模块:https://docs.saltstack.com/en/2016.11/ref/states/all/index.html
实战架构图:
实验环境设置:
主机名 | IP地址 | 角色 |
---|---|---|
linux-node1.example.com | 192.168.56.11 | Master、Minion、Haproxy+Keepalived、Nginx+PHP |
linux-node2.example.com | 192.168.56.12 | Minion、Memcached、Haproxy+Keepalived、Nginx+PHP |
SaltStack环境设置:
base环境用于存放初始化的功能,prod环境用于放置生产的配置管理功能
[root@linux-node1 ~]# vim /etc/salt/master
file_roots:
base:
- /srv/salt/base
dev:
- /srv/salt/dev
test:
- /srv/salt/test
prod:
- /srv/salt/prod
pillar_roots:
base:
- /srv/pillar/base
prod:
- /srv/pillar/prod
1、系统初始化
当我们的服务器上架并安装好操作系统后,都会有一些基础的操作,所以生产环境中使用SaltStack,建议将所有服务器都会涉及的基础配置或者软件部署归类放在base环境下。此处,在base环境下创建一个init目录,将系统初始化配置的sls均放置到init目录下,称为“初始化模块”。
(1)需求分析和模块识别
初始化内容 | 模块使用 | 文件 |
---|---|---|
关闭SElinux | file.managed | /etc/selinux/config |
关闭默认firewalld | service.disabled | |
时间同步 | pkg.installed | |
文件描述符 | file.managed | /etc/security/limits.conf |
内核优化 | sysctl.present | |
SSH服务优化 | file.managed、service.running | |
精简开机系统服务 | service.dead | |
DNS解析 | file.managed | /etc/resolv.conf |
历史记录优化history | file.append | /etc/profile |
设置终端超时时间 | file.append | /etc/profile |
配置yum源 | file.managed | /etc/yum.repo.d/epel.repo |
安装各种agent | pkg.installed 、file.managed、service.running | |
基础用户 | user.present、group.present | |
常用基础命令 | pkg.installed、pkgs | |
用户登录提示、PS1的修改 | file.append | /etc/profile |
(2)需求实现
[root@linux-node1 base]# pwd
/srv/salt/base
[root@linux-node1 base]# mkdir init/files -p
1、关闭selinux
#使用了file模块的managed方法
[root@linux-node1 init]# vim selinux.sls
selinux-config:
file.managed:
- name: /etc/selinux/config
- source: salt://salt/init/files/selinux-config
- user: root
- group: root
- mode: 0644
[root@linux-node1 init]# cp /etc/selinux/config files/selinux-config
2、关闭firewalld
#使用service模块的dead方法,直接关闭firewalld,并禁止开机启动
[root@linux-node1 init]# vim firewalld.sls
firewall-stop:
service.dead:
- name: firewalld.service
- enable: False
3、时间同步
#先使用pkg模块安装ntp服务,再使用cron模块加入计划任务
[root@linux-node1 init]# vim ntp.sls
ntp-install:
pkg.installed:
- name: ntpdate
cron-ntpdate:
cron.present:
- name: ntpdate time1.aliyun.com
- user: root
- minute: 5
4、修改文件描述符
#使用file模块的managed方法
[root@linux-node1 init]# vim limit.sls
limit-config:
file.managed:
- name: /etc/security/limits.conf
- source: salt://init/files/limits.conf
- user: root
- group: root
- mode: 0644
[root@linux-node1 init]# cp /etc/security/limits.conf files/
[root@linux-node1 init]# echo "* - nofile 65535
" >> files/limits.conf
5、内核优化
#使用sysctl模块的present方法,此处演示一部分,这里没有使用name参数,所以id就相当于是name
[root@linux-node1 init]# vim sysctl.sls
net.ipv4.tcp_fin_timeout:
sysctl.present:
- value: 2
net.ipv4.tcp_tw_reuse:
sysctl.present:
- value: 1
net.ipv4.tcp_tw_recycle:
sysctl.present:
- value: 1
net.ipv4.tcp_syncookies:
sysctl.present:
- value: 1
net.ipv4.tcp_keepalive_time:
sysctl.present:
- value: 600
6、SSH服务优化
#使用file.managed和service.running以及watch,对ssh服务进行优化配置
[root@linux-node1 init]# vim sshd.sls
sshd-config:
file.managed:
- name: /etc/ssh/sshd_config
- source: salt://init/files/sshd_config
- user: root
- gourp: root
- mode: 0600
service.running:
- name: sshd
- enable: True
- reload: True
- watch:
- file: sshd-config
[root@linux-node1 init]# cp /etc/ssh/sshd_config files/
[root@linux-node1 init]# vim files/sshd_config
Port 8022
UseDNS no
PermitRootLogin no
PermitEmptyPasswords no
GSSAPIAuthentication no
7、精简开机启动的系统服务
#举例关闭postfix开机自启动
[root@linux-node1 init]# vim thin.sls
postfix:
service.dead:
- enable: False
8、DNS解析
[root@linux-node1 init]# vim dns.sls
