YAML语言
YAML是一种直观的能够被电脑识别的数据序列化格式，是一个可读性高并且容易被人类阅读，容易和脚本语言交互，用来表达资料序列的编程语言。
它类似于标准通用标记语言的子集XML的数据描述语言，语法比XML简单很
YAML语言的格式如下：
house:
family:
name: Doe
parents:
- John
- Jane
children:
- Paul
- Mark
- Simone
address:
number: 34
street: Main Street
city: Nowheretown
zipcode: 12345YAML的基本规则：
- 使用缩进来表示层级关系，每层2个空格，禁止使用TAB键
- 当冒号不是处于最后时，冒号后面必须有一个空格
- 用 - 表示列表，- 的后面必须有一个空格
- 用 # 表示注释
YAML配置文件要放到SaltStack让我们放的位置，可以在SaltStack的 Master 配置文件中查找file_roots即可看到
[root@master ~]# vim /etc/salt/master
...此处省略N行
file_roots:
base:
- /srv/salt/base
test:
- /srv/salt/test
dev:
- /srv/salt/dev
prod:
- /srv/salt/prod
...此处省略N行
[root@master ~]# mkdir -p /srv/salt/{base,test,dev,prod}
[root@master ~]# tree /srv/salt/
/srv/salt/
├── base
├── dev
├── prod
└── test
4 directories, 0 files
[root@master ~]# systemctl restart salt-master
需要注意：
- base是默认的位置，如果file_roots只有一个，则base是必备的且必须叫base，不能改名
用SaltStack配置一个yum安装的nginx实例
[root@master ~]# cd /srv/salt/base/
[root@master base]# ls
[root@master base]# mkdir -p web/nginx
[root@master base]# tree web
web
└── nginx
1 directory, 0 files
[root@master base]# cd web/nginx/
[root@master apache]# touch install.sls
[root@master nginx]# vim install.sls #生成状态描述文件
nginx-install:
pkg.installed:
- name: nginx
nginx-service:
service.running:
- name: nginx
- enable: True
// YAML 配置文件中顶格写的被称作ID，必须全局唯一，不能重复
// SaltStack 读 YAML 配置文件时是从上往下读，所以要把先执行的写在前面
//执行状态描述文件
[root@master ~]# salt 'minion1' state.sls web.nginx.install
minion1:
----------
ID: nx-install
Function: pkg.installed
Name: nginx
Result: True
Comment: The following packages were installed/updated: nginx
Started: 20:46:08.167296
Duration: 56735.37 ms
Changes:
----------
gd:
----------
new:
2.2.5-7.el8
old:
libXpm:
----------
new:
3.5.12-8.el8
old:
libwebp:
----------
new:
1.0.0-5.el8
old:
nginx:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-all-modules:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-filesystem:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-http-image-filter:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-http-perl:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-http-xslt-filter:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-mail:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-stream:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
perl-Carp:
----------
new:
1.42-396.el8
old:
perl-Data-Dumper:
----------
new:
2.167-399.el8
old:
perl-Digest:
----------
new:
1.17-395.el8
old:
perl-Digest-MD5:
----------
new:
2.55-396.el8
old:
perl-Encode:
----------
new:
4:2.97-3.el8
old:
perl-Errno:
----------
new:
1.28-420.el8
old:
perl-Exporter:
----------
new:
5.72-396.el8
old:
perl-File-Path:
----------
new:
2.15-2.el8
old:
perl-File-Temp:
----------
new:
0.230.600-1.el8
old:
perl-Getopt-Long:
----------
new:
1:2.50-4.el8
old:
perl-HTTP-Tiny:
----------
new:
0.074-1.el8
old:
perl-IO:
----------
new:
1.38-420.el8
old:
perl-IO-Socket-IP:
----------
new:
0.39-5.el8
old:
perl-IO-Socket-SSL:
----------
new:
2.066-4.module_el8.4.0+517+be1595ff
old:
perl-MIME-Base64:
----------
new:
3.15-396.el8
old:
perl-Mozilla-CA:
----------
new:
20160104-7.module_el8.3.0+416+dee7bcef
old:
perl-Net-SSLeay:
----------
new:
1.88-1.module_el8.4.0+517+be1595ff
