saltstack自动化运维管理的一些操作(续)

job管理

• master在下发指令任务时，会附带上产生的jid。
• minion在接收到指令开始执行时，会在本地的/var/cache/salt/minion/proc目录下产生该jid命名的文件，用于在执行过程中master查看当前任务的执行情况。
• 指令执行完毕将结果传送给master后，删除该临时文件。

JOB MANAGEMENT.
Job cache
Job缓存默认保存24小时
vim /etc/salt/master
keep_jobs: 24
master端Job缓存目录
/var/cache/salt/master/jobs

把Job存储到数据库

STORING JOB RESULTS IN AN EXTERNAL SYSTEM.
SALT.RETURNERS.MYSQL.
方法一，External Job Cache

• Advantages: Data is stored without placing additional load on the Salt Master.
• Disadvantages: Each Salt Minion connects to the external job cache, which can result in a large number of connections. Also requires additional configuration to get returner module settings on all Salt Minions.

minion端
上面实验的server3已经安装过了数据库
[root@server3 mnt]# rpm -q MySQL-python 
MySQL-python-1.2.5-1.el7.x86_64
[root@server3 ~]# vim /etc/salt/minion
mysql.host: '172.25.10.1'
mysql.user: 'salt'
mysql.pass: 'westos'
mysql.db: 'salt'
mysql.port: 3306
[root@server3 ~]# systemctl restart salt-minion
master端。只需要安装mariadb-server
启动数据库
[root@server1 ~]# yum install -y mariadb-server
[root@server1 ~]# systemctl start mariadb
[root@server1 ~]# mysql
MariaDB [(none)]> create database salt;
MariaDB [(none)]> grant all on salt.* to salt@'%' identified by 'westos';

[root@server3 ~]# mysql -h 172.25.10.1 -u salt -p salt
MariaDB [salt]> show tables;

salt.sql模板内容
[root@server1 ~]#vim salt.sql
CREATE DATABASE  `salt`
  DEFAULT CHARACTER SET utf8
  DEFAULT COLLATE utf8_general_ci;
USE `salt`;
DROP TABLE IF EXISTS `jids`;
CREATE TABLE `jids` (
  `jid` varchar(255) NOT NULL,
  `load` mediumtext NOT NULL,
  UNIQUE KEY `jid` (`jid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

DROP TABLE IF EXISTS `salt_returns`;
CREATE TABLE `salt_returns` (
  `fun` varchar(50) NOT NULL,
  `jid` varchar(255) NOT NULL,
  `return` mediumtext NOT NULL,
  `id` varchar(255) NOT NULL,
  `success` varchar(10) NOT NULL,
  `full_ret` mediumtext NOT NULL,
  `alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  KEY `id` (`id`),
  KEY `jid` (`jid`),
  KEY `fun` (`fun`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

DROP TABLE IF EXISTS `salt_events`;
CREATE TABLE `salt_events` (
`id` BIGINT NOT NULL AUTO_INCREMENT,
`tag` varchar(255) NOT NULL,
`data` mediumtext NOT NULL,
`alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
`master_id` varchar(255) NOT NULL,
PRIMARY KEY (`id`),
KEY `tag` (`tag`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

mysql < salt.sql 导入数据

mysql
MariaDB [(none)]> grant all on salt.* to salt@‘localhost’ identified by ‘westos’;
[root@server1 ~]# mysql -u salt salt -p

MariaDB [salt]> select * from salt_returns;

方法二，Master Job Cache

• Advantages: A single connection is required to the external system. This is preferred for databases and similar systems.
• Disadvantages: Places additional load on your Salt Master.

master端
yum install MySQL-python mariadb-server
[root@server1 ~]# vim /etc/salt/master
master_job_cache: mysql
mysql.host: 'localhost'
mysql.user: 'salt'
mysql.pass: 'westos'
mysql.db: 'salt'
mysql.port: 3306

systemctl restart salt-master
[root@server1 ~]# mysql
MariaDB [(none)]> grant all on salt.* to salt@'localhost' identified by 'westos';
[root@server1 ~]# mysql -u salt salt -p