dns-config:
file.managed:
- name: /etc/resolv.conf
- source: salt://init/files/resolv.conf
- user: root
- group: root
- mode: 644
[root@linux-node1 init]# cp /etc/resolv.conf files/
9、历史记录优化history
#使用file.append扩展修改HISTTIMEFORMAT的值
[root@linux-node1 init]# vim history.sls
history-config:
file.append:
- name: /etc/profile
- text:
- export HISTTIMEFORMAT="%F %T `whoami` "
- export HISTSIZE=5
- export HISTFILESIZE=5
10、设置终端超时时间
#使用file.append扩展修改TMOUT环境变量的值
[root@linux-node1 init]# vim tty-timeout.sls
ty-timeout:
file.append:
- name: /etc/profile
- text:
- export TMOUT=300
11、配置yum源
#拷贝yum源
[root@linux-node1 init]# vim yum-repo.sls
/etc/yum.repos.d/epel.repo:
file.managed:
- source: salt://init/files/epel.repo
- user: root
- group: root
- mode: 0644
12、安装各种agent(如安装zabbix-agent)
#相当于一个软件的安装、配置、启动,此处也使用了jinja模板和pillar
[root@linux-node1 base]# mkdir zabbix
[root@linux-node1 base]# vim zabbix/zabbix-agent.sls
zabbix-agent:
pkg.installed:
- name: zabbix22-agent
file.managed:
- name: /etc/zabbix_agentd.conf
- source: salt://zabbix/files/zabbix_agentd.conf
- template: jinja
- defaults:
ZABBIX-SERVER: {{ pillar['zabbix-agent']['Zabbix_Server'] }}
- require:
- pkg: zabbix-agent
service.running:
- enable: True
- watch:
- pkg: zabbix-agent
- file: zabbix-agent
zabbix_agent.conf.d:
file.directory:
- name: /etc/zabbix_agentd.conf.d
- watch_in:
- service: zabbix-agent
- require:
- pkg: zabbix-agent
- file: zabbix-agent
[root@linux-node1 srv]# vim pillar/base/zabbix.sls
zabbix-agent:
Zabbix_Server: 192.168.56.11
13、基础用户
#增加基础管理用户www,使用user.present和group.present
[root@linux-node1 init]# vim user-www.sls
www-user-group:
group.present:
- name: www
- gid: 1000
user.present:
- name: www
- fullname: www
- shell: /sbin/bash
- uid: 1000
- gid: 1000
14、常用基础命令
#这里因为各软件包会依赖源,所以使用include讲yum源包含进来,并在pkg.installed最后增加require依赖
[root@linux-node1 init]# vim pkg-base.sls
include:
- init.yum-repo
base-install:
pkg.installed:
- pkgs:
- screen
- lrzsz
- tree
- openssl
- telnet
- iftop
- iotop
- sysstat
- wget
- dos2unix
- lsof
- net-tools
- mtr
- unzip
- zip
- vim
- bind-utils
- require:
- file: /etc/yum.repos.d/epel.repo
15、用户登录提示、PS1的修改
[root@linux-node1 init]# vim tty-ps1.sls
/etc/bashrc:
file.append:
- text:
- export PS1=' [\u@\h \w]\$ '
16、编写一个总的状态,并写入top file中
#将所有初始化所需要的功能编写完成,每个小功能都是一个sls文件,统一放在init目录下。此时再使用include把这些初始化的功能都包含进来。
[root@linux-node1 init]# vim init-all.sls
include:
- init.dns
- init.yum-repo
- init.firewalld
- init.history
- init.limit
- init.ntp
- init.pkg-base
- init.selinux
- init.sshd
- init.sysctl
- init.thin
- init.tty-timeout
- init.tty-ps1
- init.user-www
#在top.sls里面给Minion指定状态并执行,强烈建议先测试,确定SaltStack会执行哪些操作然后再应用状态到服务器上
[root@linux-node1 base]# vim top.sls
base:
'*':
- init.init-all
[root@linux-node1 base]# salt '*' state.highstate test=True
[root@linux-node1 base]# salt '*' state.highstate
2、MySQL主从
1.需求分析:
配置MySQL主从的有以下步骤:
(1)MySQL安装初始化---->mysql-install.sls
(2)MySQL的主配置文件my.cnf配置不同的server_id-->mariadb-server-master.cnf、mariadb-server-slave.cnf
(3)创建主从同步用户-->master.sls
(4)master获取bin-log和post值-->通过脚本实现
(5)slave上,change master && start slave-->slave.sls2.需求实现:
(1)在prod环境下载创建modules和mysql目录
[root@linux-node1 prod]# pwd
/srv/salt/prod
[root@linux-node1 prod]# mkdir modules/mysql
(2)配置安装和配置状态文件install.sls
[root@linux-node1 mysql]# cat install.sls
mysql-install:
pkg.installed:
- pkgs:
- mariadb
- mariadb-server
mysql-config:
file.managed:
- name: /etc/my.cnf
- source: salt://modules/mysql/files/my.cnf
- user: root
