SaltStack数据系统
文章目录
1. SaltStack数据系统
SaltStack有两大数据系统,分别是:
- Grains
- Pillar
2. SaltStack数据系统组件
2.1 SaltStack组件之Grains
Grains
是SaltStack
的一个组件,其存放着minion启动时收集到的信息。(类似于ansible的事实)
Grains
是SaltStack
组件中非常重要的组件之一,因为我们在做配置部署的过程中会经常使用它,Grains
是SaltStack
记录minion
的一些静态信息的组件。可简单理解为Grains
记录着每台minion
的一些常用属性,比如CPU、内存、磁盘、网络信息等。我们可以通过grains.items
查看某台minion
的所有Grains
信息。
Grains的功能:
- 收集资产信息
Grains应用场景:
- 信息查询
- 在命令行下进行目标匹配
- 在top file中进行目标匹配
- 在模板中进行目标匹配
模板中进行目标匹配请看:https://docs.saltstack.com/en/latest/topics/pillar/
信息查询实例:
# 列出所有信息
[root@master base]# salt 'node1' grains.items
node1:
----------
biosreleasedate: # bios时间
07/22/2020
biosversion: # bios版本
6.00
cpu_flags: # cpu相关属性
- fpu
- vme
- de
- pse
- tsc
- msr
- pae
- mce
- cx8
- apic
- sep
- mtrr
- pge
- mca
- cmov
- pat
- pse36
- clflush
- mmx
- fxsr
- sse
- sse2
- ss
- ht
- syscall
- nx
- pdpe1gb
- rdtscp
- lm
- constant_tsc
- arch_perfmon
- nopl
- xtopology
- tsc_reliable
- nonstop_tsc
- cpuid
- pni
- pclmulqdq
- vmx
- ssse3
- fma
- cx16
- pcid
- sse4_1
- sse4_2
- x2apic
- movbe
- popcnt
- tsc_deadline_timer
- aes
- xsave
- avx
- f16c
- rdrand
- hypervisor
- lahf_lm
- abm
- 3dnowprefetch
- cpuid_fault
- invpcid_single
- ssbd
- ibrs
- ibpb
- stibp
- ibrs_enhanced
- tpr_shadow
- vnmi
- ept
- vpid
- ept_ad
- fsgsbase
- tsc_adjust
- bmi1
- avx2
- smep
- bmi2
- invpcid
- rdseed
- adx
- smap
- clflushopt
- xsaveopt
- xsavec
- xgetbv1
- xsaves
- arat
- pku
- ospke
- md_clear
- flush_l1d
- arch_capabilities
cpu_model: # CPU具体型号
Intel(R) Core(TM) i5-10300H CPU @ 2.50GHz
cpuarch: #CPU架构
x86_64
cwd:
/
disks:
- sr0
- sda
dns:
----------
domain:
ip4_nameservers:
- 114.114.114.114
- 8.8.8.8
ip6_nameservers:
nameservers:
- 114.114.114.114
- 8.8.8.8
options:
search:
sortlist:
domain:
efi:
False
efi-secure-boot:
False
fqdn:
node1
fqdn_ip4: # IP地址
- 192.168.220.10
fqdn_ip6:
- fe80::2166:5bdf:402b:32c9
fqdns:
- node1
gid:
0
gpus:
|_
----------
model:
SVGA II Adapter
vendor:
vmware
groupname:
root
host: # 主机名
node1
hwaddr_interfaces:
----------
ens33:
00:0c:29:05:72:c7
lo:
00:00:00:00:00:00
id:
node1
init:
systemd
ip4_gw:
192.168.220.2
ip4_interfaces:
----------
ens33:
- 192.168.220.10
lo:
- 127.0.0.1
ip6_gw:
False
ip6_interfaces:
----------
ens33:
- fe80::2166:5bdf:402b:32c9
lo:
- ::1
ip_gw:
True
ip_interfaces:
----------
ens33:
- 192.168.220.10
- fe80::2166:5bdf:402b:32c9
lo:
- 127.0.0.1
- ::1
ipv4:
- 127.0.0.1
- 192.168.220.10
ipv6:
- ::1
- fe80::2166:5bdf:402b:32c9
kernel:
Linux
kernelparams:
|_
- BOOT_IMAGE
- (hd0,msdos1)/vmlinuz-4.18.0-257.el8.x86_64
|_
- root
- /dev/mapper/cs-root
|_
- ro
- None
|_
