文章目录
1. salt-ssh介绍
salt-ssh可以让我们不需要在受控机上安装salt-minion客户端也能够实现管理操作。
1.1 salt-ssh的特点
- 远程系统需要Python支持,除非使用-r选项发送原始ssh命令
- salt-ssh是一个软件包,需安装之后才能使用,命令本身也是salt-ssh
- salt-ssh不会取代标准的Salt通信系统,它只是提供了一个基于SSH的替代方案,不需要ZeroMQ和agent
请注意,由于所有与Salt SSH的通信都是通过SSH执行的,因此它比使用ZeroMQ的标准Salt慢得多
1.2 salt-ssh远程管理的方式
salt-ssh
有两种方式实现远程管理,一种是在配置文件中记录所有客户端的信息,诸如 IP 地址、端口号、用户名、密码以及是否支持sudo等;另一种是使用密钥实现远程管理,不需要输入密码。
2. salt-ssh管理
在 master 上安装 salt-ssh
[root@master ~]# yum -y install salt-ssh
2.1 通过使用用户名密码的SSH实现远程管理
修改配置文件,添加受控机信息
[root@master ~]# vim /etc/salt/roster
....此处省略N行
node4:
host: 192.168.25.131
user: root
passwd: 1
使用ssh远程连接创建密钥
[root@master ~]# ssh root@192.168.25.131
The authenticity of host '192.168.25.131 (192.168.25.131)' can't be established.
ECDSA key fingerprint is SHA256:V7GG/lAn7yHEwLCx/FHBsmOIRCQv4wLTtulR049adHQ.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.25.131' (ECDSA) to the list of known hosts.
root@192.168.25.131's password:
Last login: Mon Nov 29 05:04:32 2021 from 192.168.25.146
[root@node4 ~]#
[root@node4 ~]#
[root@node4 ~]# exit
注销
测试连通性
[root@master ~]# salt-ssh 'node4' test.ping
node4:
True
如果第一次访问时需要输入 yes/no ,但是 saltstack 是不支持交互式操作的,所以为了解决这个问题,我们需要对其进行设置,让系统不进行主机验证。
[root@master ~]# vim ~/.ssh/config
StrictHostKeyChecking no
[root@master ~]# salt-ssh 'node4' test.ping
node4:
True
安装python3
[root@master ~]# salt-ssh -r 'node1' 'yum -y install python3'
2.2 通过salt-ssh初始化系统安装salt-minion
安装 salt-ssh
[root@master ~]# yum -y install salt-ssh
修改roster配置文件,添加受控主机
[root@master ~]# vim /etc/salt/roster
....此处省略N行
node4:
host: 192.168.25.131
user: root
passwd: 1
测试连通性
[root@master ~]# salt-ssh 'node4' test.ping
node4:
True
执行状态命令,初始化系统,安装salt-minion
[root@master yum]# cat main.sls
{% if grains['os'] == 'RedHat' %}
/etc/yum.repos.d/centos-{{ grains['osrelease'] }}.repo:
file.managed:
- source: salt://init/yum/files/centos-{{ grains['osrelease'] }}.repo
- user: root
- group: root
- mode: '0644'
{% endif %}
/etc/yum.repos.d/epel.repo:
file.managed:
- source: salt://init/yum/files/epel.repo
- user: root
- group: root
- mode: '0644'
/etc/yum.repos.d/salt-{{ grains['osrelease'] }}.repo:
file.managed:
- source: salt://init/yum/files/salt-{{ grains['osrelease'] }}.repo
- user: root
- group: root
- mode: '0644'
[root@master salt-minion]# vim main.sls
include:
- init.yum.main
salt-minion:
pkg.installed
/etc/salt/minion:
file.managed:
- source: salt://init/salt-minion/files/minion.j2
- user: root
- group: root
- mode: '0644'
- template: jinja
salt-minion.service:
service.running:
- enable: true
[root@master ~]# salt-ssh 'node4' state.sls init.salt-minion.main
node4:
----------
ID: /etc/yum.repos.d/epel.repo
Function: file.managed
Result: True
Comment: File /etc/yum.repos.d/epel.repo is in the correct state
Started: 05:30:48.085141
Duration: 83.344 ms
Changes:
----------
ID: /etc/yum.repos.d/salt-8.repo
Function: file.managed
Result: True
Comment: File /etc/yum.repos.d/salt-8.repo is in the correct state
Started: 05:30:48.168613
Duration: 4.087 ms
Changes:
----------
ID: salt-minion
Function: pkg.installed
Result: True
Comment: All specified packages are already installed
Started: 05:30:50.146835
Duration: 841.953 ms
Changes:
----------
ID: /etc/salt/minion
Function: file.managed
Result: True
Comment: File /etc/salt/minion updated
Started: 05:30:50.988957
Duration: 48.79 ms
Changes:
----------
mode:
0644
----------
ID: salt-minion.service
Function: service.running
Result: True
Comment: The service salt-minion.service is already running
Started: 05:30:51.042335
Duration: 41.81 ms
Changes:
Summary for node4
------------
Succeeded: 5 (changed=1)
Failed: 0
------------
Total states run: 5
Total run time: 1.020 s
//在minion端查看状态
[root@node4 ~]# systemctl status salt-minion
● salt-minion.service - The Salt Minion
Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; enabled; vend>
Active: active (running) since Mon 2021-11-29 04:49:25 EST; 42min ago
Docs: man:salt-minion(1)
file:///usr/share/doc/salt/html/contents.html
https://docs.saltproject.io/en/latest/contents.html
Main PID: 921 (salt-minion)
Tasks: 6 (limit: 11201)
Memory: 114.9M
CGroup: /system.slice/salt-minion.service
├─ 921 /usr/bin/python3.6 /usr/bin/salt-minion
├─1203 /usr/bin/python3.6 /usr/bin/salt-minion
└─1271 /usr/bin/python3.6 /usr/bin/salt-minion
11月 29 04:49:23 node4 systemd[1]: Starting The Salt Minion...
11月 29 04:49:25 node4 systemd[1]: Started The Salt Minion.
11月 29 04:50:57 node4 salt-minion[921]: [ERROR ] Error while bringing up m>
11月 29 04:51:17 node4 salt-minion[921]: [ERROR ] Minion unable to successf>
lines 1-18/19 88%
在master上接受指定minion的新证书
[root@master ~]# salt-key -L
Accepted Keys:
minion
node1
node2
node3
node4
Denied Keys:
Unaccepted Keys:
master
Rejected Keys:
使用salt命令测试连通性
[root@master ~]# salt 'node4' test.ping
node4:
True