old:
perl-PathTools:
----------
new:
3.74-1.el8
old:
perl-Pod-Escapes:
----------
new:
1:1.07-395.el8
old:
perl-Pod-Perldoc:
----------
new:
3.28-396.el8
old:
perl-Pod-Simple:
----------
new:
1:3.35-395.el8
old:
perl-Pod-Usage:
----------
new:
4:1.69-395.el8
old:
perl-Scalar-List-Utils:
----------
new:
3:1.49-2.el8
old:
perl-Socket:
----------
new:
4:2.027-3.el8
old:
perl-Storable:
----------
new:
1:3.11-3.el8
old:
perl-Term-ANSIColor:
----------
new:
4.06-396.el8
old:
perl-Term-Cap:
----------
new:
1.17-395.el8
old:
perl-Text-ParseWords:
----------
new:
3.30-395.el8
old:
perl-Text-Tabs+Wrap:
----------
new:
2013.0523-395.el8
old:
perl-Time-Local:
----------
new:
1:1.280-1.el8
old:
perl-URI:
----------
new:
1.73-3.el8
old:
perl-Unicode-Normalize:
----------
new:
1.25-396.el8
old:
perl-constant:
----------
new:
1.33-396.el8
old:
perl-interpreter:
----------
new:
4:5.26.3-420.el8
old:
perl-libnet:
----------
new:
3.11-3.el8
old:
perl-libs:
----------
new:
4:5.26.3-420.el8
old:
perl-macros:
----------
new:
4:5.26.3-420.el8
old:
perl-parent:
----------
new:
1:0.237-1.el8
old:
perl-podlators:
----------
new:
4.11-1.el8
old:
perl-threads:
----------
new:
1:2.21-2.el8
old:
perl-threads-shared:
----------
new:
1.58-2.el8
old:
----------
ID: nginx-service
Function: service.running
Name: nginx
Result: True
Comment: Service nginx has been enabled, and is running
Started: 20:47:04.941979
Duration: 333.719 ms
Changes:
----------
nginx:
True
Summary for minion1
------------
Succeeded: 2 (changed=2)
Failed: 0
------------
Total states run: 2
Total run time: 57.069 s
在Minion上查看nginx状态
[root@minion1 ~]# systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vend>
Active: active (running) since Sun 2021-07-04 20:47:05 CST; 8min ago
Main PID: 4253 (nginx)
Tasks: 3 (limit: 4743)
Memory: 10.3M
CGroup: /system.slice/nginx.service
├─4253 nginx: master process /usr/sbin/nginx
├─4254 nginx: worker process
└─4255 nginx: worker process
Jul 04 20:47:05 minion1 systemd[1]: Starting The nginx HTTP and reverse>
Jul 04 20:47:05 minion1 nginx[4250]: nginx: the configuration file /etc>
Jul 04 20:47:05 minion1 nginx[4250]: nginx: configuration file /etc/ngi>
Jul 04 20:47:05 minion1 systemd[1]: Started The nginx HTTP and reverse >
[root@minion1 ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 [::]:80 [::]:*
[root@minion1 ~]# 
执行状态文件时可以先用test.ping测试需要执行状态文件的主机是否能正常通信，然后再执行状态文件。
top file介绍
直接通过命令执行sls文件时够自动化吗？答案是否定的，因为我们还要告诉某台主机要执行某个任务，自动化应该是我们让它干活时，它自己就知道哪台主机要干什么活，但是直接通过命令执行sls文件并不能达到这个目的，为了解决这个问题，top file 应运而生。
top file就是一个入口，top file的文件名可通过在 Master的配置文件中搜索top.sls找出，且此文件必须在 base 环境中，默认情况下此文件必须叫top.sls。
top file的作用就是告诉对应的主机要干什么活，比如让web服务器启动web服务，让数据库服务器安装mysql等等。
top file实例
我们继续以nginx服务为例，先停掉minion上的nginx
[root@minion1 ~]# systemctl stop nginx
[root@minion1 ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
[root@minion1 ~]# 在 /srv/salt/base/下面生成top.sls文件
[root@master ~]# vim /srv/salt/base/top.sls
base: #执行状态文件的环境
minion: #执行状态文件的目标
- web.nginx.install #要执行的状态文件使用高级状态highstate来执行
[root@master ~]# salt '*' state.highstate
master:
----------
ID: states
Function: no.None
Result: False
Comment: No Top file or master_tops data matches found. Please see master log for details.