- gourp: root
- mode: 644
[root@linux-node1 mysql]# cp /etc/my.cnf files/
(3)在主上配置mariadb-server.cnf,并更改server_id,以及创建主从用户
[root@linux-node1 mysql]# cat master.sls
include:
- modules.mysql.install
master-config:
file.managed:
- name: /etc/my.cnf.d/mariadb-server.cnf
- source: salt://modules/mysql/files/mariadb-server-master.cnf
- user: root
- group: root
- mode: 0644
master-grant:
cmd.run:
- name: mysql -e "grant replication slave on *.* to repl@'192.168.56.0/255.255.255.0' identified by '123456';flush privileges;"
[root@linux-node1 mysql]# cp /etc/my.cnf.d/mariadb-server.cnf files/mariadb-server-master.cnf
[root@linux-node1 mysql]# cp /etc/my.cnf.d/mariadb-server.cnf files/mariadb-server-slave.cnf
#修改主从的配置文件的server_id和开启主上的log-bin功能
[root@linux-node1 mysql]# vim files/mariadb-server-master.cnf
[mysqld]
server_id=1111
log-bin=mysql-bin
[root@linux-node1 mysql]# vim files/mariadb-server-slave.cnf
[mysqld]
server_id=2222
(4)编写shell脚本获取bin-log值和pos值
[root@linux-node1 mysql]# cat files/start-slave.sh
#!/bin/bash
for i in `seq 1 10`
do
mysql -h 192.168.56.11 -urepl -p123456 -e "exit"
if [ $? -eq 0 ];then
Bin_log=`mysql -h 192.168.56.11 -urepl -p123456 -e "show master status;"|awk 'NR==2{print $1}'`
POS=`mysql -h 192.168.56.11 -urepl -p123456 -e "show master status;"|awk 'NR==2{print $2}'`
mysql -e "change master to master_host='192.168.56.11', master_user='repl', master_password='123456', master_log_file='$Bin_log', master_log_pos=$POS;start slave;"
exit;
else
sleep 60;
fi
done
(5)从库上配置slave,并启动
[root@linux-node1 mysql]# cat slave.sls
include:
- modules.mysql.install
slave-config:
file.managed:
- name: /etc/my.cnf.d/mariadb-server.cnf
- source: salt://modules/mysql/files/mariadb-server-slave.cnf
- user: root
- group: root
- mode: 0644
start-slave:
file.managed:
- name: /tmp/start-slave.sh
- source: salt://modules/mysql/files/start-slave.sh
- user: root
- group: root
- mode: 755
cmd.run:
- name: /bin/bash /tmp/start-slave.sh
3、HAproxy+Keepalived
(1)pkg配置管理
[root@linux-node1 modules]# mkdir pkg
[root@linux-node1 pkg]# vim pkg-init.sls
pkg-init:
pkg.installed:
- names:
- gcc
- gcc-c++
- glibc
- make
- autoconf
- openssl
- openssl-devel
[root@linux-node1 pkg]# salt 'linux-node1*' state.sls modules.pkg.pkg-init saltenv=prod test=True
(2)haproxy配置管理
[root@linux-node1 modules]# mkdir haproxy/files -p
[root@linux-node1 haproxy]# cat haproxy.sls
include:
- pkg.pkg-init
haproxy-install:
file.managed:
- name: /usr/local/src/haproxy-1.5.3.tar.gz
- source: salt://modules/haproxy/files/haproxy-1.5.3.tar.gz
- user: root
- group: root
- mode: 755
cmd.run:
- name: cd /usr/local/src && tar -zxvf haproxy-1.5.3.tar.gz && cd haproxy-1.5.3 && make TARGET=linux26 PREFIX=/usr/local/haproxy && make install PREFIX=/usr/local/haproxy
- unless: test -d /usr/local/haproxy
- require:
- pkg: pkg-init
- file: haproxy-install
/etc/init.d/haproxy:
file.managed:
- source: salt://modules/haproxy/files/haproxy.init
- user: root
- group: root
- mode: 755
- require:
- cmd: haproxy-install
net.ipv4.ip_nonlocal_bind:
sysctl.present:
- value: 1
haproxy-config-dir:
file.directory:
- name: /etc/haproxy
- mode: 755
- user: root
- group: root
haproxy-init:
cmd.run:
- name: chkconfig --add haproxy
- unless: chkconfig --list | grep haproxy
- require:
- file: /etc/init.d/haproxy
[root@linux-node1 haproxy]# cp /usr/local/src/haproxy-1.5.3.tar.gz files/
[root@linux-node1 haproxy]# cp /usr/local/src/haproxy-1.5.3/examples/haproxy.init files/
[root@linux-node1 haproxy]# tree
.
