SaltStack进阶

最新推荐文章于 2022-05-10 11:49:09 发布

喂小鸭

最新推荐文章于 2022-05-10 11:49:09 发布

阅读量101

点赞数

文章标签： mongodb 数据库 database

本文链接：https://blog.csdn.net/weixiaoya0204/article/details/121616231

版权

这里写目录标题

1. masterless
2. salt-master高可用
- 2.1 salt-master高可用配置
- 2.2 salt-master高可用之数据同步
3. salt-syndic分布式架构

1. masterless

1.1 应用场景

master 与 minion 网络不通或通信有延迟，即网络不稳定
想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到 masterless 了。

有了masterless，即使你只有一台主机，也能玩saltstack，而不需要你有N台主机架构。

1.2 masterless配置

1.2.1 修改配置文件minion

注释master行
取消注释file_client并设其值为local
设置file_roots
设置pillar_roots

[root@node1 ~]# mkdir -p /srv/{salt,piller}/base
[root@node1 ~]# tree /srv/
/srv/
├── piller
│   └── base
└── salt
    └── base

[root@node1 ~]# vim /etc/salt/minion 
# resolved, then the minion will fail to start.
# master: salt      //注释此行

607 # minion in masterless mode.
608 file_client: local

625 file_roots:
626   base:
627     - /srv/salt/base

663 pillar_roots:
664   base:
665     - /srv/pillar/base

1.2.2 关闭salt-minion服务

使用 masterless 模式时是不需要启动任何服务的，包括salt-master和salt-minion。

[root@node1 ~]# systemctl disable --now salt-minion
Removed /etc/systemd/system/multi-user.target.wants/salt-minion.service.

1.2.3 salt-call

masterless模式执行模块或状态时需要使用salt-call命令，而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。

//在minion查看当前系统时间
[root@node1 ~]# salt-call --local cmd.run 'date'
local:
    Mon Nov 29 18:42:07 CST 2021
 
 //在node1关闭防火墙
[root@node1 base]# cat main.sls 
firewalld.service:
  service.dead:
    - enable: false
    
[root@node1 base]# salt-call --local state.sls 'main'
local:
----------
          ID: firewalld.service
    Function: service.dead
      Result: True
     Comment: Service firewalld.service has been disabled, and is dead
     Started: 02:54:13.654208
    Duration: 850.803 ms
     Changes:   
              ----------
              firewalld.service:
                  True

Summary for local
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time: 850.803 ms

2. salt-master高可用

2.1 salt-master高可用配置

我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。salt的高可用配置非常简单，只需要改一下minion配置文件，将master用列表的形式列出即可

[root@node1 ~]# vim /etc/salt/minion
master:
  - 192.168.235.160
  - 192.168.235.135
  - 
 46 # beacons) without a master connection
 47  master_type: failover

本例列出的master上必须都安装了salt-master且保证服务都是正常状态。

2.2 salt-master高可用之数据同步

涉及到高可用时，数据的同步是个永恒的话题，我们必须保证高可用的2个master间使用的数据是一致的，包括：

/etc/salt/master配置文件
/etc/salt/pki目录下的所有key
/srv/下的salt和pillar目录下的所有文件
保障这些数据同步的方案有：

nfs挂载
rsync同步
使用gitlab进行版本控制
安全相关：
为保证数据的同步与防止丢失，可将状态文件通过gitlab进行版本控制管理。

3. salt-syndic分布式架构

3.1 salt-syndic架构图

在这里插入图片描述

3.2 salt-syndic的优劣势

优势：

可以通过syndic实现更复杂的salt架构
减轻master的负担

劣势：

syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致，所以要进行数据同步，同步方案同salt-master高可用
最顶层的master不知道自己有几个syndic，它只知道自己有多少个minion，并不知道这些minion是由哪些syndic来管理的

3.3 salt-syndic部署

3.3.1 环境说明

IP	角色	应用
192.168.235.160	master	salt-master
192.168.235.175	syndic	salt-master salt-syndic
192.168.235.172	node1	salt-minion

[root@syndic ~]# yum -y install salt-master salt-syndic

将master上面的/etc/salt/master配置文件复制到syndic上保证一致


[root@syndic ~]# scp 192.168.235.160:/etc/salt/master 192.168.235.175:/etc/salt/master
The authenticity of host '192.168.235.160 (192.168.235.160)' can't be established.
ECDSA key fingerprint is SHA256:ghl+21XZYuW114MkJUxv0903+4ODkTu9/LSiIwwkBm8.
ECDSA key fingerprint is MD5:7d:4b:d0:3f:39:d6:61:5f:20:7a:07:8e:9e:00:65:0b.
Are you sure you want to continue connecting (yes/no)? yes 
Warning: Permanently added '192.168.235.160' (ECDSA) to the list of known hosts.
root@192.168.235.160's password: 
The authenticity of host '192.168.235.175 (192.168.235.175)' can't be established.
ECDSA key fingerprint is SHA256:xyMS7T/DEq7c5Ky1v5/FOxC/KSnhxA34RF4BCIp+gcc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.235.175' (ECDSA) to the list of known hosts.
root@192.168.235.175's password: 
master                                                        100%   52KB   4.8MB/s   00:00    
Connection to 192.168.235.160 closed.