Changes:
Summary for master
------------
Succeeded: 0
Failed: 1
------------
Total states run: 1
Total run time: 0.000 ms
minion1:
----------
ID: nx-install
Function: pkg.installed
Name: nginx
Result: True
Comment: All specified packages are already installed
Started: 17:46:53.320004
Duration: 994.427 ms
Changes:
----------
ID: nginx-service
Function: service.running
Name: nginx
Result: True
Comment: Service nginx is already enabled, and is running
Started: 17:46:54.316126
Duration: 173.584 ms
Changes:
----------
nginx:
True
Summary for minion1
------------
Succeeded: 2 (changed=1)
Failed: 0
------------
Total states run: 2
Total run time: 1.168 s
ERROR: Minions returned with non-zero exit code
[root@master ~]#
在minion上查看nginx状态
[root@minion1 ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
[root@minion1 ~]# systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vend>
Active: active (running) since Mon 2021-07-05 17:46:54 CST; 3min 2s >
Process: 2333 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCES>
Process: 2331 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/>
Process: 2329 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited>
Main PID: 2334 (nginx)
Tasks: 3 (limit: 4743)
Memory: 9.0M
CGroup: /system.slice/nginx.service
├─2334 nginx: master process /usr/sbin/nginx
├─2335 nginx: worker process
└─2336 nginx: worker process
Jul 05 17:46:54 minion1 systemd[1]: Starting The nginx HTTP and reverse>
Jul 05 17:46:54 minion1 nginx[2331]: nginx: the configuration file /etc>
Jul 05 17:46:54 minion1 nginx[2331]: nginx: configuration file /etc/ngi>
Jul 05 17:46:54 minion1 systemd[1]: Started The nginx HTTP and reverse >
注意：
若top file里面的目标是用 * 表示的，要注意的是，top file里面的 * 表示的是所有要执行状态的目标，而
salt '*' state.highstate里面的 * 表示通知所有机器干活，而是否要干活则是由top file来指定的
高级状态highstate的使用
管理SaltStack时一般最常用的管理操作就是执行高级状态
[root@master ~]# salt '*' state.highstate //生产环境禁止这样使用salt命令
注意：
上面让所有人执行高级状态，但实际工作当中，一般不会这么用，工作当中一般都是通知某台或某些台目标主机来执行高级状态，具体是否执行则是由top file来决定的。
若在执行高级状态时加上参数test=True，则它会告诉我们它将会做什么，但是它不会真的去执行这个操作。
/停掉minon上的httpd服务
[root@minion ~]# systemctl stop httpd
[root@minion ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: inactive (dead) since 三 2019-02-20 14:58:04 CST; 22s ago
Docs: man:httpd(8)
man:apachectl(8)
Process: 12401 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS)
Process: 11138 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=0/SUCCESS)
Main PID: 11138 (code=exited, status=0/SUCCESS)
Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec"
2月 20 14:39:40 minion systemd[1]: Starting The Apache HTTP Server...
2月 20 14:39:41 minion httpd[11138]: AH00558: httpd: Could not reliably determine the server's fully ...ssage
2月 20 14:39:41 minion systemd[1]: Started The Apache HTTP Server.
2月 20 14:58:03 minion systemd[1]: Stopping The Apache HTTP Server...
2月 20 14:58:04 minion systemd[1]: Stopped The Apache HTTP Server.
Hint: Some lines were ellipsized, use -l to show in full.
//在master上执行高级状态的测试
[root@master ~]# salt '*' state.highstate test=True
192.168.69.202:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: All specified packages are already installed
Started: 14:58:50.450451
Duration: 1055.942 ms
Changes:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: None
Comment: Service httpd is set to start //将会启动httpd
Started: 14:58:51.508031
Duration: 57.505 ms
Changes:
Summary for 192.168.69.202
------------
Succeeded: 2 (unchanged=1)
Failed: 0
------------
Total states run: 2
Total run time: 1.113 s
//在minion上查看httpd是否启动
[root@minion ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: inactive (dead) since 三 2019-02-20 14:58:04 CST; 2min 27s ago
Docs: man:httpd(8)
man:apachectl(8)
Process: 12401 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS)
Process: 11138 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=0/SUCCESS)
Main PID: 11138 (code=exited, status=0/SUCCESS)
Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec"
2月 20 14:39:40 minion systemd[1]: Starting The Apache HTTP Server...
2月 20 14:39:41 minion httpd[11138]: AH00558: httpd: Could not reliably determine the server's fully ...ssage
2月 20 14:39:41 minion systemd[1]: Started The Apache HTTP Server.
2月 20 14:58:03 minion systemd[1]: Stopping The Apache HTTP Server...
2月 20 14:58:04 minion systemd[1]: Stopped The Apache HTTP Server.
Hint: Some lines were ellipsized, use -l to show in full.
