saltstack自动化运维---Job管理、salt-ssh、salt-syndic、api

Job管理

master在下发指令任务时，会附带上产生的jid。
minion在接收到指令开始执行时，会在本地的/var/cache/salt/minion/proc目录下产生该jid命名的文件，用于在执行过程中master查看当前任务的执行情况。
指令执行完毕将结果传送给master后，删除该临时文件。

方法一

[root@server1 ~]# 
yum install -y mariadb-server
systemctl start mariadb.service

[root@server3 ~]# vim /etc/salt/minion
mysql.host: '192.168.3.201'
mysql.user: 'salt'
mysql.pass: 'westos'
mysql.db: 'salt'
mysql.port: 3306

[root@server3 ~]# systemctl restart salt-minion.service 

[root@server1 ~]# vim salt.sql 
CREATE DATABASE  `salt`
  DEFAULT CHARACTER SET utf8
  DEFAULT COLLATE utf8_general_ci;

USE `salt`;

--
-- Table structure for table `jids`
--

DROP TABLE IF EXISTS `jids`;
CREATE TABLE `jids` (
  `jid` varchar(255) NOT NULL,
  `load` mediumtext NOT NULL,
  UNIQUE KEY `jid` (`jid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--
-- Table structure for table `salt_returns`
--

DROP TABLE IF EXISTS `salt_returns`;
CREATE TABLE `salt_returns` (
  `fun` varchar(50) NOT NULL,
  `jid` varchar(255) NOT NULL,
  `return` mediumtext NOT NULL,
  `id` varchar(255) NOT NULL,
  `success` varchar(10) NOT NULL,
  `full_ret` mediumtext NOT NULL,
  `alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  KEY `id` (`id`),
  KEY `jid` (`jid`),
  KEY `fun` (`fun`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--
-- Table structure for table `salt_events`
--

DROP TABLE IF EXISTS `salt_events`;
CREATE TABLE `salt_events` (
`id` BIGINT NOT NULL AUTO_INCREMENT,
`tag` varchar(255) NOT NULL,
`data` mediumtext NOT NULL,
`alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
`master_id` varchar(255) NOT NULL,
PRIMARY KEY (`id`),
KEY `tag` (`tag`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

[root@server1 ~]# mysql < salt.sql
[root@server1 ~]# mysql
> grant all on salt.* to salt@'%' identified by 'westos';
> quit

salt 'server3' test.ping --return mysql
salt 'server3' cmd.run df --return mysql

[root@server3 ~]# systemctl restart salt-minion.service

[root@server1 ~]# mysql
> use salt;
> show tables;
> select * from salt_returns;

方法二

[root@server1 ~]# vim /etc/salt/master
master_job_cache: mysql
mysql.host: 'localhost'
mysql.user: 'salt'
mysql.pass: 'westos'
mysql.db: 'salt'
mysql.port: 3306

[root@server1 ~]# systemctl restart salt-master.service 
[root@server1 ~]# yum install MySQL-python -y

[root@server1 ~]# mysql
> grant all on salt.* to salt@'localhost' identified by 'westos';
> Bye
[root@server1 ~]# systemctl restart salt-master.service
[root@server1 ~]# lsof -i :4505
[root@server1 ~]# salt '*' test.ping
[root@server1 ~]# salt '*' mydisk.df
[root@server1 ~]# mysql -u salt salt -p
MariaDB [salt]> select * from salt_returns;

---

salt-ssh

salt-ssh可以独立运行的，不需要minion端。
salt-ssh 用的是sshpass进行密码交互的。
以串行模式工作，性能下降。

[root@server1 ~]# yum install -y salt-ssh
[root@server1 ~]# vim /etc/salt/roster
server2:
  host: 192.168.3.202
  user: root
  passwd: westos

[root@server2]# systemctl stop salt-minion.service 
[root@server1 ~]# lsof -i :4505
[root@server1 ~]# salt-ssh '*' test.ping
[root@server1 ~]# salt-ssh '*' cmd.run df

salt-syndic

syndic其实就是个代理，隔离master与minion。
Syndic必须要运行在master上，再连接到另一个topmaster上。
Topmaster 下发的状态需要通过syndic来传递给下级master，minion传递给master的数据也是由syndic传递给topmaster。
topmaster并不知道有多少个minion。
syndic与topmaster的file_roots和pillar_roots的目录要保持一致。

此实验server1为Syndic，server4为topmaster，server2,server3为minion

配置一台server4 关火墙

[root@server2 ~]# systemctl start salt-minion.service 
[root@server2 ~]# cd /etc/yum.repos.d/
[root@server2 yum.repos.d]# scp salt-3000.repo server4:/etc/yum.repos.d/

[root@server4 ~]#yum install -y salt-master

[root@server1 ~]# yum install -y salt-syndic

[root@server4 ~]# vim /etc/salt/master
order_masters: True

[root@server4 ~]# systemctl enable --now salt-master.service

[root@server1 ~]# vim /etc/salt/master
syndic_master: 192.168.3.204
[root@server1 ~]# systemctl restart salt-master.service 
[root@server1 ~]# systemctl enable --now salt-syndic.service

[root@server4 ~]# salt-key -L
[root@server4 ~]# salt-key -A
[root@server4 ~]# salt '*' test.ping

api

yum install -y salt-api
cd /etc/pki/tls/private/
openssl genrsa 1024 > localhost.key
cd /etc/pki/tls/certs/
make testcert

cd /etc/salt/master.d/
vim api.conf
rest_cherrypy:
  port: 8000
  ssl_crt: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/private/localhost.key

[root@server1 master.d]#vim auth.conf
external_auth:
  pam:
    saltapi:
      - .*
      - '@wheel'
      - '@runner'
      - '@jobs'

[root@server1 master.d]# useradd saltapi
[root@server1 master.d]# passwd saltapi
[root@server1 master.d]# systemctl restart salt-master
[root@server1 master.d]# systemctl enable --now salt-api
[root@server1 master.d]# netstat -antlp | grep :8000

[root@server1 master.d]# curl -sSk https://localhost:8000/login \
> -H 'Accept: application/x-yaml' \
> -d username=saltapi \
> -d password=westos \
> -d eauth=pam

[root@server1 master.d]# curl -sSk https://localhost:8000 \
> -H 'Accept: application/x-yaml' \
> -H 'X-Auth-Token: 87002b0d2594815c3b7546520151c74539bf2e26' \
> -d client=local \
> -d tgt='*' \
> -d fun=test.ping