将master上面的/etc/salt/pki目录下的所有key复制到syndic上保证一致

[root@syndic ~]# cd /etc/salt/pki/
[root@syndic pki]# scp -r  192.168.235.160:/etc/salt/pki/master 192.168.235.175:/etc/salt/pki/
root@192.168.235.160's password: 
root@192.168.235.175's password: 
node1                                                         100%  451   114.2KB/s   00:00    
master                                                        100%  451    51.8KB/s   00:00    
node2                                                         100%  451    86.8KB/s   00:00    
master.pem                                                    100% 1675    61.1KB/s   00:00    
master.pub                                                    100%  451    60.0KB/s   00:00    
Connection to 192.168.235.160 closed.
[root@syndic pki]# tree
.
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── minions
│   │   ├── master
│   │   └── node1
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   │   └── node2
│   └── minions_rejected
└── minion
    ├── minion_master.pub
    ├── minion.pem
    └── minion.pub

将master上面的/srv/下的salt和pillar目录下的所有文件复制到syndic上保证一致

[root@syndic pki]# scp -r  192.168.235.160:/srv/* 192.168.235.175:/srv/
root@192.168.235.160's password: 
root@192.168.235.175's password: 
·
·
·Connection to 192.168.235.160 closed.

启动服务

[root@syndic ~]# systemctl start salt-master

配置node1连接syndic

[root@node1 pki]# vim /etc/salt/minion
 16 #master: salt
 17  master:
 18    - 192.168.235.160
 19    - 192.168.235.175

49 # beacons) without a master connection
50  master_type: failover     # 取消注释，将str改为failover(故障转移)\

55 # of TCP connections, such as load balancers.)
56  master_alive_interval: 10  # 默认是30s,故障转移切换时间(以秒为单位)，用于检查主服务器是否仍然存在。如果master_type上面是“failover”，那么就会被启用。

74  retry_dns: 0  # 设置在尝试解析之前等待的秒数,默认为30秒

[root@syndic ~]# systemctl restart salt-minion

master ping (此时是syndicping不通node1的，只有当master挂了才能ping通)
[root@master ~]# salt node1 test.ping
node1:
    True

[root@master ~]# systemctl stop salt-master

//使用syndic 来ping并查看node1的salt-minion服务状态(ping不通记得多试几次，还需要注意防火墙和selinux)
[root@syndic ~]# salt node1 test.ping
node1:
    True


[root@node1 ~]# systemctl status salt-minion
● salt-minion.service - The Salt Minion
   Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; disabled; vendor preset: disabled)
   Active: active (running) since Mon 2021-11-29 10:40:17 EST; 1min 25s ago
     Docs: man:salt-minion(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html
 Main PID: 239372 (salt-minion)
    Tasks: 6 (limit: 11201)
   Memory: 83.9M
   CGroup: /system.slice/salt-minion.service
           ├─239372 /usr/bin/python3.6 /usr/bin/salt-minion
           ├─239399 /usr/bin/python3.6 /usr/bin/salt-minion
           └─239401 /usr/bin/python3.6 /usr/bin/salt-minion

Nov 29 10:40:16 node2 systemd[1]: Starting The Salt Minion...
Nov 29 10:40:17 node2 systemd[1]: Started The Salt Minion.
Nov 29 10:40:38 node2 salt-minion[239372]: [WARNING ] Master ip address changed from 192.168.235.160 to 192.168.235.175

当然也可以把备停掉，启动主测试ping
# 停掉备
[root@syndic pki]# systemctl stop salt-master

# 启动主并测试ping
[root@master pki]# salt node2 test.ping
node1:
    True

[root@node1额 ~]# systemctl status salt-minion
● salt-minion.service - The Salt Minion
   Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; disabled; vendor preset: disabled)
   Active: active (running) since Mon 2021-11-29 06:11:46 EST; 1min 34s ago
     Docs: man:salt-minion(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html
 Main PID: 298440 (salt-minion)
    Tasks: 17 (limit: 11201)
   Memory: 89.0M
   CGroup: /system.slice/salt-minion.service
           ├─298440 /usr/bin/python3.6 /usr/bin/salt-minion
           ├─298466 /usr/bin/python3.6 /usr/bin/salt-minion
           └─298468 /usr/bin/python3.6 /usr/bin/salt-minion

Nov 29 06:11:46 node2 systemd[1]: Starting The Salt Minion...
Nov 29 06:11:46 node2 systemd[1]: Started The Salt Minion.
Nov 29 06:12:07 node2 salt-minion[298440]: [WARNING ] Master ip address changed from 192.168.235.160 to 192.168.235.175
Nov 29 06:13:09 node2 salt-minion[298440]: [WARNING ] Master ip address changed from 192.168.235.160 to 192.168.235.175
Nov 29 06:13:09 node2 salt-minion[298440]: [WARNING ] Master ip address changed from 192.168.235.160 to 192.168.235.175

喂小鸭

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
SaltStack进阶

这里写目录标题1. masterless1.1 应用场景1.2 masterless配置1.2.1 修改配置文件minion1.2.2 关闭salt-minion服务1.2.3 salt-call2. salt-master高可用2.1 salt-master高可用配置2.2 salt-master高可用之数据同步3. salt-syndic分布式架构3.1 salt-syndic架构图3.2 salt-syndic的优劣势3.3 salt-syndic部署3.3.1 环境说明1. masterless
复制链接

扫一扫