//由此可见高级状态并没有执行，因为httpd并没有启动SaltStack数据系统
SaltStack有两大数据系统，分别是：
- Grains
- Pillar
2. SaltStack数据系统组件
2.1 SaltStack组件之Grains
Grains是SaltStack的一个组件，其存放着minion启动时收集到的信息。
Grains是SaltStack组件中非常重要的组件之一，因为我们在做配置部署的过程中会经常使用它，Grains是SaltStack记录minion的一些静态信息的组件。可简单理解为Grains记录着每台minion的一些常用属性，比如CPU、内存、磁盘、网络信息等。我们可以通过grains.items查看某台minion的所有Grains信息。
Grains的功能：
- 收集资产信息
Grains应用场景：
- 信息查询
- 在命令行下进行目标匹配
- 在top file中进行目标匹配
- 在模板中进行目标匹配
模板中进行目标匹配请看：https://docs.saltstack.com/en/latest/topics/pillar/
查看所有的minion用salt '*' grains.items,或者知道某一台salt 'minion' grains.items
minion:
----------
biosreleasedate: #bios的时间
04/13/2018
biosversion: #bios的版本
6.00
cpu_flags: #cpu相关的属性
- fpu
- vme
- de
- pse
- tsc
- msr
- pae
- mce
- cx8
- apic
- sep
- mtrr
- pge
- mca
- cmov
- pat
- pse36
- clflush
- mmx
- fxsr
- sse
- sse2
- ss
- ht
- syscall
- nx
- pdpe1gb
- rdtscp
- lm
- constant_tsc
- arch_perfmon
- nopl
- xtopology
- tsc_reliable
- nonstop_tsc
- cpuid
- pni
- pclmulqdq
- ssse3
- fma
- cx16
- pcid
- sse4_1
- sse4_2
- x2apic
- movbe
- popcnt
- tsc_deadline_timer
- aes
- xsave
- avx
- f16c
- rdrand
- hypervisor
- lahf_lm
- abm
- 3dnowprefetch
- cpuid_fault
- invpcid_single
- pti
- ssbd
- ibrs
- ibpb
- stibp
- fsgsbase
- tsc_adjust
- bmi1
- avx2
- smep
- bmi2
- invpcid
- mpx
- rdseed
- adx
- smap
- clflushopt
- xsaveopt
- xsavec
- xsaves
- arat
- flush_l1d
- arch_capabilities
cpu_model: #cpu的具体型号
Intel(R) Core(TM) i5-6200U CPU @ 2.30GHz
cpuarch: #cpu架构
x86_64
cwd:
/
disks:
- sr0
- sda
dns:
----------
domain:
ip4_nameservers:
- 192.168.249.2
ip6_nameservers:
nameservers:
- 192.168.249.2
options:
search:
- localdomain
sortlist:
domain:
fqdn:
minion
fqdn_ip4: #ip地址
- 192.168.249.145
fqdn_ip6:
- fe80::dd3:b80d:8d2a:19ee
fqdns:
- minion
gid:
0
gpus:
|_
----------
model:
SVGA II Adapter
vendor:
vmware
groupname:
root
host: #主机名
minion
hwaddr_interfaces:
----------
ens33:
00:0c:29:e3:d6:a4
lo:
00:00:00:00:00:00
id: #minion的ID
minion
init:
systemd
ip4_gw:
192.168.249.2
ip4_interfaces:
----------
ens33:
- 192.168.249.145
lo:
- 127.0.0.1
ip6_gw:
False
ip6_interfaces:
----------
ens33:
- fe80::dd3:b80d:8d2a:19ee
lo:
- ::1
ip_gw:
True
ip_interfaces:
----------
ens33:
- 192.168.249.145
- fe80::dd3:b80d:8d2a:19ee
lo:
- 127.0.0.1
- ::1
ipv4:
- 127.0.0.1
- 192.168.249.145
ipv6:
- ::1
- fe80::dd3:b80d:8d2a:19ee
kernel:
Linux
kernelparams:
|_
- BOOT_IMAGE
- (hd0,msdos1)/vmlinuz-4.18.0-257.el8.x86_64
|_
- root
- /dev/mapper/cs-root
|_
- ro
- None
|_
- crashkernel
- auto
|_
- resume
- /dev/mapper/cs-swap
|_
- rd.lvm.lv
- cs/root
|_
- rd.lvm.lv
- cs/swap
|_
- rhgb
- None
|_
- quiet
- None
kernelrelease:
4.18.0-257.el8.x86_64
kernelversion:
#1 SMP Thu Dec 3 22:16:23 UTC 2020
locale_info:
----------
defaultencoding:
UTF-8
defaultlanguage:
zh_CN
detectedencoding:
UTF-8
timezone:
CST
localhost:
minion
lsb_distrib_codename:
CentOS Stream 8
lsb_distrib_id:
CentOS Stream
lsb_distrib_release:
8
lvm:
----------
cs:
- root
- swap
machine_id:
f1c3821253604c5684b5bb81ef5a45f6
manufacturer:
VMware, Inc.
