saltstack(6)jobcache和salt-ssh

---

1.jobcache

Salt提供了一种可以直接在Master端将返回存储下来的机制。在Master配置文件中有master_job_cache的选项，默认就是Mysql。我们打开就可以将Job的返回结果直接存入MySQL中。

• 官方手册
  http://docs.saltstack.cn/ref/returners/all/salt.returners.mysql.html#module-salt.returners.mysql

[root@zhenji ~]# yum install ipmitool.x86_64 -y

1 ）minion端安装和配置

[root@server11 zabbix-server]# yum install mariadb-server -y
[root@server11 zabbix-server]# systemctl start mariadb.service 
#minion端安装，通过这个传数据
[root@server13 ~]# rpm -q MySQL-python 
MySQL-python-1.2.5-1.el7.x86_64
[root@server13 ~]# vim /etc/salt/minion
#return:
#  - mysql
#  - hipchat
#  - slack
#添加：
mysql.host: '192.168.100.241'
mysql.user: 'salt'
mysql.pass: 'westos'
mysql.db: 'salt'
mysql.port: 3306

[root@server13 ~]# systemctl restart salt-minion.service 

2）往库里写数据

[root@server11 ~]# vim salt.sql
[root@server11 ~]# cat salt.sql 
CREATE DATABASE  `salt`
  DEFAULT CHARACTER SET utf8
  DEFAULT COLLATE utf8_general_ci;

USE `salt`;

--
-- Table structure for table `jids`
--

DROP TABLE IF EXISTS `jids`;
CREATE TABLE `jids` (
  `jid` varchar(255) NOT NULL,
  `load` mediumtext NOT NULL,
  UNIQUE KEY `jid` (`jid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--
-- Table structure for table `salt_returns`
--

DROP TABLE IF EXISTS `salt_returns`;
CREATE TABLE `salt_returns` (
  `fun` varchar(50) NOT NULL,
  `jid` varchar(255) NOT NULL,
  `return` mediumtext NOT NULL,
  `id` varchar(255) NOT NULL,
  `success` varchar(10) NOT NULL,
  `full_ret` mediumtext NOT NULL,
  `alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  KEY `id` (`id`),
  KEY `jid` (`jid`),
  KEY `fun` (`fun`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

--
-- Table structure for table `salt_events`
--

DROP TABLE IF EXISTS `salt_events`;
CREATE TABLE `salt_events` (
`id` BIGINT NOT NULL AUTO_INCREMENT,
`tag` varchar(255) NOT NULL,
`data` mediumtext NOT NULL,
`alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
`master_id` varchar(255) NOT NULL,
PRIMARY KEY (`id`),
KEY `tag` (`tag`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

[root@server11 ~]# mysql < salt.sql

[root@server11 ~]# mysql
MariaDB [(none)]> use salt

MariaDB [salt]> show tables;
+----------------+
| Tables_in_salt |
+----------------+
| jids           |
| salt_events    |
| salt_returns   |
+----------------+

[root@server11 ~]# salt server13 test.ping --return mysql
[root@server11 ~]# salt server13 cmd.run df  --return mysql#这些数据都会通过minion端返回到server11的数据库中
#在数据库中查看
[root@server11 ~]# mysql

MariaDB [(none)]> use salt
MariaDB [salt]> show tables;
+----------------+
| Tables_in_salt |
+----------------+
| jids           |
| salt_events    |
| salt_returns   |
+----------------+
MariaDB [salt]> select * from salt_returns;

3)master：配置mysql,让mysql直接储存catch。而不是存到本地

[root@server11 ~]# vim /etc/salt/master
#最后加上
master_job_cache: mysql
mysql.host: 'localhost'
mysql.user: 'salt'
mysql.pass: 'westos'
mysql.db: 'salt'
mysql.port: 3306

[root@server11 ~]# yum install MySQL-python-1.2.5-1.el7.x86_64 -y
[root@server11 ~]# mysql
MariaDB [(none)]> grant all on salt.* to salt@'localhost' identified by 'westos';
[root@server11 ~]# systemctl restart salt-master.service
[root@server11 ~]# lsof -i :4505
COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
/usr/bin/ 23888 root   15u  IPv4  82696      0t0  TCP *:4505 (LISTEN)
/usr/bin/ 23888 root   17u  IPv4  83313      0t0  TCP server11:4505->server13:58416 (ESTABLISHED)
/usr/bin/ 23888 root   18u  IPv4  85004      0t0  TCP server11:4505->server12:41984 (ESTABLISHED)
[root@server11 ~]# salt '*' test.ping
[root@server11 ~]# salt '*' mydisk.df