├── files
│ ├── haproxy-1.5.3.tar.gz
│ └── haproxy.init
└── install.sls
(3)Keepalived配置管理
[root@linux-node1 keepalived]# vim install.sls
include:
- pkg.pkg-init
keepalived-install:
file.managed:
- name: /usr/local/src/keepalived-1.2.17.tar.gz
- source: salt://modules/keepalived/files/keepalived-1.2.17.tar.gz
- user: root
- gourp: root
- mode: 755
cmd.run:
- name: cd /usr/locall/src && tar -zxf keepalived-1.2.17.tar.gz && cd keepalived-1.2.17 && ./configure --prefix=/usr/local/keepalived --disable-fwmark && make && make install
- unless: test -d /usr/local/keepalived
- require:
- pkg: pkg-init
- file: keepalived-install
/etc/sysconfig/keeplived:
file.managed:
- source: salt://modules/keepalived/files/keepalived-sysconfig
- user: root
- gourp: root
- mode: 644
/etc/init.d/keepalived:
file.managed:
- sourcd: salt://modules/keepalived/files/keepalived.init
- user: root
- group: root
- mode: 755
keepalive-init:
cmd.run:
- name: chkconfig --add keepalived
- unless: chkconfig --list | grep keepalived
- require:
- file: /etc/init.d/keepalived
/etc/keepalived:
file.directory:
- user: root
- group: root
[root@linux-node1 keepalived]# cp /usr/local/src/keepalived-1.2.17.tar.gz files/
[root@linux-node1 init.d]# pwd
/usr/local/src/keepalived-1.2.17/keepalived/etc/init.d
[root@linux-node1 init.d]# cp keepalived.init /srv/salt/prod/modules/keepalived/files/
[root@linux-node1 init.d]# cp keepalived.sysconfig /srv/salt/prod/modules/keepalived/files/
[root@linux-node1 keepalived]# tree
.
├── files
│ ├── keepalived-1.2.17.tar.gz
│ ├── keepalived.init
│ └── keepalived.sysconfig
└── install.sls
4、Nginx+PHP
(1)Nginx配置管理
[root@linux-node1 modules]# mkdir pcre
[root@linux-node1 pcre]# cat init.sls
pcre-install:
pkg.installed:
- names:
- pcre
- pcre-devel
[root@linux-node1 modules]# mkdir user
[root@linux-node1 user]# cat www.sls
www-user-group:
group.present:
- name: www
- gid: 1000
user.present:
- name: www
- fullname: www
- shell: /sbin/nologin
- uid: 1000
- gid: 1000
[root@linux-node1 modules]# mkdir nginx/files -p
[root@linux-node1 nginx]# cp /usr/local/src/nginx-1.12.2.tar.gz files/
[root@linux-node1 nginx]# tree
.