- crashkernel
- auto
|_
- resume
- /dev/mapper/cs-swap
|_
- rd.lvm.lv
- cs/root
|_
- rd.lvm.lv
- cs/swap
|_
- rhgb
- None
|_
- quiet
- None
kernelrelease:
4.18.0-257.el8.x86_64
kernelversion:
#1 SMP Thu Dec 3 22:16:23 UTC 2020
locale_info:
----------
defaultencoding:
UTF-8
defaultlanguage:
en_US
detectedencoding:
UTF-8
timezone:
EDT
localhost:
node1
lsb_distrib_codename:
CentOS Stream 8
lsb_distrib_id:
CentOS Stream
lsb_distrib_release:
8
lvm:
----------
cs:
- root
- swap
machine_id:
efed383c88dc451dba7b1ab7fb42b345
manufacturer:
VMware, Inc.
master:
192.168.220.9
mdadm:
mem_total:
1789
nodename:
node1
num_cpus:
2
num_gpus:
1
os: # 系统
CentOS Stream
os_family:
RedHat
osarch:
x86_64
oscodename:
CentOS Stream 8
osfinger:
CentOS Stream-8
osfullname:
CentOS Stream
osmajorrelease:
8
osrelease:
8
osrelease_info:
- 8
path:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
pid:
552906
productname:
VMware Virtual Platform
ps:
ps -efHww
pythonexecutable:
/usr/bin/python3.6
pythonpath:
- /usr/bin
- /usr/lib64/python36.zip
- /usr/lib64/python3.6
- /usr/lib64/python3.6/lib-dynload
- /usr/lib64/python3.6/site-packages
- /usr/lib/python3.6/site-packages
pythonversion:
- 3
- 6
- 8
- final
- 0
saltpath:
/usr/lib/python3.6/site-packages/salt
saltversion:
3004
saltversioninfo:
- 3004
selinux:
----------
enabled:
False
enforced:
Disabled
serialnumber:
VMware-56 4d 00 67 0e ae 3d fd-67 5a ca 68 9a 05 72 c7
server_id:
1797241226
shell:
/bin/sh
ssds:
swap_total:
2047
systemd:
----------
features:
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy
version:
239
systempath:
- /usr/local/sbin
- /usr/local/bin
- /usr/sbin
- /usr/bin
transactional:
False
uid:
0
username:
root
uuid:
67004d56-ae0e-fd3d-675a-ca689a0572c7
virtual:
VMware
zfs_feature_flags:
False
zfs_support:
False
zmqversion:
4.3.4
# 只查询所有的grains的key,而不查看具体的值
[root@master base]# salt 'node1' grains.ls
node1:
- biosreleasedate
- biosversion
- cpu_flags
- cpu_model
- cpuarch
- cwd
- disks
- dns
- domain
- efi
- efi-secure-boot
- fqdn
- fqdn_ip4
- fqdn_ip6
- fqdns
- gid
- gpus
- groupname
- host
- hwaddr_interfaces
- id
- init
- ip4_gw
- ip4_interfaces
- ip6_gw
- ip6_interfaces
- ip_gw
- ip_interfaces
- ipv4
- ipv6
- kernel
- kernelparams
- kernelrelease
- kernelversion
- locale_info
- localhost
- lsb_distrib_codename
- lsb_distrib_id
- lsb_distrib_release
- lvm
- machine_id
- manufacturer
- master
- mdadm
- mem_total
- nodename
- num_cpus
- num_gpus
- os
- os_family
- osarch
- oscodename
- osfinger
- osfullname
- osmajorrelease
- osrelease
- osrelease_info
- path
- pid
- productname
- ps
- pythonexecutable
