SaltStack进阶

1. masterless

1.1 应用场景

• master 与 minion 网络不通或通信有延迟，即网络不稳定
• 想在 minion 端直接执行状态

传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到 masterless 了。

有了masterless，即使你只有一台主机，也能玩saltstack，而不需要你有N台主机架构。

1.2 masterless配置

1.2.1 修改配置文件minion

环境：centos8

主机名	IP地址	部署功能	实现
node5	192.168.143.106	salt-minion	无master，使用salt命令

• 注释master行
• 取消注释file_client并设其值为local
• 设置file_roots
• 设置pillar_roots

[root@master ~]# scp /etc/yum.repos.d/salt-8.repo 192.168.143.106:/etc/yum.repos.d/salt-8.repo
root@192.168.143.106's password: 
salt-8.repo            100%  292    76.3KB/s   00:00  
[root@node5 ~]# yum install -y epel-release

[root@node5 ~]# vim /etc/salt/minion
....此处省略N行
# resolved, then the minion will fail to start.
# master: salt      //注释此行
....此处省略N行
file_client: local  //取消此行注释并将值设为local
....此处省略N行
file_roots:         //设置file_roots的路径和环境，可有多套环境
  base:
    - /srv/salt/base
pillar_roots: /设置pillar_roots的路径和环境，可有多套环境
  base:
    - /srv/pillar/base
    

1.2.2 关闭salt-minion服务

使用 masterless 模式时是不需要启动任何服务的，包括salt-master和salt-minion。

[root@node5 ~]# systemctl stop salt-minion
[root@node5 ~]# systemctl disable salt-minion
Removed symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service.

1.2.3 salt-call

masterless模式执行模块或状态时需要使用salt-call命令，而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。

//普通命令
[root@node5 ~]# salt-call --local cmd.run 'date'
local:
    Mon Nov 29 04:15:55 EST 2021
[root@node5 ~]# salt-call --local cmd.run 'mkdir hy'
local:
[root@node5 ~]# ls
anaconda-ks.cfg  hy
//执行状态
[root@node5 ~]# mkdir -p /srv/{salt,pillar}/base
[root@master ~]#  scp -r /srv/salt/base/* 192.168.143.106:/srv/salt/base/
[root@master ~]# scp -r /srv/pillar/base/* 192.168.143.106:/srv/pillar/base/
[root@node5 ~]# salt-call --local state.sls init.history.main
[root@node5 ~]# history 
    1  2021-11-29 04:30:07 root df -hT
    2  2021-11-29 04:30:07 root hostnamectl set-hostname localhost

2. salt-master高可用

2.1 salt-master高可用配置

我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。salt的高可用配置非常简单，只需要改一下minion配置文件，将master用列表的形式列出即可。官方文档

环境：centos8 高可用

主机名	IP地址	部署功能	实现
master	192.168.143.101	salt-master	主salt
maser2	192.168.143.105	salt-master	同步的备salt
node5	192.168.143.106	salt-minion	被控minion配置

//配置流程
步骤概述
1创建master2主服务器

2将主master密钥复制到master2主密钥

3启动maser2主机

4配置minion连接到master2主机

5重启minion

6接受maser2主机上的密钥

7配置minion主备切换

//创建master2主服务器
[root@master2 ~]# ls /etc/yum.repos.d/
CentOS-Linux-AppStream.repo
CentOS-Linux-BaseOS.repo
CentOS-Linux-ContinuousRelease.repo
CentOS-Linux-Debuginfo.repo
CentOS-Linux-Devel.repo
CentOS-Linux-Extras.repo
CentOS-Linux-FastTrack.repo
CentOS-Linux-HighAvailability.repo
CentOS-Linux-Media.repo
CentOS-Linux-Plus.repo
CentOS-Linux-PowerTools.repo
CentOS-Linux-Sources.repo
salt-8.repo
[root@master2 ~]# yum install -y salt-master
[root@master ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── minions
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   │   
│   ├── minions_rejected
│   └── ssh
└── minion

7 directories, 3 files

[root@node5 ~]# vim /etc/salt/minion
[root@node5 ~]# systemctl restart salt-minion.service
[root@master ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
node5
Key for minion node5 accepted.
[root@master ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── minions
│   │   └── node5
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   ├── minions_rejected
│   └── ssh
└── minion

8 directories, 3 files
[root@master2 ~]# tree  /etc/salt/pki/
/etc/salt/pki/
├── master
└── minion

2 directories, 0 files
//将主master密钥复制到master2主密钥
[root@master ~]# scp /etc/salt/pki/master/master.p* 192.168.143.106:/etc/salt/pki/master/
[root@master2 ~]# tree  /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   └── master.pub
└── minion

2 directories, 2 files
//启动maser2主机
[root@master2 ~]# systemctl start salt-master.service 
[root@master2 ~]# tree  /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── minions
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   └── minions_rejected
└── minion