master:
192.168.249.141
mdadm:
mem_total:
2623
nodename:
minion
num_cpus:
2
num_gpus:
1
os:
CentOS Stream
os_family:
RedHat
osarch:
x86_64
oscodename:
CentOS Stream 8
osfinger:
CentOS Stream-8
osfullname:
CentOS Stream
osmajorrelease:
8
osrelease:
8
osrelease_info:
- 8
path:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
pid:
1494
productname:
VMware Virtual Platform
ps:
ps -efHww
pythonexecutable:
/usr/bin/python3.6
pythonpath:
- /usr/bin
- /usr/lib64/python36.zip
- /usr/lib64/python3.6
- /usr/lib64/python3.6/lib-dynload
- /usr/lib64/python3.6/site-packages
- /usr/lib/python3.6/site-packages
pythonversion:
- 3
- 6
- 8
- final
- 0
saltpath:
/usr/lib/python3.6/site-packages/salt
saltversion:
3003.1
saltversioninfo:
- 3003
- 1
selinux:
----------
enabled:
False
enforced:
Disabled
serialnumber:
VMware-56 4d a0 c4 e2 5b 5e 0c-43 ca 55 8c d9 e3 d6 a4
server_id:
279719642
shell:
/bin/sh
ssds:
swap_total:
2047
systemd:
----------
features:
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy
version:
239
systempath:
- /usr/local/sbin
- /usr/local/bin
- /usr/sbin
- /usr/bin
uid:
0
username:
root
uuid:
c4a04d56-5be2-0c5e-43ca-558cd9e3d6a4
virtual:
VMware
zfs_feature_flags:
False
zfs_support:
False
zmqversion:
4.3.4
只查询所有的grains的key
[root@master ~]# salt 'minion1' grains.ls
minion:
- biosreleasedate
- biosversion
- cpu_flags
- cpu_model
- cpuarch
- cwd
- disks
- dns
- domain
- fqdn
- fqdn_ip4
- fqdn_ip6
- fqdns
- gid
- gpus
- groupname
- host
- hwaddr_interfaces
- id
- init
- ip4_gw
- ip4_interfaces
- ip6_gw
- ip6_interfaces
- ip_gw
- ip_interfaces
- ipv4
- ipv6
- kernel
- kernelparams
- kernelrelease
- kernelversion
- locale_info
- localhost
- lsb_distrib_codename
- lsb_distrib_id
- lsb_distrib_release
- lvm
- machine_id
- manufacturer
- master
- mdadm
- mem_total
- nodename
- num_cpus
- num_gpus
- os
- os_family
- osarch
- oscodename
- osfinger
- osfullname
- osmajorrelease
- osrelease
- osrelease_info
- path
- pid
- productname
- ps
- pythonexecutable
- pythonpath
- pythonversion
- saltpath
- saltversion
- saltversioninfo
- selinux
- serialnumber
- server_id
- shell
- ssds
- swap_total
- systemd
- systempath
- uid
- username
- uuid
- virtual
- zfs_feature_flags
- zfs_support
- zmqversion
通过grains.get xx查询某个key的值
[root@master ~]# salt 'minion1' grains.get ipv4
minion1:
- 127.0.0.1
- 192.168.137.128
[root@master ~]# salt '*' grains.get ipv4
master:
- 127.0.0.1
- 192.168.137.132
minion1:
- 127.0.0.1
- 192.168.137.128
[root@master ~]#
目标匹配实例
#在所有centos系统中执行命令
[root@master base]# salt -G 'os:CentOS Stream' cmd.run 'uptime'
master:
03:26:14 up 57 min, 1 user, load average: 0.01, 0.02, 0.00
minion1:
03:26:14 up 56 min, 1 user, load average: 0.00, 0.00, 0.00在top file里面使用Grains：
[root@master base]# vim /srv/salt/base/top.sls
base:
'os:CentOS Stream':
- match: grain
- web.nginx.install
#在minion1上停掉nginx
[root@minion1 ~]# systemctl stop nginx
[root@minion1 ~]# systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Sun 2021-07-04 02:58:28 EDT; 34min ago
Process: 27546 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
Process: 27544 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
Process: 27543 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
Main PID: 27548 (code=exited, status=0/SUCCESS)
Jul 04 02:56:07 minion1 systemd[1]: Starting The nginx HTTP and reverse proxy server...
Jul 04 02:56:07 minion1 nginx[27544]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Jul 04 02:56:07 minion1 nginx[27544]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Jul 04 02:56:07 minion1 systemd[1]: nginx.service: Failed to parse PID from file /run/nginx.pid: Invalid argument
Jul 04 02:56:07 minion1 systemd[1]: Started The nginx HTTP and reverse proxy server.
