SaltStack之系统初始化状态文件编写_saltstack 下发sysctl.conf-CSDN博客

本文链接：https://blog.csdn.net/hyhxy0206/article/details/121326926

一、SaltStack之系统初始化部署状态文件

环境说明：

centos8

主机名	IP地址	部署功能	性能
master	192.168.143.101	salt-master salt-minion	4核8G
node3	192.168.143.104	salt-minion init	4核2G

[root@master init]# tree
.
├── basepkg
│ └── main.sls
├── chrony
│ ├── files
│ │ └── chrony.conf
│ └── main.sls
├── firewall
│ └── main.sls
├── history
│ └── main.sls
├── kernel
│ ├── files
│ │ ├── limits.conf
│ │ └── sysctl.conf
│ └── main.sls
├── main.sls
├── salt-minion
│ ├── files
│ │ └── minion.j2
│ └── main.sls
├── selinux
│ ├── files
│ │ └── config
│ └── main.sls
├── service
│ └── main.sls
├── timeout
│ └── main.sls
├── timezone
│ ├── files
│ │ └── clock
│ └── main.sls
├── yum
│ ├── files
│ │ ├── centos-7.repo
│ │ ├── centos-8.repo
│ │ ├── epel.repo
│ │ ├── salt-7.repo
│ │ └── salt-8.repo
│ └── main.sls
└── zabbix-agentd
├── files
│ ├── install.sh
│ ├── zabbix-5.4.4.tar.gz
│ └── zabbix_agentd.conf.j2
└── main.sls

19 directories, 27 files

关闭 selinux

[root@master init]# tree selinux/
selinux/
├── files
│   └── config
└── main.sls

1 directory, 2 files

[root@master init]# vim selinux/main.sls 
/etc/selinux/config:
  file.managed:
    - source: salt://init/selinux/files/config
    - user: root
    - group: root
    - mode: '0644'

setenforce 0:
  cmd.run:
    - name: setenforce0

关闭 firewall

[root@master init]# tree firewall/
firewall/
└── main.sls

0 directories, 1 file

[root@master init]# vim firewall/main.sls 
firewalld:
  service.dead:
    - enable: false

同步 chrony

[root@master init]# tree chrony/
chrony/
├── files
│   └── chrony.conf
└── main.sls

1 directory, 2 files
[root@master init]# vim chrony/main.sls 
chrony:
  pkg.installed

/etc/chrony.conf:
  file.managed:
    - source: salt://init/chrony/files/chrony.conf
    - user: root
    - group: root
    - mode: '0644'

chronyd.service:
  service.running:
    - enable: true

设置 timezone

[root@master init]# tree timezone/
timezone/
├── files
│   └── clock
└── main.sls

1 directory, 2 files
[root@master init]# vim timezone/main.sls
/etc/sysconfig/clock:
  file.managed:
    - source: salt://init/timezone/files/clock

rm -rf:
  cmd.run:
    - name: rm -rf /etc/localtime

/etc/localtime:
  file.symlink:
    - target: /usr/share/zoneinfo/Asia/Shanghai
[root@master init]# vim timezone/files/clock 
zone = Asia/Shshanghai

内核优化 kernel

[root@master init]# tree kernel/
kernel/
├── files
│   ├── limits.conf
│   └── sysctl.conf
└── main.sls

1 directory, 3 files
[root@master init]# vim kernel/main.sls 
/etc/sysctl.conf:
  file.managed:
    - source: salt://init/kernel/files/sysctl.conf
    - user: root
    - gorup: root
    - mode: '0644'

/etc/security/limits.conf:
  file.managed:
    - source: salt://init/kernel/files/limits.conf
    - user: root
    - gorup: root
    - mode: '0644'

'sysctl -p':
  cmd.run
  
[root@master init]# vim kernel/files/limits.conf
。。。
#@student        -       maxlogins       4
*                soft    nofile          65535
*                hard    nofile          65535
# End of file
。。。
[root@master init]# vim kernel/files/sysctl.conf 
。。。
# For more information, see sysctl.conf(5) and sysctl.d(5).
net.ipv4.ip_forward = 1