7 directories, 2 files
//配置minion连接到master2主机
[root@node5 ~]# vim /etc/salt/minion
....此处省略N行
master: 192.168.143.105
....此处省略N行
//重启minion
[root@node5 ~]# systemctl restart salt-minion.service
//接受maser2主机上的密钥
[root@master2 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node5
Rejected Keys:
[root@master2 ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
node5
Key for minion node5 accepted.
[root@master2 ~]# salt-key -L
Accepted Keys:
node5
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@master2 ~]# salt 'node5' test.ping
node5:
    True
//配置minion主备切换
[root@node5 ~]# vim /etc/salt/minion
....此处省略N行
#master: salt
master: 
  - 192.168.143.101  #master-ip
  - 192.168.143.105  #master2-ip
  
# beacons) without a master connection
master_type: failover #类型为故障切换

# of TCP connections, such as load balancers.)
master_alive_interval: 3 #修改此行3秒超时
....此处省略N行

//模拟主salt出现故障
[root@master ~]# salt 'node5' test.ping
node5:
    True
[root@master ~]# systemctl stop salt-master.service 
//此时被salt就可以使用
[root@master2 ~]# salt 'node5' test.ping
node5:
    Minion did not return. [No response]
    The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:
    
    salt-run jobs.lookup_jid 20211129110135298459
ERROR: Minions returned with non-zero exit code
[root@master2 ~]# salt 'node5' test.ping
node5:
    True
#注意高可用又称故障转移，来保护重要服务，二台设备不能同时使用。

2.2 salt-master高可用之数据同步

涉及到高可用时，数据的同步是个永恒的话题，我们必须保证高可用的2个master间使用的数据是一致的，包括：

• /etc/salt/master配置文件
• /etc/salt/pki目录下的所有key
• /srv/下的salt和pillar目录下的所有文件

保障这些数据同步的方案有：

• nfs挂载
• rsync同步
• 使用gitlab进行版本控制

安全相关：
为保证数据的同步与防止丢失，可将状态文件通过gitlab进行版本控制管理。

3. salt-syndic分布式架构

3.1 salt-syndic架构图

3.2 salt-syndic的优劣势

优势：

• 可以通过syndic实现更复杂的salt架构
• 减轻master的负担

劣势：

• syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致，所以要进行数据同步，同步方案同salt-master高可用
• 最顶层的master不知道自己有几个syndic，它只知道自己有多少个minion，并不知道这些minion是由哪些syndic来管理的

3.3 salt-syndic部署

3.3.1 环境说明 Centos8

主机IP	角色	主机名	安装的应用
192.168.143.101	Master	master	salt-master
192.168.143.102	Syndic	syndic	salt-master salt-syndic
192.168.143.103	Syndic	syndic2	salt-master salt-syndic
192.168.143.104	Minion	node3	salt-minion
192.168.143.105	Minion	node4	salt-minion

3.3.2 配置master

修改master的master配置文件

• 取消注释order_master
• 将order_master的值设为True

[root@master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@master ~]# vim /etc/salt/master
.....此处省略N行
# masters' syndic interfaces.
order_masters: True
[root@master ~]# systemctl restart salt-master

3.3.3 配置syndic

修改syndic所在主机的master配置文件

• 取消注释syndic_master
• 将syndic_master的值设为master的IP

//syndic配置
[root@syndic ~]# ls /etc/yum.repos.d/
CentOS-Linux-AppStream.repo
CentOS-Linux-BaseOS.repo
CentOS-Linux-ContinuousRelease.repo
CentOS-Linux-Debuginfo.repo
CentOS-Linux-Devel.repo
CentOS-Linux-Extras.repo
CentOS-Linux-FastTrack.repo
CentOS-Linux-HighAvailability.repo
CentOS-Linux-Media.repo
CentOS-Linux-Plus.repo
CentOS-Linux-PowerTools.repo
CentOS-Linux-Sources.repo
salt-8.repo
[root@syndic ~]# yum install -y salt-master salt-syndic
[root@syndic ~]# vim /etc/salt/master
.....此处省略N行
syndic_master: 192.168.143.101
[root@syndic ~]# systemctl enable --now salt-master.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.
[root@syndic ~]# systemctl enable --now salt-syndic.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-syndic.service → /usr/lib/systemd/system/salt-syndic.service.

//syndir2配置
[root@syndic2 ~]# ls /etc/yum.repos.d/
CentOS-Linux-AppStream.repo
CentOS-Linux-BaseOS.repo
CentOS-Linux-ContinuousRelease.repo
CentOS-Linux-Debuginfo.repo
CentOS-Linux-Devel.repo
CentOS-Linux-Extras.repo
CentOS-Linux-FastTrack.repo
CentOS-Linux-HighAvailability.repo
CentOS-Linux-Media.repo
CentOS-Linux-Plus.repo
CentOS-Linux-PowerTools.repo
CentOS-Linux-Sources.repo
salt-8.repo
[root@syndic2 ~]# yum install -y salt-master salt-syndic
[root@syndic2 ~]# vim /etc/salt/master
.....此处省略N行
syndic_master: 192.168.143.101
[root@syndic2 ~]# systemctl enable --now salt-master.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.
[root@syndic2 ~]# systemctl enable --now salt-syndic.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-syndic.service → /usr/lib/systemd/system/salt-syndic.service.

