SaltStack进阶

SaltStack进阶

1.1 应用场景

• master 与 minion 网络不通或通信有延迟，即网络不稳定
• 想在 minion 端直接执行状态

传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到 masterless 了。

有了masterless，即使你只有一台主机，也能玩saltstack，而不需要你有N台主机架构。

1.2 masterless配置

1.2.1 修改配置文件minion

• 注释master行
• 取消注释file_client并设其值为local
• 设置file_roots
• 设置pillar_roots

# resolved, then the minion will fail to start.
#master: salt
......
# minion in masterless mode.
file_client: local
......
file_roots:
  base:
    - /srv/salt/base
  test:
    - /srv/salt/test
  prod:
    - /srv/salt/prod
  dev:
    - /srv/salt/dev
.......    
# also be configured on the minion:
pillar_roots:
  base:
    - /srv/pillar/base
  prod:
    - /srv/pillar/prod

1.2.2 关闭salt-minion服务

使用 masterless 模式时是不需要启动任何服务的，包括salt-master和salt-minion。

[root@node3 salt]# systemctl stop salt-minion
[root@node3 salt]# systemctl status salt-minion
● salt-minion.service - The Salt Minion
   Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; e>
   Active: inactive (dead) since Mon 2021-11-29 19:39:28 CST; 17s>
     Docs: man:salt-minion(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html
  Process: 23517 ExecStart=/usr/bin/salt-minion (code=exited, sta>
 Main PID: 23517 (code=exited, status=0/SUCCESS)

1.2.3 salt-call

masterless模式执行模块或状态时需要使用salt-call命令，而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。

[root@node3 salt]# salt-call --local cmd.run 'date'
local:
    Mon Nov 29 19:42:02 CST 2021
[root@node3 salt]# mkdir -p /srv/{salt,pillar}/{base,prod}
[root@node3 prod]# scp -r 192.168.200.142:/srv/salt/base/srv/salt/
[root@node3 base]# tree
.
└── init
    ├── chrony
    │   ├── file
    │   │   └── chrony.conf
    │   └── main.sls
    ├── firewall
    │   └── main.sls
    ├── history
    │   └── main.sls
    ├── kernel
    │   ├── file
    │   │   ├── limits.conf
    │   │   └── sysctl.conf
    │   └── main.sls
    ├── main.sls
    ├── packages
    │   └── main.sls
    ├── salt-minion
    │   ├── file
    │   │   └── minion.j2
    │   └── main.sls
    ├── selinux
    │   ├── file
    │   │   └── config
    │   └── main.sls
    ├── ssh
    │   ├── file
    │   │   └── sshd_config
    │   └── main.sls
    ├── timeout
    │   └── main.sls
    ├── yum
    │   ├── file
    │   │   ├── centos7.repo
    │   │   ├── centos8.repo
    │   │   ├── epel.repo
    │   │   ├── salt-7.repo
    │   │   └── salt-8.repo
    │   └── main.sls
[root@node3 base]# salt-call --local state.sls init.history.main
local:
----------
          ID: history
    Function: file.line
        Name: /etc/profile
      Result: True
     Comment: Changes were made
     Started: 19:48:40.181750
    Duration: 9.716 ms
     Changes:   
              ----------
              diff:
                  --- 
                  +++ 
                  @@ -1,5 +1,6 @@
                   # /etc/profile
                   
                  +export HISTTIMEFORMAT="%F %T `whoami` "
                   # System wide environment and startup programs, for login setup
                   # Functions and aliases go in /etc/bashrc
                   

Summary for local
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time:   9.716 ms

2. salt-master高可用

2.1 salt-master高可用配置

我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。salt的高可用配置非常简单，只需要改一下minion配置文件，将master用列表的形式列出即可

master1	192.168.200.142
master2	192.168.200.146
node1	192.168.200.147

[root@master2 ~]# yum -y install salt-master
[root@master1 ~]# yum -y install salt-master
[root@node1 ~]# yum -y install salt-minion

//查看两台master状态
[root@master salt]# systemctl status salt-master
● salt-master.service - The Salt Master Server
   Loaded: loaded (/usr/lib/systemd/system/salt-master.service; e>
   Active: active (running) since Mon 2021-11-29 06:18:03 EST; 55>
     Docs: man:salt-master(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html

[root@master2 salt]# systemctl status salt-master
● salt-master.service - The Salt Master Server
   Loaded: loaded (/usr/lib/systemd/system/salt-master.service; d>
   Active: active (running) since Mon 2021-11-29 19:59:10 CST; 15>
     Docs: man:salt-master(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html

//先配置一台
[root@minion salt]# vim minion
......
#master: salt
master: 192.168.200.142
......

[root@master salt-minion]# salt '192.168.200.147' test.ping
192.168.200.147:
    True

//传递密钥
[root@master salt]# scp /etc/salt/pki/master/master.p* 192.168.200.146:/etc/salt/pki/master
root@192.168.200.146's password: 
master.pem                      100% 1675     1.8MB/s   00:00    
master.pub                      100%  451   568.9KB/s   00:00

//修改minion
[root@minion ~]# vim /etc/salt/minion
#master: salt
master: 192.168.200.146

//接受密钥
[root@master2 salt]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
192.168.200.147
Rejected Keys:

[root@master2 salt]# salt-key -ya 192.168.200.147
The following keys are going to be accepted:
Unaccepted Keys:
192.168.200.147
Key for minion 192.168.200.147 accepted.

