pkg-http': ['httpd', 'php']}
[root@server1 salt]# /etc/init.d/salt-master restart
Stopping salt-master daemon: [ OK ]
Starting salt-master daemon: [ OK ]
编写一个可以执行的安装模块
[root@server1 salt]# mkdir /srv/salt
[root@server1 salt]# cd /srv/salt/
[root@server1 salt]# mkdir httpd
[root@server1 salt]# cd httpd/
[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
[root@server1 httpd]# salt server2 state.sls httpd.install
[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
service.running:
- name: httpd
远程对已互信的minion进行命令执行
[root@server1 httpd]# salt server2 state.sls httpd.install
[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
service.running:
- name: httpd
- enable: True
[root@server1 httpd]# salt server2 state.sls httpd.install
[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
file.managed:
- name: /etc/httpd/conf/httpd.conf
- source: salt://httpd/files/httpd.conf
- mode: 644
- user: root
service.running:
- name: httpd
- enable: True
- reload: True
- watch:
- file: apache-install
[root@server1 httpd]# mkdir files
[root@server1 httpd]# cd files/
[root@server1 files]# pwd
/srv/salt/httpd/files
[root@server2 minion]# scp /etc/httpd/conf/httpd.conf server1:/srv/salt/httpd/files
The authenticity of host 'server1 (172.25.53.1)' can't be established.
RSA key fingerprint is 6d:fd:b7:7f:ae:10:eb:24:2f:67:97:93:84:6f:36:7e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'server1,172.25.53.1' (RSA) to the list of known hosts.
root@server1's password:
httpd.conf 100% 34KB 33.6KB/s 00:00
[root@server2 minion]# md5sum /etc/httpd/conf/httpd.conf
27a5c8d9e75351b08b8ca1171e8a0bbd /etc/httpd/conf/httpd.conf
[root@server1 files]# vim httpd.conf
[root@server1 files]# md5sum httpd.conf
b7ca7a0e786418ba7b5ad84efac70265 httpd.conf
[root@server1 files]# salt server2 state.sls httpd.install
远程使用源码编译nginx
[root@server1 httpd]# cd ..
[root@server1 salt]# ls
httpd
[root@server1 salt]# mkdir nginx
[root@server1 salt]# cd nginx/
[root@server1 nginx]# mkdir files
[root@server1 nginx]# ls
files
[root@server1 nginx]# cd files/
[root@server1 files]# ls
[root@server1 files]# pwd
/srv/salt/nginx/files
[root@server1 files]# ls
nginx-1.14.0.tar.gz
[root@server1 files]# cd ..
[root@server1 nginx]# vim install.sls
ngisx-install:
pkg.installed:
- pkgs:
- pcre-devel
- openssl-devel
- gcc
file.managed:
- name: /mnt/nginx-1.14.0.tar.gz
- source: salt://nginx/files/nginx-1.14.0.tar.gz
# cmd.run:
# - name: cd /mnt && tar zxf nginx-1.14.0.tar.gz &&cd nginx-1.14.0
先进行简单测试看前面写的是否正确
[root@server1 nginx]# salt server3 start.sls nginx.install
通过刷新server3的正在运行,可以看到
Ps ax
代表前面写的没有问题
然后我们写执行操作的时候可以先在server3上将命令运行一遍看是否正确
更改src/core/nginx.h的版本号
[root@server3 nginx-1.14.0]# sed -i.bak 's/#define NGINX_VER "nginx\/" NGINX_VERSION/#define NGINX_VER "nginx"/g' src/core/nginx.h
注释auto/cc/gcc的debug选项
[root@server3 nginx-1.14.0]# sed -i.bak 's/CFLAGS="$CFLAGS -g"/#CFLAGS="$CFLAGS -g"/g' auto/cc/gcc
通过运行可以证明这两个命令是正确的
[root@server3 nginx-1.14.0]# ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-threads --with-file-aio
编译所需模块,至此,我们可以将他们写入执行脚本里了
[root@server1 nginx]# vim install.sls
ngisx-install:
pkg.installed:
- pkgs:
- pcre-devel
- openssl-devel
- gcc
file.managed:
- name: /mnt/nginx-1.14.0.tar.gz
- source: salt://nginx/files/nginx-1.14.0.tar.gz
cmd.run:
- name: cd /mnt && tar zxf nginx-1.14.0.tar.gz && cd nginx-1.14.0 && sed -i.bak 's/#define NGINX_VER "nginx\/" NGINX_VERSION/#define NGINX_VER "nginx"/g' src/core/nginx.h && sed -i.bak 's/CFLAGS="$CFLAGS -g"/#CFLAGS="$CFLAGS -g"/g' auto/cc/gcc && ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-threads --with-file-aio &> /dev/null && make &>/dev/null &&make install &>/dev/null
运行
[root@server1 nginx]# salt server3 state.sls nginx.install
运行过程中我们通过刷新server3的运行程序,依然可以看到他的执行效果
执行完成后
执行成功
如果nginx已经安装,我们难道要让重新安装吗,不是的,我们需要添加一个判断
我们再写一个nginx启动脚本
[root@server1 nginx]# vim service.sls
include:
- nginx.install
nginx-service:
cmd.run:
- name: /usr/local/nginx/sbin/nginx
[root@server1 nginx]# salt server3 state.sls nginx.service
执行效果 nginx启动了
但这个脚本有个问题,就是nginx在启动状态时,你运行的话会报错
需要改进
我们根据日志判断他是否启动
- creates: /usr/local/nginx/logs/nginx.pid
这样就算重复启动也不会报错了
另外一种启动脚本
首先将nginx脚本
[root@server1 files]# pwd
/srv/salt/nginx/files
[root@server1 files]# ls
nginx nginx-1.14.0.tar.gz nginx.conf
[root@server1 nginx]# cat service.sls
include:
- nginx.install
/usr/local/nginx/conf/nginx.conf:
file.managed:
- source: salt://nginx/files/nginx.conf
nginx-service:
file.managed:
- name: /etc/init.d/nginx
- source: salt://nginx/files/nginx
- mode: 755
service.running:
- name: nginx
- reload: True
- watch:
- file: /usr/local/nginx/conf/nginx.conf
[root@server1 nginx]# ls
files install.sls service.sls
[root@server1 nginx]# cd ..
[root@server1 salt]# cd /srv/salt/nginx/files
[root@server1 files]# cat nginx
#!/bin/sh
#
# nginx Startup script for nginx
#
# chkconfig: - 85 15
# processname: nginx
# config: /usr/local/nginx/conf/nginx/nginx.conf
# pidfile: /usr/local/nginx/logs/nginx.pid
# description: nginx is an HTTP and reverse proxy server
#
### BEGIN INIT INFO
# Provides: nginx
# Required-Start: $local_fs $remote_fs $network
# Required-Stop: $local_fs $remote_fs $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop nginx
### END INIT INFO
# Source function library.
. /etc/rc.d/init.d/functions
if [ -L $0 ]; then
initscript=`/bin/readlink -f $0`
else
initscript=$0
fi
#sysconfig=`/bin/basename $initscript`
#if [ -f /etc/sysconfig/$sysconfig ]; then
# . /etc/sysconfig/$sysconfig
#fi
nginx=${NGINX-/usr/local/nginx/sbin/nginx}
prog=`/bin/basename $nginx`
conffile=${CONFFILE-/usr/local/nginx/conf/nginx.conf}
lockfile=${LOCKFILE-/var/lock/subsys/nginx}
pidfile=${PIDFILE-/usr/local/nginx/logs/nginx.pid}
SLEEPMSEC=${SLEEPMSEC-200000}
UPGRADEWAITLOOPS=${UPGRADEWAITLOOPS-5}
RETVAL=0
start() {
echo -n $"Starting $prog: "
daemon --pidfile=${pidfile} ${nginx} -c ${conffile}
RETVAL=$?
echo
[ $RETVAL = 0 ] && touch ${lockfile}
return $RETVAL
}
stop() {
echo -n $"Stopping $prog: "
killproc -p ${pidfile} ${prog}
RETVAL=$?
echo
[ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile}
}
reload() {
echo -n $"Reloading $prog: "
killproc -p ${pidfile} ${prog} -HUP
RETVAL=$?
echo
}
upgrade() {
oldbinpidfile=${pidfile}.oldbin
configtest -q || return
echo -n $"Starting new master $prog: "
killproc -p ${pidfile} ${prog} -USR2
echo
for i in `/usr/bin/seq $UPGRADEWAITLOOPS`; do
/bin/usleep $SLEEPMSEC
if [ -f ${oldbinpidfile} -a -f ${pidfile} ]; then
echo -n $"Graceful shutdown of old $prog: "
killproc -p ${oldbinpidfile} ${prog} -QUIT
RETVAL=$?
echo
return
fi
done
echo $"Upgrade failed!"