[root@server1 ~]# salt '*' mydisk.df
[root@server1 ~]# mysql
MariaDB [(none)]> use salt
MariaDB [salt]> select * from salt_returns\G;

salt-ssh与salt-syndic

salt-ssh

• salt-ssh可以独立运行的，不需要minion端。
• salt-ssh 用的是sshpass进行密码交互的。
• 以串行模式工作，性能下降。
• 安装salt-ssh:yum install -y salt-ssh

salt-ssh配置

配置roster文件
[root@server1 ~]# yum install -y salt-ssh 
[root@server1 ~]# vim /etc/salt/roster  ##默认的本地路径
server2:
  host: 172.25.0.2
  user: root
  passwd: westos
[root@server2 ~]# systemctl stop salt-minion

测试：
[root@server1 ~]# salt-ssh '*' test.ping
[root@server1 ~]# salt-ssh '*' cmd.run df

salt-syndic

• 如果大家知道zabbix proxy的话那就很容易理解了，syndic其实就是个代理，隔离master与minion。
• Syndic必须要运行在master上，再连接到另一个topmaster上。
• Topmaster 下发的状态需要通过syndic来传递给下级master，minion传递给master的数据也是由syndic传递给topmaster。
• topmaster并不知道有多少个minion。
• syndic与topmaster的file_roots和pillar_roots的目录要保持一致。

topmaster端（server4）

[root@server2 web]#  systemctl start salt-minion
[root@server1 ~]# yum install -y salt-syndic
[root@server4 ~]# yum install -y salt-master
[root@server4 ~]# vim /etc/salt/master
 order_masters: True   #作为顶级master
[root@server4 ~]# systemctl enable --now salt-master
下级master端：
[root@server1 ~]# vim /etc/salt/master
syndic_master: 172.25.0.4   #指向topmaster
[root@server1 ~]# systemctl restart salt-master
[root@server1 ~]# systemctl enable --now salt-syndic.service

测试

[root@server4 ~]# salt-key -A
[root@server4 ~]# salt-key -L  #查看下级master的连接授权
[root@server4 ~]# salt '*' test.ping

salt-api配置

github的salt-api.
REST_CHERRYPY.
SaltStack 官方提供有REST API格式的 salt-api 项目，将使Salt与第三方系统集成变得尤为简单。
安装salt-api
[root@server1 ~]# yum install -y salt-api ##安装salt-api
建立认证，生成密钥和证书
生成密钥

[root@server1 certs]# cd /etc/pki/tls/
[root@server1 tls]# cd private/
[root@server1 private]# openssl genrsa 1024 > localhost.key
[root@server1 private]# ls
localhost.key

生成证书

[root@server1 tls]# cd  certs/
[root@server1 certs]# ls
ca-bundle.crt  ca-bundle.trust.crt  localhost.key  make-dummy-cert  Makefile  renew-dummy-cert
[root@server1 certs]# make testcert   ##生成证书
(必须在/etc/pki/tls/certs/目录下,调用的是Makefile里面的东西)

创建用户认证文件
useradd -s /sbin/nologin saltapi
echo westos | passwd --stdin saltapi

vim /etc/salt/master.d/eauth.conf
external_auth:
  pam:
    saltapi:
      - .*
      - '@wheel'
      - '@runner'
      - '@jobs'

激活rest_cherrypy模块

[root@server1 master.d]# vim /etc/salt/master.d/api.conf
rest_cherrypy:
  port: 8000
  ssl_crt: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/private/localhost.key

重启服务
systemctl restart salt-master
systemctl start salt-api

获取认证token

[root@server1 master.d]# curl -sSk https://localhost:8000/login \
-H ‘Accept: application/x-yaml’\
-d username=saltapi\
-d password=westos\
-d eauth=pam

推送任务
salt '*' test.ping

[root@server1 master.d]# curl -sSk https://localhost:8000 \
-H ‘Accept: application/x-yaml’\
-H ‘X-Auth-Token: 443768cf691c2710ac2931c996b61de1c9821f3f’\
-d client=local\
-d tgt=’*’\
-d fun=test.ping

补充

oms的saltapi.py.

[root@server1 ~]# vim saltapi.py
[root@server1 ~]# python saltapi.py 
[root@server2 ~]# systemctl stop httpd
[root@server2 ~]# netstat -antlp | grep :80
tcp6       0      0 :::80                   :::*                    LISTEN      4360/httpd     

saltapi.py