[root@master2 salt]# salt-key -L
Accepted Keys:
192.168.200.147
Denied Keys:
Unaccepted Keys:
Rejected Keys:

[root@master2 ~]# salt '192.168.200.147' test.ping
192.168.200.147:
    True

//配置高可用
[root@minion ~]# vim /etc/salt/minion
.....
#master: salt
master:
  - 192.168.200.142
  - 192.168.200.146
.....
# beacons) without a master connection
 master_type: failover

# Poll interval in seconds for checking if the master is still there.  Only
# respected if master_type above is "failover". To disable the interval entirely,
# set the value to -1. (This may be necessary on machines which have high numbers
# of TCP connections, such as load balancers.)
 master_alive_interval: 3

//重启服务
[root@minion ~]# vim /etc/salt/minion

//在主上ping
[root@master salt]# salt '192.168.200.147' test.ping
192.168.200.147:
    True
//备上ping不通
[root@master2 ~]# salt '192.168.200.147' test.ping
192.168.200.147:
    Minion did not return. [No response]
    The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:
    
    salt-run jobs.lookup_jid 20211129135339995690

//模拟主上故障
[root@master salt]# systemctl stop salt-master.service

//在备上ping
[root@master2 ~]# salt '192.168.200.147' test.ping
192.168.200.147:
    True

//查看minion状态
● salt-minion.service - The Salt Minion
   Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2021-11-29 09:14:02 EST; 2min 10s ago
     Docs: man:salt-minion(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html
 Main PID: 4987 (salt-minion)
    Tasks: 6 (limit: 23789)
   Memory: 81.4M
   CGroup: /system.slice/salt-minion.service
           ├─4987 /usr/bin/python3.6 /usr/bin/salt-minion
           ├─4995 /usr/bin/python3.6 /usr/bin/salt-minion
           └─4997 /usr/bin/python3.6 /usr/bin/salt-minion

11月 29 09:14:02 minion systemd[1]: salt-minion.service: Succeeded.
11月 29 09:14:02 minion systemd[1]: Stopped The Salt Minion.
11月 29 09:14:02 minion systemd[1]: Starting The Salt Minion...
11月 29 09:14:02 minion systemd[1]: Started The Salt Minion.
11月 29 09:15:09 minion salt-minion[4987]: [CRITICAL] 'master_type' set to 'failover' but 'retry_dns' is not 0. Setting 'retry_dns' t>
11月 29 09:15:14 minion salt-minion[4987]: [WARNING ] Master ip address changed from 192.168.200.142 to 192.168.200.146

//同步/srv
[root@master salt]# scp /srv/ 192.168.200.146:/srv

3. salt-syndic分布式架构

3.1 salt-syndic架构图

3.2 salt-syndic的优劣势

优势：

• 可以通过syndic实现更复杂的salt架构
• 减轻master的负担

劣势：

• syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致，所以要进行数据同步，同步方案同salt-master高可用
• 最顶层的master不知道自己有几个syndic，它只知道自己有多少个minion，并不知道这些minion是由哪些syndic来管理的

3.3 salt-syndic部署

3.3.1 环境说明

主机IP	角色	安装的应用
192.168.200.142	Master	salt-master
192.168.200.146	Syndic	salt-master salt-syndic
192.168.200.147	Minion	salt-minion
192.168.200.145	Minion	salt-minion

3.3.2 安装salt-master与salt-syndic

在192.168.200.146上安装salt-master与salt-syndic，安装前请自行配置yum源

[root@syndic ~]# yum -y install salt-master salt-syndic

3.3.3 配置master

修改master的master配置文件

• 取消注释order_master
• 将order_master的值设为True

[root@master salt]# vim /etc/salt/master
.....
#masters' syndic interfaces.
order_masters: True
.....
[root@master salt]# systemctl restart salt-master.service

3.3.4 配置syndic

修改syndic所在主机的master配置文件

• 取消注释syndic_master
• 将syndic_master的值设为master的IP

[root@syndic ~]# vim /etc/salt/master             +++
# this master where to receive commands from.
syndic_master: 192.168.200.142
[root@syndic ~]# systemctl restart salt-master 
[root@syndic ~]# systemctl enable --now salt-syndic
Created symlink /etc/systemd/system/multi-user.target.wants/salt-syndic.service → /usr/lib/systemd/system/salt-syndic.service.

3.3.5 配置minion

配置minion，将master指向syndic所在主机

[root@node2 ~]# vim /etc/salt/minion
......
#master: salt
master: 192.168.200.146
[root@node2 ~]# systemctl restart salt-minion

[root@node1 ~]# vim /etc/salt/minion
#master: salt
 master: 192.168.200.146
[root@node1 ~]# systemctl restart salt-minion   

在所有minion上做同样的操作，注意，要设置minion配置文件中的id参数，指向minion自身的ip地址或主机名，必须能够唯一标识minion本机。

3.3.6 在syndic上接受minion主机的key

[root@syndic ~]# salt-key -L
Accepted Keys:
192.168.200.147
Denied Keys:
Unaccepted Keys:
192.168.200.145
Rejected Keys:

[root@syndic ~]# salt-key -ya 192.168.200.145
The following keys are going to be accepted:
Unaccepted Keys:
192.168.200.145

[root@syndic ~]# salt-key -L
Accepted Keys:
192.168.200.145
192.168.200.147
Denied Keys:
Unaccepted Keys:
Rejected Keys:

[root@syndic ~]# salt '*' test.ping
192.168.200.147:
    True
192.168.200.145:
    True

3.3.7 在master上接受syndic主机的key

[root@master ~]# salt-key -L
Accepted Keys:
192.168.200.146
Denied Keys:
Unaccepted Keys:
Rejected Keys:

[root@master ~]# salt '*' test.ping
192.168.200.147:
    True
192.168.200.145:
    True