3.3.4 配置minion

配置minion，将master指向syndic所在主机

//node3配置
[root@node3 ~]# ls /etc/yum.repos.d/
CentOS-Linux-AppStream.repo
CentOS-Linux-BaseOS.repo
CentOS-Linux-ContinuousRelease.repo
CentOS-Linux-Debuginfo.repo
CentOS-Linux-Devel.repo
CentOS-Linux-Extras.repo
CentOS-Linux-FastTrack.repo
CentOS-Linux-HighAvailability.repo
CentOS-Linux-Media.repo
CentOS-Linux-Plus.repo
CentOS-Linux-PowerTools.repo
CentOS-Linux-Sources.repo
salt-8.repo
[root@node3 ~]# yum install -y salt-minion
[root@node3 ~]# vim /etc/salt/minion
.....此处省略N行
#修改此行
master: 192.168.143.102
[root@node3 ~]# systemctl enable --now salt-minion.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.

//node4配置
[root@node4 ~]# ls /etc/yum.repos.d/
CentOS-Linux-AppStream.repo
CentOS-Linux-BaseOS.repo
CentOS-Linux-ContinuousRelease.repo
CentOS-Linux-Debuginfo.repo
CentOS-Linux-Devel.repo
CentOS-Linux-Extras.repo
CentOS-Linux-FastTrack.repo
CentOS-Linux-HighAvailability.repo
CentOS-Linux-Media.repo
CentOS-Linux-Plus.repo
CentOS-Linux-PowerTools.repo
CentOS-Linux-Sources.repo
salt-8.repo
[root@node4 ~]# yum install -y salt-minion
[root@node4 ~]# vim /etc/salt/minion
.....此处省略N行
#修改此行
master: 192.168.143.103
[root@node4 ~]# systemctl enable --now salt-minion.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.

在所有minion上做同样的操作，注意，要设置minion配置文件中的id参数，指向minion自身的ip地址或主机名，必须能够唯一标识minion本机。

3.3.5 在syndic上接受minion主机的key

//syndir接受
[root@syndic ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node3
Rejected Keys:
[root@syndic ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
node2
Key for minion node3 accepted.

//syndir2接受
[root@syndic2 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node4
Rejected Keys:
[root@syndic2 ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
node4
Key for minion node4 accepted.

3.3.6 在master上接受syndic主机的key

//master接受key
[root@master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
syndic
syndic2
Rejected Keys:
master
[root@master ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
syndic
syndic2
Key for minion syndic accepted.
Key for minion syndic2 accepted.
[root@master ~]# salt-key -L
Accepted Keys:
syndic
syndic2
Denied Keys:
Unaccepted Keys:
Rejected Keys:
master

3.3.7 在master上执行模块或状态检验有几个minion应答

//master测试
[root@master ~]# salt '*' test.ping
node4:
    True
node3:
    True

3.3.8 在master上执行初始化命令到minion主机

//syndir 打开环境
[root@syndic ~]# vim /etc/salt/master
。。。
file_roots:
  base:
    - /srv/salt/base
    
pillar_roots:
  base:
    - /srv/pillar/base
[root@syndic ~]# mkdir -p /srv/salt/base
[root@syndic ~]# mkdir -p /srv/pillar/base
[root@syndic ~]# systemctl restart salt-master.service 
[root@syndic ~]# systemctl restart salt-syndic.service

//syndir2 打开环境
[root@syndic2 ~]# vim /etc/salt/master
.....此处省略N行
file_roots:
  base:
    - /srv/salt/base
    
pillar_roots:
  base:
    - /srv/pillar/base
[root@syndic2 ~]# mkdir -p /srv/salt/base
[root@syndic2 ~]#  mkdir -p /srv/pillar/base
[root@syndic2 ~]# systemctl restart salt-master.service 
[root@syndic2 ~]# systemctl restart salt-syndic.service

//minon执行效果
[root@master ~]# salt '*' test.ping
node3:
    True
node4:
    True
[root@master ~]# scp -r /srv/* 192.168.143.102:/srv/
[root@master ~]# scp -r /srv/* 192.168.143.103:/srv/
[root@master ~]# salt '*' state.sls init.main
[root@node3 ~]# history 
    1  2021-11-30 21:23:11 root df -hT
    2  2021-11-30 21:23:11 root hostnamectl set-hostname localhost
    3  2021-11-30 21:23:11 root bash
[root@node3 ~]# tree /srv/
/srv/

0 directories, 0 files