Jul 04 02:58:28 minion1 systemd[1]: Stopping The nginx HTTP and reverse proxy server...
Jul 04 02:58:28 minion1 systemd[1]: nginx.service: Succeeded.
Jul 04 02:58:28 minion1 systemd[1]: Stopped The nginx HTTP and reverse proxy server.
#在master上执行
[root@master base]# salt 'minion1' state.highstate
minion1:
----------
ID: nginx-install
Function: pkg.installed
Name: nginx
Result: True
Comment: All specified packages are already installed
Started: 03:34:16.218945
Duration: 806.932 ms
Changes:
----------
ID: nginx-service
Function: service.running
Name: nginx
Result: True
Comment: Service nginx is already enabled, and is running
Started: 03:34:17.027175
Duration: 159.837 ms
Changes:
----------
nginx:
True
Summary for minion1
------------
Succeeded: 2 (changed=1)
Failed: 0
------------
Total states run: 2
Total run time: 966.769 ms
#查看nginx状态
[root@minion1 ~]# systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2021-07-04 03:34:17 EDT; 4s ago
Process: 27948 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
Process: 27946 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
Process: 27945 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
Main PID: 27950 (nginx)
Tasks: 2 (limit: 4741)
Memory: 4.1M
CGroup: /system.slice/nginx.service
├─27950 nginx: master process /usr/sbin/nginx
└─27951 nginx: worker process
Jul 04 03:34:17 minion1 systemd[1]: Starting The nginx HTTP and reverse proxy server...
Jul 04 03:34:17 minion1 nginx[27946]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Jul 04 03:34:17 minion1 nginx[27946]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Jul 04 03:34:17 minion1 systemd[1]: nginx.service: Failed to parse PID from file /run/nginx.pid: Invalid argument
Jul 04 03:34:17 minion1 systemd[1]: Started The nginx HTTP and reverse proxy server.自定义Grains的两种方法
- minion配置文件，在配置文件中搜索grains
- 在/etc/salt下生成一个grains文件，在此文件中定义(推荐方式)
[root@minion1 ~]# vim /etc/salt/grains
test-grains: linux-node1
[root@minion1 ~]# systemctl restart salt-minion
[root@master ~]# salt '*' grains.get test-grains
minion1:
master:
linux-node1不重启的情况下自定义grains：
[root@minion1 salt]# cat grains
test-grains: linux-node1
mei: test
[root@minion1 salt]#
[root@master ~]# salt '*' saltutil.sync_grains
master:
minion1:
[root@master ~]# salt '*' grains.get mei
minion1:
test
master:
[root@master ~]#
SaltStack组件之Pillar
Pillar也是SaltStack组件中非常重要的组件之一，是数据管理中心，经常配置states在大规模的配置管理工作中使用它。Pillar在SaltStack中主要的作用就是存储和定义配置管理中需要的一些数据，比如软件版本号、用户名密码等信息，它的定义存储格式与Grains类似，都是YAML格式。
在Master配置文件中有一段Pillar settings选项专门定义Pillar相关的一些参数：
[root@master ~]# vim /etc/salt/master
#pillar_roots:
# base:
# - /srv/pillar
取消注释
[root@master ~]# mkdir -p /srv/pillar/base
默认Base环境下Pillar的工作目录在/srv/pillar目录下。若你想定义多个环境不同的Pillar工作目录，只需要修改此处配置文件即可。
Pillar的特点：
- 可以给指定的minion定义它需要的数据
- 只有指定的人才能看到定义的数据
- 在master配置文件里设置
[root@master ~]# salt '*' pillar.items
minion1:
----------
master:
----------默认pillar是没有任何信息的，如果想查看信息，需要在 master 配置文件上把 pillar_opts的注释取消，并将其值设为 True。
[root@master ~]# vim /etc/salt/master
# master config file that can then be used on minions.
pillar_opts: True
# The pillar_safe_render_error option prevents the master from passing pillar
root@master ~]# salt '*' pillar.items
.....
