Saltstack之salt-ssh
salt-ssh介绍
salt-ssh可以让我们不需要在受控机上安装salt-minion客户端也能够实现管理操作。
salt-ssh的特点
远程系统需要Python支持,除非使用-r选项发送原始ssh命令
salt-ssh是一个软件包,需安装之后才能使用,命令本身也是salt-ssh
salt-ssh不会取代标准的Salt通信系统,它只是提供了一个基于SSH的替代方案,不需要ZeroMQ和agent
请注意,由于所有与Salt SSH的通信都是通过SSH执行的,因此它比使用ZeroMQ的标准Salt慢得多
salt-ssh远程管理的方式
salt-ssh有两种方式实现远程管理,一种是在配置文件中记录所有客户端的信息,诸如 IP 地址、端口号、用户名、密码以及是否支持sudo等;另一种是使用密钥实现远程管理,不需要输入密码。
通过salt-ssh安装salt-minion
[root@master ~]# yum -y install salt-ssh
AppStream 1.7 MB/s | 4.4 kB 00:00
BaseOS 1.9 MB/s | 3.9 kB 00:00
MySQL Connectors Community 1.6 kB/s | 2.6 kB 00:01
MySQL Tools Community 5.4 kB/s | 2.6 kB 00:00
MySQL 5.7 Community Server 1.3 kB/s | 2.6 kB 00:02
Salt repo for RHEL/CentOS 8 PY3 1.3 kB/s | 3.0 kB 00:02
依赖关系解决。
=======================================================================================================================================
软件包 架构 版本 仓库 大小
=======================================================================================================================================
安装:
salt-ssh noarch 3004-1.el8 salt-latest-repo 25 k
事务概要
=======================================================================================================================================
安装 1 软件包
总下载:25 k
安装大小:4.1 k
下载软件包:
salt-ssh-3004-1.el8.noarch.rpm 16 kB/s | 25 kB 00:01
---------------------------------------------------------------------------------------------------------------------------------------
总计 16 kB/s | 25 kB 00:01
运行事务检查
事务检查成功。
运行事务测试
事务测试成功。
运行事务
准备中 : 1/1
安装 : salt-ssh-3004-1.el8.noarch 1/1
运行脚本: salt-ssh-3004-1.el8.noarch 1/1
验证 : salt-ssh-3004-1.el8.noarch 1/1
Installed products updated.
已安装:
salt-ssh-3004-1.el8.noarch
完毕!
[root@master ~]# vim /etc/salt/roster
[root@master ~]# vim /etc/salt/master
[root@master ~]# mkdir -p /srv/salt/base
[root@master ~]# systemctl status salt-master
● salt-master.service - The Salt Master Server
Loaded: loaded (/usr/lib/systemd/system/salt-master.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2021-11-02 19:18:47 CST; 3 weeks 6 days ago
Docs: man:salt-master(1)
file:///usr/share/doc/salt/html/contents.html
https://docs.saltproject.io/en/latest/contents.html
Main PID: 3501947 (salt-master)
Tasks: 38 (limit: 11070)
Memory: 110.3M
CGroup: /system.slice/salt-master.service
├─ 443902 /usr/bin/python3.6 /usr/bin/salt-master
├─3501947 /usr/bin/python3.6 /usr/bin/salt-master
├─3501954 /usr/bin/python3.6 /usr/bin/salt-master
├─3501982 /usr/bin/python3.6 /usr/bin/salt-master
├─3501985 /usr/bin/python3.6 /usr/bin/salt-master
├─3501986 /usr/bin/python3.6 /usr/bin/salt-master
├─3501987 /usr/bin/python3.6 /usr/bin/salt-master
├─3501988 /usr/bin/python3.6 /usr/bin/salt-master
├─3501995 /usr/bin/python3.6 /usr/bin/salt-master
├─3501996 /usr/bin/python3.6 /usr/bin/salt-master
├─3501997 /usr/bin/python3.6 /usr/bin/salt-master
├─3501998 /usr/bin/python3.6 /usr/bin/salt-master
└─3502001 /usr/bin/python3.6 /usr/bin/salt-master
11月 02 19:18:47 master systemd[1]: Starting The Salt Master Server...
11月 02 19:18:47 master systemd[1]: Started The Salt Master Server.
11月 02 19:26:59 master salt-master[3501947]: [ERROR ] Event iteration failed with exception: 'list' object has no attribute 'items'
[5]+ 已停止 systemctl status salt-master
[root@master ~]# cd /srv/salt/base/
[root@master base]# ls
apache.sls top.sls web
[root@master base]# mkdir minion
[root@master base]# ls
apache.sls minion top.sls web
[root@master base]# mkdir minion/files
[root@master base]# touch minion/install.sls
[root@master base]# cp /etc/yum.repos.d/salt.repo minion/files/
[root@master base]# cp /etc/salt/minion minion/files/
[root@master base]# tree
.