├── files
│ └── nginx-1.12.2.tar.gz
└── install.sls
[root@linux-node1 nginx]# cat install.sls
include:
- modules.pcre.init
- modules.user.www
- modules.pkg.pkg-init
nginx-source-install:
file.managed:
- name: /usr/local/src/nginx-1.12.2.tar.gz
- source: salt://modules/nginx/files/nginx-1.12.2.tar.gz
- user: root
- group: root
- mode: 755
cmd.run:
- name : cd /usr/local/src && tar -zxf nginx-1.12.2.tar.gz && cd nginx-1.12.2 && ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_ssl_module --with-http_stub_status_module --with-file-aio --with-http_dav_module && make && make install && chown -R www.www /usrl/local/nginx
- unless: test -d /usr/local/nginx
- require:
- user: www-user-group
- file: nginx-source-install
- pkg: pcre-install
- pkg: pkg-init
[root@linux-node1 nginx]# salt 'linux-node1*' state.sls modules.nginx.install saltenv=prod test=True
(2)PHP配置管理
[root@linux-node1 modules]# mkdir php/files -p
[root@linux-node1 php]# cp /usr/local/src/php-5.6.9/sapi/fpm/init.d.php-fpm files/
[root@linux-node1 php]# cp /usr/local/php/etc/php-fpm.conf.default files/
[root@linux-node1 php]# cp /usr/local/src/php-5.6.9/php.ini-production files/
[root@linux-node1 php]# cp /usr/local/src/php-5.6.9.tar.gz files/
[root@linux-node1 php]# tree
.
├── files
│ ├── init.d.php-fpm
│ ├── php-5.6.9.tar.gz
│ ├── php-fpm.conf.default
│ └── php.ini-production
└── install.sls
[root@linux-node1 php]# cat install.sls
include:
- modules.user.www
pkg-php:
pkg.installed:
- names:
- mysql-devel
- openssl-devel
- swig
- libjpeg-turbo
- libjpeg-turbo-devel
- libpng
- libpng-devel
- freetype
- freetype-devel
- libxml2
- libxml2-devel
- zlib
- zlib-devel
- libcurl
- libcurl-devel
php-source-install:
file.managed:
- name: /usr/local/src/php-5.6.9.tar.gz
- source: salt://modules/php/files/php-5.6.9.tar.gz
- user: root
- gourp: root
- mode: 755
cmd.run:
- name: cd /usr/local/src && tar -zxf php-5.6.9.tar.gz && cd php-5.6.9 && ./configure --prefix=/usr/local/php -with-pdo-mysql=mysqlnd --with-mysqli=mysqlnd --with-mysql=mysqlnd --with-jpeg-dir --with-png-dir --with-zlib --enable-xml --with-libxml-dir --with-curl --enable-bcmath --enable-shmop --enable-sysvsem --enable-inline-optimization --enable-mbregex --with-openssl --enable-mbstring --with-gd --enable-gd-native-ttf --with-freetype-dir=/usr/lib64 --with-gettext=/usr/lib64 --enable-sockets --with-xmlrpc --enable-zip --enable-soap --disable-debug --enable-opcache --enable-zip --with-config-file-path=/usr/local/php-fastcgi/etc --enable-fpm --with-fpm-user=www --with-fpm-group=www && make && make install
- require:
- file: php-source-install
- user: www-user-group
- unless: test -d /user/local/php
php-ini:
file.managed:
- name: /usr/local/php/etc/php.ini
- source: salt://modules/php/files/php.ini-production
- user: root
- group: root
- mode: 644
php-fpm:
file.managed:
- name: /usr/local/php/etc/php-fpm.conf
- source: salt://modules/php/files/php-fpm.conf.default
- user: root
- group: root
- mode: 644
php-service:
file.managed:
- name: /etc/init.d/php-fpm
- source: salt://modules/php/files/init.d.php-fpm
- user: root
- group: root
- mode: 755
cmd.run:
- name: chkconfig --add php-fpm
- unless: chkconfig --list | grep php-fpm
- require:
- file: php-service
service.running:
- name: php-fpm
- enable: True
- reload: True
- require:
- file: php-ini
- file: php-fpm
- file: php-service
- cmd: php-service
统一使用的功能都抽象成一个模块,如安装以及基本配置(nginx中包含include,php中包含的include,那么就可以将nginx.conf放在功能模块,而虚拟主机配置文件,可以放在业务模块)。
其它配置和服务启动可以抽象在一个业务模块,每一个业务都是使用不同的配置文件。
服务全部使用www用户,统一id,只开放8080端口,对于web服务只开放ssh的8022端口以及web的8080端口。其余不用的端口一律不开启
这里将nginx,php都抽象成一个模块,把安装和基础配置都放在了modules中,在nginx衍生的业务模块web目录下,做一个bbs的虚拟主机。
[root@linux-node1 base]# vim top.sls
prod:
'*':
- web.bbs
[root@linux-node1 base]# salt '*' state.highstate
转载于:https://blog.51cto.com/jinlong/2066276