winrepo_cachefile:
winrepo.p
winrepo_dir:
/srv/salt/win/repo
winrepo_dir_ng:
/srv/salt/win/repo-ng
winrepo_fallback:
winrepo_insecure_auth:
False
winrepo_passphrase:
winrepo_password:
winrepo_privkey:
winrepo_pubkey:
winrepo_refspecs:
- +refs/heads/*:refs/remotes/origin/*
- +refs/tags/*:refs/tags/*
winrepo_remotes:
- https://github.com/saltstack/salt-winrepo.git
winrepo_remotes_ng:
- https://github.com/saltstack/salt-winrepo-ng.git
winrepo_ssl_verify:
True
winrepo_user:
worker_threads:
5
zmq_backlog:
1000
zmq_filtering:
False
zmq_monitor:
Falsepillar自定义数据：
在master的配置文件里找pillar_roots可以看到其存放pillar的位置
[root@master ~]# vim /etc/salt/master
pillar_roots:
base:
- /srv/pillar/base
[root@master ~]# mkdir -p /srv/pillar/base
[root@master ~]# systemctl restart salt-master
[root@master ~]# vim /srv/pillar/base/apache.sls
{% if grains['os'] == 'CentOS Stream' %}
apache: httpd
{% elif grains['os'] == 'Ubuntu' %}
apache: apache2
{% endif %}
#定义top file入口文件
[root@master ~]# vim /srv/pillar/base/top.sls
base:
'*':
- apache
[root@master ~]# salt '*' pillar.items
minion1:
----------
apache:
httpd
#state
[root@master ~]# vim /srv/salt/base/top.sls
base:
'*':
- web.apache.install
#在salt下修改apache的状态文件，引用pillar的数据
[root@master ~]# mkdir /srv/salt/base/web/apache/
[root@master ~]# vim /srv/salt/base/web/apache/install.sls
apache-install:
pkg.installed:
- name: {{ pillar['apache'] }}
apache-service:
service.running:
- name: {{ pillar['apache'] }}
- enable: True
#配置ubuntu系统
tom@tom-virtual-machine:~$ sudo curl -fsSL -o /usr/share/keyrings/salt-archive-keyring.gpg https://repo.saltproject.io/py3/ubuntu/20.04/amd64/latest/salt-archive-keyring.gpg
tom@tom-virtual-machine:~$ echo "deb [signed-by=/usr/share/keyrings/salt-archive-keyring.gpg] https://repo.saltproject.io/py3/ubuntu/20.04/amd64/latest focal main" | sudo tee /etc/apt/sources.list.d/salt.list
tom@tom-virtual-machine:~$ sudo apt-get update
tom@tom-virtual-machine:~$ sudo apt-get install salt-minion
tom@tom-virtual-machine:~$ sudo vim /etc/salt/minion
master: 192.168.168.132
tom@tom-virtual-machine:~$ sudo systemctl restart salt-minion
[root@master ~]# salt-key -L
Accepted Keys:
master
minion1
Denied Keys:
Unaccepted Keys:
tom-virtual-machine
[root@master ~]# salt-key -yA
#执行高级状态文件
[root@master ~]# salt '*' state.highstate
master:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: The following packages were installed/updated: httpd
Started: 06:36:39.400751
Duration: 14697.251 ms
Changes:
----------
apr:
----------
new:
1.6.3-11.el8
old:
apr-util:
----------
new:
1.6.1-6.el8
old:
apr-util-bdb:
----------
new:
1.6.1-6.el8
old:
apr-util-openssl:
----------
new:
1.6.1-6.el8
old:
centos-logos-httpd:
----------
new:
85.5-1.el8
old:
httpd:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
httpd-filesystem:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
httpd-tools:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
mailcap:
----------
new:
2.1.48-3.el8
old:
mod_http2:
----------
new:
1.15.7-3.module_el8.4.0+778+c970deab
old:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: True
Comment: Service httpd has been enabled, and is running
Started: 06:36:54.139133
Duration: 1819.027 ms
Changes:
----------
httpd:
True
Summary for master
------------
Succeeded: 2 (changed=2)
Failed: 0
------------
Total states run: 2
Total run time: 16.516 s
minion1:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: The following packages were installed/updated: httpd
Started: 06:36:39.313710
Duration: 22394.335 ms
Changes:
----------
apr:
----------
new:
1.6.3-11.el8
old:
apr-util:
----------
new:
1.6.1-6.el8
old:
apr-util-bdb:
----------
new:
1.6.1-6.el8
old:
apr-util-openssl:
----------
new:
1.6.1-6.el8
old:
centos-logos-httpd:
----------
new:
85.5-1.el8
old:
httpd:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
httpd-filesystem:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
httpd-tools:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
mod_http2:
----------