- pythonpath
- pythonversion
- saltpath
- saltversion
- saltversioninfo
- selinux
- serialnumber
- server_id
- shell
- ssds
- swap_total
- systemd
- systempath
- transactional
- uid
- username
- uuid
- virtual
- zfs_feature_flags
- zfs_support
- zmqversion
# 获取IP地址
[root@master base]# salt 'node1' grains.get fqdn_ip4
node1:
- 192.168.220.10
[root@master base]# salt 'node1' grains.get ip4_interfaces
node1:
----------
ens33:
- 192.168.220.10
lo:
- 127.0.0.1
[root@master base]# salt 'node1' grains.get ip4_interfaces:ens33
node1:
- 192.168.220.10
目标匹配示例
用Grains
来匹配minion
:
# 在所有CentOS Stream 系统执行命令查看时间
[root@master base]# salt -G 'os:CentOS Stream' cmd.run 'date'
node1:
Tue Nov 2 03:59:22 EDT 2021
master:
Tue Nov 2 03:59:22 EDT 2021
在 top file里面使用Grains
[root@master base]# vim top.sls
base:
'os:CentOS Stream':
- match: grain # match 匹配grain
- web.apache.install
# 执行
[root@master base]# salt -G 'os:CentOS Stream' state.highstate
自定义Grains的两种方法:
-
minion配置文件,在配置文件中搜索grains
-
在/etc/salt下生成一个grains文件,在此文件中定义(推荐方式)
第一种:
# node1上修改配置文件
[root@node1 ~]# vim /etc/salt/minion
.......
137 grains:
138 roles:
139 linux
.......
[root@node1 ~]# systemctl restart salt-minion
# master上查看
[root@master base]# salt 'node1' grains.get roles
node1:
linux
第二种:
# 在master端的/etc/salt/下生成一个grains文件,在此文件中定义,然后那台被控制机需要就传过去
[root@master base]# cd /etc/salt/
[root@master salt]# ls
cloud cloud.maps.d master minion.d proxy
cloud.conf.d cloud.profiles.d master.d minion_id proxy.d
cloud.deploy.d cloud.providers.d minion pki roster
[root@master salt]# vim grains
LOOKP:
lpgfdg
# 不重启服务的情况下同步
[root@master salt]# salt '*' saltutil.sync_grains
node1:
master:
# 查看
[root@master salt]# salt 'master' grains.get LOOKP
master:
lpgfdg
# 比如我们传到node1上
[root@master salt]# scp grains 192.168.220.10:/etc/salt/
The authenticity of host '192.168.220.10 (192.168.220.10)' can't be established.
ECDSA key fingerprint is SHA256:ZeQy7MqiTiEdnowRrum5zEWROx4LRrsYwdL8dvgx6N0.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.220.10' (ECDSA) to the list of known hosts.
root@192.168.220.10's password:
grains 100% 16 31.5KB/s 00:00
# 同步并查看
[root@master salt]# salt 'node1' saltutil.sync_grains
node1:
[root@master salt]# salt 'node1' grains.get LOOKP
node1:
lpgfdg
2.2 SaltStack组件之Pillar
Pillar也是SaltStack组件中非常重要的组件之一,是数据管理中心,**经常配置states在大规模的配置管理工作中使用它。**Pillar在SaltStack中主要的作用就是存储和定义配置管理中需要的一些数据,比如软件版本号、用户名密码等信息,它的定义存储格式与Grains类似,都是YAML格式。
在Master配置文件中有一段Pillar settings选项专门定义Pillar相关的一些参数:
[root@master salt]# vim /etc/salt/master
......
851 pillar_roots:
852 base:
853 - /srv/salt/pillar/base
......