#在数据库中查看
[root@server11 ~]# mysql
MariaDB [(none)]> use salt
MariaDB [salt]> show tables;
MariaDB [salt]> select * from salt_returns\G;#有test.pingh和mydisk.df数据

2.salt-ssh

salt-ssh 是 0.17.0 新引入的一个功能，不需要minion对客户端进行管理，也不需要master。
salt-ssh 支持salt大部分的功能：如 grains、modules、state 等
salt-ssh 没有使用ZeroMQ的通信架构，执行是串行模式，类似 paramiko、pssh、ansible 这类的工具

[root@server11 ~]# yum install salt-ssh -y
[root@server11 ~]# cd /etc/salt/
[root@server11 salt]# vim roster 
添加
server12:
  host: 192.168.100.242
  user: root
  passwd: westos
[root@server12 web]# systemctl stop salt-minion.service 
[root@server11 salt]# lsof -i :4505 #已经断开了连接
COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
/usr/bin/ 23888 root   15u  IPv4  82696      0t0  TCP *:4505 (LISTEN)
/usr/bin/ 23888 root   17u  IPv4  83313      0t0  TCP server11:4505->server13:58416 (ESTABLISHED)
[root@server11 salt]# salt-ssh '*' test.ping
server12:
    True
[root@server11 salt]# salt-ssh '*' cmd.run df

3. salt-syndic

要控制的节点变多的时候，一个master节点压力过大，需要syndic，相当于zabbix的proxy代理，隔离master与minion。
Syndic必须要运行在master上，再连接到另一个topmaster上。
• Topmaster 下发的状态需要通过syndic来传递给下级master，minion传递给master的数据也是由syndic传递给topmaster。
• topmaster并不知道有多少个minion。
• syndic与topmaster的file_roots和pillar_roots的目录要保持一致。

新建server14做salt-syndic、salt-api

[root@server12 yum.repos.d]# scp salt-3000.repo server14:/etc/yum.repos.d/
[root@server14 yum.repos.d]# yum install salt-master -y
[root@server11 salt]# yum install salt-syndic -y

• 作分布式，salt-syndic配置，syndic是master和minion的代理
• syndic要运行在master上
• user->top master->(syndic->mater)->minion

[root@server14 ~]# vim /etc/salt/master
#更改
order_masters: True
[root@server14 ~]# systemctl enable --now salt-master.service 

[root@server11 salt]# vim /etc/salt/master
#更改
syndic_master: 192.168.100.244
[root@server11 salt]# systemctl restart salt-master.service 
[root@server11 salt]# systemctl enable --now salt-syndic.service 

[root@server14 ~]# salt-key -A
The following keys are going to be accepted:
Unaccepted Keys:
server11
Proceed? [n/Y] y
Key for minion server11 accepted.
[root@server14 ~]# salt-key -L
Accepted Keys:
server11
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@server14 ~]# salt '*' test.ping
server13:
    True
server12:
    True

5 salt-api

SaltStack 官方提供有REST API格式的 salt-api 项目
官方提供了三种api模块:
• rest_cherrypy
• rest_tornado
• rest_wsgi
• 官方链接：https://docs.saltstack.com/en/latest/ref/netapi/all/index.html#all-netapimodules

[root@server14 ~]# yum install -y salt-api
[root@server14 private]# cd /etc/pki/tls/private/
[root@server14 private]# openssl genrsa 1024 > localhost.key
[root@server14 private]# cd /etc/pki/tls/certs/
[root@server14 certs]# make testcert

cd /etc/salt/master.d/
vim api.conf
rest_cherrypy:
  port: 8000
  ssl_crt: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/private/localhost.key
[root@server1 master.d]#vim auth.conf
external_auth:
  pam:
    saltapi:
      - .*
      - '@wheel'
      - '@runner'
      - '@jobs'

[root@server1 master.d]# useradd saltapi
[root@server1 master.d]# passwd saltapi
[root@server1 master.d]# systemctl restart salt-master
[root@server1 master.d]# systemctl enable --now salt-api
[root@server1 master.d]# netstat -antlp | grep :8000
[root@server1 master.d]# curl -sSk https://localhost:8000/login \
> -H 'Accept: application/x-yaml' \
> -d username=saltapi \
> -d password=westos \
> -d eauth=pam
[root@server1 master.d]# curl -sSk https://localhost:8000 \
> -H 'Accept: application/x-yaml' \
> -H 'X-Auth-Token: 87002b0d2594815c3b7546520151c74539bf2e26' \
> -d client=local \
> -d tgt='*' \
> -d fun=test.ping