RETVAL=1
}
configtest() {
if [ "$#" -ne 0 ] ; then
case "$1" in
-q)
FLAG=$1
;;
*)
;;
esac
shift
fi
${nginx} -t -c ${conffile} $FLAG
RETVAL=$?
return $RETVAL
}
rh_status() {
status -p ${pidfile} ${nginx}
}
# See how we were called.
case "$1" in
start)
rh_status >/dev/null 2>&1 && exit 0
start
;;
stop)
stop
;;
status)
rh_status
RETVAL=$?
;;
restart)
configtest -q || exit $RETVAL
stop
start
;;
upgrade)
rh_status >/dev/null 2>&1 || exit 0
upgrade
;;
condrestart|try-restart)
if rh_status >/dev/null 2>&1; then
stop
start
fi
;;
force-reload|reload)
reload
;;
configtest)
configtest
;;
*)
echo $"Usage: $prog {start|stop|restart|condrestart|try-restart|force-reload|upgrade|reload|status|help|configtest}"
RETVAL=2
esac
exit $RETVAL
[root@server1 nginx]# cat service.sls
include:
- nginx.install
/usr/local/nginx/conf/nginx.conf:
file.managed:
- source: salt://nginx/files/nginx.conf
nginx-service:
file.managed:
- name: /etc/init.d/nginx
- source: salt://nginx/files/nginx
- mode: 755
service.running:
- name: nginx
- reload: True
- watch:
- file: /usr/local/nginx/conf/nginx.conf
这样也可以
编辑可生成用户
[root@server1 nginx]# cat users.sls
nginx-group:
group.present:
- name: nginx
- gid: 800
nginx-user:
user.present:
- name: nginx
- uid: 800
- gid: 800
- shell: /sbin/nologin
- createhome: False
- home: /usr/local/nginx
添加到service.sls
运行之后
将模块添加到service
[root@server1 salt]# ls /srv/salt/nginx/
files install.sls service.sls users users.sls
[root@server1 salt]# cat /srv/salt/nginx/service.sls
include:
- nginx.users
- nginx.install
/usr/local/nginx/conf/nginx.conf:
file.managed:
- source: salt://nginx/files/nginx.conf
nginx-service:
file.managed:
- name: /etc/init.d/nginx
- source: salt://nginx/files/nginx
- mode: 755
service.running:
- name: nginx
- reload: True
- watch:
- file: /usr/local/nginx/conf/nginx.conf
[root@server1 ~]# yum install -y salt-minion
[root@server1 ~]# cd /etc/salt/
[root@server1 salt]# vim minion
[root@server1 salt]# salt-key -L
Accepted Keys:
server2
server3
Denied Keys:
Unaccepted Keys:
server1
Rejected Keys:
[root@server1 salt]# salt-key -a server1
The following keys are going to be accepted:
Unaccepted Keys:
server1
Proceed? [n/Y] y
Key for minion server1 accepted.