[root@master ~]# mkdir -p /srv/salt/pillar/base
[root@master ~]# ls /srv/salt
base dev pillar prod test
[root@master ~]# ls /srv/salt/pillar/
base
[root@master salt]# systemctl restart salt-master
默认Base环境下Pillar的工作目录在/srv/pillar目录下。若你想定义多个环境不同的Pillar工作目录,只需要修改此处配置文件即可。
Pillar的特点:
- 可以给指定的minion定义它需要的数据
- 只有指定的人才能看到定义的数据
- 在master配置文件里设置
# 查看pillar的信息
[root@master salt]# salt '*' pillar.items
master:
----------
node1:
----------
默认pillar
是没有任何信息的,如果想查看信息,需要在 master 配置文件上把 pillar_opts
的注释取消,并将其值设为 True。
[root@master salt]# vim /etc/salt/master
......
900 # master config file that can then be used on minions.
901 pillar_opts: True # 取消注释,改为True
......
[root@master salt]# systemctl restart salt-master
[root@master salt]# salt '*' pillar.items
......
winrepo_passphrase:
winrepo_password:
winrepo_privkey:
winrepo_pubkey:
winrepo_refspecs:
- +refs/heads/*:refs/remotes/origin/*
- +refs/tags/*:refs/tags/*
winrepo_remotes:
- https://github.com/saltstack/salt-winrepo.git
winrepo_remotes_ng:
- https://github.com/saltstack/salt-winrepo-ng.git
winrepo_ssl_verify:
True
winrepo_user:
worker_threads:
5
zmq_backlog:
1000
zmq_filtering:
False
zmq_monitor:
False
2.3 pillar自定义数据
在master的配置文件里找pillar_roots可以看到其存放pillar的位置
[root@master salt]# vim /etc/salt/master
......
851 pillar_roots:
852 base:
853 - /srv/salt/pillar/base
854 prod:
855 - /srv/salt/pillar/prod
......
[root@master salt]# mkdir -p /srv/salt/pillar/prod
[root@master salt]# systemctl restart salt-master
[root@master salt]# cd /srv/salt/pillar/base
[root@master base]# ls
[root@master base]# vim apache.sls
{% if grains['os'] == 'CentOS Stream' %} # 系统为CentOS Stream的可以
apache: httpd
{% elif grains['os'] == 'Debian' %}
apache: apache2
{% endif %}
[root@master base]# vim top.sls
[root@master base]# cat top.sls
base:
'node1': # 只能让node1能够看到和执行/srv/salt/pillar/base/apache.sls文件
- apache
[root@master salt]# salt '*' pillar.items
node1:
----------
apache:
httpd
master:
----------
# 修改apache的状态文件,引用pillar的数据
[root@master base]# vim /srv/salt/base/web/apache/install.sls
apache-install:
pkg.installed:
- name: {{ pillar['apache'] }}
apache-service:
service.running:
- name: {{ pillar['apache']}}
- enable: True
# 执行高级状态
[root@master salt]# salt '*' state.highstate
master: # master不能看到也不能执行
Data failed to compile:
----------
Rendering SLS 'base:web.apache.install' failed: Jinja variable 'salt.utils.context.NamespacedDictWrapper object' has no attribute 'apache'
node1:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: All specified packages are already installed
Started: 05:36:33.911887
Duration: 640.768 ms
Changes:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: True
Comment: The service httpd is already running
Started: 05:36:34.554109
Duration: 37.839 ms
Changes:
Summary for node1
------------
Succeeded: 2
Failed: 0
------------
Total states run: 2
Total run time: 678.607 ms
ERROR: Minions returned with non-zero exit code
2.4 Grains与Pillar的区别
存储位置 | 类型 | 采集方式 | 应用场景 | |
---|---|---|---|---|
Grains | minion | 静态 | minion启动时采集 可通过刷新避免重启minion服务 | 1.信息查询 2.在命令行下进行目标匹配 3.在top file中进行目标匹配 4.在模板中进行目标匹配 |
Pillar | master | 动态 | 指定,实时生效 | 1.目标匹配 2.敏感数据配置 |