精简开机 service

[root@master init]# tree service/
service/
└── main.sls

0 directories, 1 file

[root@master init]# vim service/main.sls 
postfix.service:
  service.dead:
    - enable: false

优化 history

[root@master init]# tree history/
history/
└── main.sls

0 directories, 1 file
[root@master init]# vim history/main.sls 
/etc/profile:
  file.append:
    - text: 'export HISTTIMEFORMAT="%F %T `whoami` "'

设置终端超时 timeout

[root@master init]# tree timeout/
timeout/
└── main.sls

0 directories, 1 file
[root@master init]# cat timeout/main.sls 
/etc/profile:
  file.append:
    - text: 'export TMOUT=300'

配置 yum

[root@master init]# tree yum
yum
├── files
│   ├── centos-7.repo
│   ├── centos-8.repo
│   ├── epel.repo
│   ├── salt-7.repo
│   └── salt-8.repo
└── main.sls

1 directory, 6 files

[root@master init]# vim yum/main.sls 
{% if grains['os'] == 'RedHat' %}
/etc/yum.repos.d/centos-{{ grains['osrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/centos-{{ grains['osrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'
/etc/yum.repos.d/epel.repo:
  file.managed:
    - source: salt://init/yum/files/epel.repo
    - user: root
    - group: root
    - mode: '0644'
{% endif %}

{% if grains['os'] == 'CentOS' %}
epel-release:
  pkg.installed 
{% endif %}

/etc/yum.repos.d/salt-{{ grains['osmajorrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/salt-{{ grains['osmajorrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'

   


#基于基础源eple，阿里云源配置
cd files/
curl -o centos-7.repo https://mirrors.aliyun.com/repo/Centos-7.repo
curl -o centos-8.repo https://mirrors.aliyun.com/repo/Centos-8.repo
sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d'  centos-*.repo

yum install -y https://mirrors.aliyun.com/epel/epel-release-latest-8.noarch.rpm
mv /etc/yum.repos.d/epel.repo .
vim epel.repo
:%s#baseurl=https://download.example/pub#baseurl=https://mirrors.a
liyun.com#g
:%s/^#baseurl/baseurl/g
:%s/^metalink/#metalink/g

[root@master init]# vim yum/files/salt-7.repo 
[salt-latest-repo]
name=Salt repo for RHEL/CentOS 7 PY3
baseurl=https://repo.saltproject.io/py3/redhat/7/x86_64/latest
skip_if_unavailable=True
failovermethod=priority
enabled=1
enabled_metadata=1
gpgcheck=1
gpgkey=https://repo.saltproject.io/py3/redhat/7/x86_64/latest/SALTSTACK-GPG-KEY.pub, https://repo.saltproject.io/py3/redhat/7/x86_64/latest/base/RPM-GPG-KEY-CentOS-7

[root@master init]# vim yum/files/salt-8.repo 
[salt-latest-repo]
name=Salt repo for RHEL/CentOS 8 PY3
baseurl=https://repo.saltproject.io/py3/redhat/8/x86_64/latest
skip_if_unavailable=True
failovermethod=priority
enabled=1
enabled_metadata=1
gpgcheck=1
gpgkey=https://repo.saltproject.io/py3/redhat/8/x86_64/latest/SALTSTACK-GPG-KEY.pub

安装 salt-minion

[root@master init]# tree salt-minion/
salt-minion/
├── files
│   └── minion.j2
└── main.sls

1 directory, 2 files

[root@master init]# vim salt-minion/main.sls
include:
  - init.yum.main

salt-minion:
  pkg.installed

/etc/salt/minion:
  file.managed:
    - source: salt://init/salt-minion/files/minion.j2
    - user: root
    - group: root
    - mode: '0644'
    - template: jinja
salt-minion.service:
  service.running:
    - enable: true
//配置变量
[root@master ~]# cd /srv/pillar/
[root@master pillar]# ls
base  prod

[root@master base]# vim salt-minion.sls 
master_ip: 192.168.143.101
[root@master base]# vim top.sls 
base:
  '*':
    - salt-minion    
[root@master init]# vim salt-minion/files/minion.j2
。。。
#master: salt  
//修改此行
master: {{ pillar['master_ip'] }} 