[root@server1 salt]# salt-key -L
Accepted Keys:
server1
server2
server3
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@server1 haproxy]# vim /etc/yum.repos.d/rhel-source.repo
[root@server1 haproxy]# cat /etc/yum.repos.d/rhel-source.repo
[rhel-source]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=http://172.25.53.250/rhel6.5
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
[salt]
name=saltstack
baseurl=http://172.25.53.250/rhel6
enabled=1
gpgcheck=0
[LoadBalancer]
name=LoadBalancer
baseurl=http://172.25.53.250/rhel6.5/LoadBalancer
#!/usr/bin/env python
def yourfunction():
# initialize a grains dictionary
grains = {}
# Some code for logic that sets grains like
grains['yourcustomgrain'] = True
grains['anothergrain'] = 'somevalue'
return grains
[root@server1 files]# vim haproxy.cfg
[root@server1 files]# tail -n 10 haproxy.cfg
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend main *:80
default_backend app
backend app
balance roundrobin
server app1 172.25.53.2:80 check
server app2 172.25.53.3:80 check
[root@server1 haproxy]# pwd
/srv/salt/haproxy
[root@server1 haproxy]# vim install.sls
[root@server1 haproxy]# cat install.sls
haproxy-install:
pkg.installed:
- pkgs:
- haproxy
file.managed:
- name: /etc/haproxy/haproxy.cfg
- source: salt://haproxy/files/haproxy.cfg
service.running:
- name: haproxy
- reload: True
- watch:
- file: haproxy-install
[root@server1 files]# cd /srv/salt/
[root@server1 salt]# vim top.sls
[root@server1 salt]# cat top.sls
base:
'server1':
- haproxy.install
'server2':
- httpd.install
'server3':
- nginx.service
[root@server1 salt]# salt server? test.ping
server2:
True
server3:
True
server1:
True
[root@server1 files]# salt '*' state.highstate
记得看httpd的端口是否为80
[root@server1 files]# ls
httpd.conf
[root@server1 files]# pwd
/srv/salt/httpd/files
Server2 发布目录添加
[root@server2 minion]# cd /var/www/html/
[root@server2 html]# ls
[root@server2 html]# vim index.html
[root@server2 ~]# vim /etc/salt/minion
[root@server2 ~]# /etc/init.d/salt-minion restart
Stopping salt-minion:root:server2 daemon: OK
Starting salt-minion:root:server2 daemon: OK
[root@server1 ~]# cd /srv/salt/
[root@server1 salt]# mkdir _grains
[root@server1 salt]# cd _grains/
[root@server1 _grains]# ls
[root@server1 _grains]# vim my_grains.py
#!/usr/bin/env python
def my_grains():
grains = {}
grains['hello'] = 'world'
grains['salt'] = 'stack'
return grains
[root@server1 ~]# vim /etc/salt/master
[root@server1 ~]# mkdir /srv/pillar
[root@server1 ~]# cd /srv/pillar
[root@server1 pillar]# mkdir web/
[root@server1 pillar]# cd web/
[root@server1 web]# vim install.sls
{% if grains['fqdn'] == 'server2' %}
webserver: httpd
{% elif grains['fqdn'] == 'server3' %}
webserver: nginx
{% endif %}
[root@server1 web]# cd ..
[root@server1 pillar]# vim top.sls
[root@server1 pillar]# cat top.sls
base:
'*':
- web.install
新建虚拟机server4 配置yum源,安装minion,master作允许
[root@server1 pillar]# cd /srv/salt/httpd/
[root@server1 httpd]# ls
files install.sls
[root@server1 httpd]# vim install.sls
[root@server1 httpd]# pwd
/srv/salt/httpd
[root@server1 httpd]# cat install.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
file.managed:
- name: /etc/httpd/conf/httpd.conf
- source: salt://httpd/files/httpd.conf
- mode: 644
- user: root
service.running:
- name: httpd
- enable: True
- reload: True
- watch:
- file: apache-install
[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls
httpd:
pkg.installed
php:
pkg.installed
apache:
service.running:
- name: httpd
- enable: True
- reload: True
- watch:
- file: /etc/httpd/conf/httpd.conf
/etc/httpd/conf/httpd.conf:
file.managed:
- source: salt://httpd/files/httpd.conf
- mode: 644
- user: root
- template: jinja
- context:
bind: 172.25.53.2
port: 8080
[root@server1 httpd]# ls
files install.sls
[root@server1 httpd]# cd files/
[root@server1 files]# ls
httpd.conf
[root@server1 files]# vim httpd.conf
[root@server1 files]# salt server2 state.sls httpd.install
[root@server2 salt]# vim /etc/httpd/conf/httpd.conf
另一种方法
[root@server1 files]# vim httpd.conf
[root@server1 files]# salt server2 state.sls httpd.install
[root@server1 files]# cd ..
[root@server1 httpd]# ls
files install.sls
[root@server1 httpd]# vim lib.sls
[root@server1 httpd]# cat lib.sls
{% set port = 80 %}
[root@server1 httpd]# vim files/httpd.conf
在行首
[root@server1 httpd]# salt server2 state.sls httpd.install
[root@server1 httpd]# vim install.sls
salt server2 state.sls httpd.install
强烈推荐用这种方法
[root@server1 web]# vim install.sls
[root@server1 web]# pwd /srv/pillar/web
[root@server1 httpd]# vim files/httpd.conf
[root@server1 httpd]# vim install.sls
[root@server1 web]# salt server2 state.sls httpd.install
[root@server2 salt]# vim /etc/httpd/conf/httpd.conf