new:
1.15.7-3.module_el8.4.0+778+c970deab
old:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: True
Comment: Service httpd has been enabled, and is running
Started: 06:37:02.053624
Duration: 6469.225 ms
Changes:
----------
httpd:
True
Summary for minion1
------------
Succeeded: 2 (changed=2)
Failed: 0
------------
Total states run: 2
Total run time: 28.864 s
tom-virtual-machine:
----------
ID: apache-install
Function: pkg.installed
Name: apache2
Result: True
Comment: The following packages were installed/updated: apache2
Started: 18:36:39.659617
Duration: 46710.241 ms
Changes:
----------
apache2:
----------
new:
2.4.41-4ubuntu3.3
old:
apache2-bin:
----------
new:
2.4.41-4ubuntu3.3
old:
apache2-data:
----------
new:
2.4.41-4ubuntu3.3
old:
apache2-utils:
----------
new:
2.4.41-4ubuntu3.3
old:
libapr1:
----------
new:
1.6.5-1ubuntu1
old:
libaprutil1:
----------
new:
1.6.1-4ubuntu2
old:
libaprutil1-dbd-sqlite3:
----------
new:
1.6.1-4ubuntu2
old:
libaprutil1-ldap:
----------
new:
1.6.1-4ubuntu2
old:
liblua5.2-0:
----------
new:
5.2.4-1.1build3
old:
----------
ID: apache-service
Function: service.running
Name: apache2
Result: True
Comment: The service apache2 is already running
Started: 18:37:26.385690
Duration: 30.843 ms
Changes:
Summary for tom-virtual-machine
------------
Succeeded: 2 (changed=1)
Failed: 0
------------
Total states run: 2
Total run time: 46.741 s
#这里可以看到他会根据操作系统的不同安装apache
查看状态
[root@master ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2021-07-04 06:36:55 EDT; 3min 37s ago
Docs: man:httpd.service(8)
Main PID: 31186 (httpd)
Status: "Running, listening on: port 80"
Tasks: 213 (limit: 4743)
Memory: 34.5M
CGroup: /system.slice/httpd.service
├─31186 /usr/sbin/httpd -DFOREGROUND
├─31203 /usr/sbin/httpd -DFOREGROUND
├─31204 /usr/sbin/httpd -DFOREGROUND
├─31205 /usr/sbin/httpd -DFOREGROUND
└─31206 /usr/sbin/httpd -DFOREGROUND
Jul 04 06:36:54 master systemd[1]: Starting The Apache HTTP Server...
Jul 04 06:36:55 master httpd[31186]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, u>
Jul 04 06:36:55 master systemd[1]: Started The Apache HTTP Server.
Jul 04 06:36:55 master httpd[31186]: Server configured, listening on: port 80
[root@minion1 ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2021-07-04 06:37:08 EDT; 3min 49s ago
Docs: man:httpd.service(8)
Main PID: 33001 (httpd)
Status: "Running, listening on: port 80"
Tasks: 213 (limit: 4741)
Memory: 29.1M
CGroup: /system.slice/httpd.service
├─33001 /usr/sbin/httpd -DFOREGROUND
├─33072 /usr/sbin/httpd -DFOREGROUND
├─33073 /usr/sbin/httpd -DFOREGROUND
├─33074 /usr/sbin/httpd -DFOREGROUND
└─33075 /usr/sbin/httpd -DFOREGROUND
Jul 04 06:37:02 minion1 systemd[1]: Starting The Apache HTTP Server...
Jul 04 06:37:08 minion1 httpd[33001]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, >
Jul 04 06:37:08 minion1 systemd[1]: Started The Apache HTTP Server.
Jul 04 06:37:08 minion1 httpd[33001]: Server configured, listening on: port 80
tom@tom-virtual-machine:~$ sudo systemctl status apache2
[sudo] tom 的密码：
● apache2.service - The Apache HTTP Server
Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2021-07-04 18:37:13 CST; 4min 18s ago
Docs: https://httpd.apache.org/docs/2.4/
Main PID: 12593 (apache2)
Tasks: 55 (limit: 2285)
Memory: 7.1M
CGroup: /system.slice/apache2.service
├─12593 /usr/sbin/apache2 -k start
├─12595 /usr/sbin/apache2 -k start
└─12596 /usr/sbin/apache2 -k start
7月 04 18:37:13 tom-virtual-machine systemd[1]: Starting The Apache HTTP Server...
7月 04 18:37:13 tom-virtual-machine apachectl[12592]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName'>
7月 04 18:37:13 tom-virtual-machine systemd[1]: Started The Apache HTTP Server.
Grains与Pillar的区别
| 存储位置 | 类型 | 采集方式 | 应用场景 | |
|---|---|---|---|---|
| Grains | minion | 静态 | minion启动时采集 可通过刷新避免重启minion服务 | 1.信息查询 2.在命令行下进行目标匹配 3.在top file中进行目标匹配 4.在模板中进行目标匹配 |
| Pillar | master | 动态 | 指定，实时生效 | 1.目标匹配 2.敏感数据配置 |
277
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