# Set http proxy information for the minion when doing requests
。。。

安装 zabbix-agentd

[root@master zabbix-agentd]# tree
.
├── files
│   ├── install.sh
│   ├── zabbix-5.4.4.tar.gz
│   └── zabbix_agentd.conf.j2
└── main.sls

1 directory, 4 files

[root@master base]# pwd
/srv/pillar/base
[root@master base]# vim zabbix-ip.sls 
zabbix_ip: 192.168.143.101
[root@master base]# vim zabbix-name.sls 
zabbix_name: lTbqtJ5m
[root@master base]# vim top.sls 
base:
  '*':
     - zabbix-ip
     - zabbix-name

[root@master zabbix-agentd]# vim files/install.sh 
#! /bin/bash

cd /usr/src
tar xf zabbix-5.4.4.tar.gz

cd zabbix-5.4.4
./configure --enable-agent && make install

[root@master zabbix-agentd]# vim main.sls 
include:
  - init.basepkg.main

zabbix-user:
  user.present:
    - name: zabbix
    - shell: /sbin/nologin
    - system: true
    - createhome: false

/usr/src/zabbix-5.4.4.tar.gz:
  file.managed:
    - source: salt://init/zabbix-agentd/files/zabbix-5.4.4.tar.gz

agentd-install:
  cmd.script:
    - name: salt://init/zabbix-agentd/files/install.sh 
      unless: test -d /usr/local/etc/zabbix_agentd.conf.d

/usr/local/etc/zabbix_agentd.conf:
  file.managed:
    - source: salt://init/zabbix-agentd/files/zabbix_agentd.conf.j2
    - user: root
    - group: root
    - mode: '0644'
    - requitre:
      - cmd: agentd-install
    - template: jinja

#开机自启
/etc/init.d/zabbix_agentd:
  file.managed:
    - source: salt://init/zabbix-agentd/files/zabbix_agentd
    - user: root
    - group: root
    - mode: '0755'

'zabbix_agentd':
  cmd.run

'/etc/init.d/zabbix_agentd start':
  cmd.run

'chkconfig zabbix_agentd on':
  cmd.run

安装 basepkg

[root@master init]# tree basepkg/
basepkg/
└── main.sls

0 directories, 1 file


[root@master init]# vim basepkg/main.sls 
include:
  - init.yum.main

base.packages:
  pkg.installed:
    - pkgs:
      - screen
      - tree 
      - psmisc
      - openssl
      - openssl-devel
      - telnet
      - iftop
      - iotop
      - sysstat
      - wget
      - dos2unix
      - lsof
      - net-tools
      - vim-enhanced
      - zip
      - unzip
      - bzip2
      - bind-utils
      - gcc
      - gcc-c++
      - glibc
      - make
      - autoconf
      - pcre-devel
      - libpsl

二、SaltStack之系统初始化部署状态文件执行

[root@master init]# tree 
.
├── basepkg
│   └── main.sls
├── chrony
│   ├── files
│   │   └── chrony.conf
│   └── main.sls
├── firewall
│   └── main.sls
├── history
│   └── main.sls
├── kernel
│   ├── files
│   │   ├── limits.conf
│   │   └── sysctl.conf
│   └── main.sls
├── main.sls
├── salt-minion
│   ├── files
│   │   └── minion.j2
│   └── main.sls
├── selinux
│   ├── files
│   │   └── config
│   └── main.sls
├── service
│   └── main.sls
├── timeout
│   └── main.sls
├── timezone
│   ├── files
│   │   └── clock
│   └── main.sls
└── yum
    ├── files
    │   ├── centos-7.repo
    │   ├── centos-8.repo
    │   ├── epel.repo
    │   ├── salt-7.repo
    │   └── salt-8.repo
    └── main.sls

17 directories, 23 files

[root@master init]# vim main.sls 
//增加要包含的状态，即可
include:
  - init.yum.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
  - init.xx.main
//由于要随使用者添加状态，仅参考，没执行
[root@master init]# salt 'node3' state.sls init.main