├── apache.sls
├── minion
│ ├── files
│ │ ├── minion
│ │ └── salt.repo
│ └── install.sls
├── top.sls
└── web
└── apache
├── apache.sls
└── install.sls
4 directories, 7 files
[root@master base]# vim minion/files/minion
[root@master base]# cat minion/install.sls
[root@master base]# vim minion/install.sls
[root@master base]# cat minion/install.sls
alt-repo-cp:
file.managed:
- name: /etc/yum.repos.d/salt.repo
- source: salt://minion/files/salt.repo
- user: root
- group: root
- mode: 644
salt-minion-install:
pkg.installed:
- name: salt-minion
salt-minion-conf:
file.managed:
- name: /etc/salt/minion
- source: salt://minion/files/minion
- user: root
- group: root
- mode: 644
- require:
- pkg: salt-minion-install
salt-minion-service:
service.running:
- name: salt-minion
- enable: True
- start: True
- watch:
- file: /etc/salt/minion
[root@master base]# salt-ssh 'minion' state.sls minion.install
i^H^Hminion:
ssh: connect to host 192.168.197.128 port 22: Connection timed out
[root@master base]# salt-key -L
Accepted Keys:
master
minion
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@master base]# salt-key -ya node1
The key glob 'node1' does not match any unaccepted keys.
[root@master base]# salt-key -ya minion
The key glob 'minion' does not match any unaccepted keys.
[root@master base]# salt-key -L
Accepted Keys:
master
minion
Denied Keys:
Unaccepted Keys:
Rejected Keys:
masterless
(无salt-master模式)
应用场景
master 与 minion 网络不通或通信有延迟,即网络不稳定
想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理,但是当网络不稳定的时候,当想在minion本地执行状态的时候,当在只有一台主机的时候,想执行状态该怎么办呢?这就需要用到 masterless 了。
有了masterless,即使你只有一台主机,也能玩saltstack,而不需要你有N台主机。
masterless配置
修改配置文件minion:
注释master行
取消注释file_client并设其值为local
设置file_roots
设置pillar_roots
[root@node1 ~]# vim /etc/salt/minion
......
16 #master: salt # 注释掉
17 #master: 192.168.197.131 # 注释掉
......
608 # minion in masterless mode.
609 file_client: local # 取消注释,并将remote改为local
......
615 # Example:
616 file_roots: # 设置file_roots的路径和环境,可有多套环境
617 base:
618 - /srv/salt/base
......
[root@node1 ~]# mkdir -p /srv/salt/base
[root@node1 ~]# systemctl disable --now salt-minion
Removed /etc/systemd/system/multi-user.target.wants/salt-minion.service.
salt-call
masterless模式执行模块或状态时需要使用salt-call命令,而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。
[root@node1 ~]# salt-call --local cmd.run 'uptime'
local:
03:35:29 up 1:28, 3 users, load average: 0.24, 0.10, 0.12
[root@node1 ~]# salt-call --local cmd.run "ls -l /root"
local:
total 4
-rw-------. 1 root root 1023 Sep 24 04:52 anaconda-ks.cfg
salt-master高可用
我们需要用salt来管理公司的所有机器,那么salt的master就不能宕机,否则就会整个瘫痪,所以我们必须要对salt进行高可用。salt的高可用配置非常简单,只需要改一下minion配置文件,将master用列表的形式列出即可。
涉及到高可用时,数据的同步是个永恒的话题,我们必须保证高可用的2个master间使用的数据是一致的,包括:
将master上面的/etc/salt/master配置文件复制到master2上保证一致
[root@master ~]# scp /etc/salt/master 192.168.197.131:/etc/salt/master
The authenticity of host '192.168.197.131 (192.168.197.131)' can't be established.
ECDSA key fingerprint is SHA256:qGo2KBhH76C5Wuc1GcoWxBn7Gua5/QoSQQefFVgb9Yo.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.197.131' (ECDSA) to the list of known hosts.
root@192.168.197.131's password:
master 100% 52KB 24.9MB/s 00:00
[root@master ~]# scp -r /etc/salt/pki/master 192.168.197.131:/etc/salt/pki/master
root@192.168.197.129's password:
minion 100% 451 410.1KB/s 00:00
master 100% 451 783.8KB/s 00:00
node2 100% 451 395.3KB/s 00:00
node1 100% 451 210.9KB/s 00:00
master.pem 100% 1679 1.6MB/s 00:00
master.pub 100% 451 779.8KB/s 00:00
[root@master2 pki]# tree
.
├── master
│ └── master
│ ├── master.pem
│ ├── master.pub
│ ├── minions
│ │ ├── master
│ │ ├── minion
│ │ ├── node1
│ │ └── node2
│ ├── minions_autosign
│ ├── minions_denied
│ ├── minions_pre
│ └── minions_rejected
└── minion
8 directories, 6 files
将master上面的/srv/下的salt和pillar目录下的所有文件复制到master2上保证一致
[root@master ~]# scp -r /etc/salt/pki/master 192.168.101.200:/etc/salt/pki/master
[root@master2 ~]# systemctl enable --now salt-master.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.
[root@node2 pki]# vim /etc/salt/minion
......
16 #master: salt
17 master:
18 - 192.168.197.131 # 主
19 - 192.168.197.129 # 备
......
49 # beacons) without a master connection
50 master_type: failover # 取消注释,将str改为failover(故障转移)
......
55 # of TCP connections, such as load balancers.)
56 master_alive_interval: 10 # 默认是30s,故障转移切换时间(以秒为单位),用于检查主服务器是否仍然存在。如果master_type上面是“failover”,那么就会被启用。
......
74 retry_dns: 0 # 设置在尝试解析之前等待的秒数,默认为30秒
# 重启salt-minion
[root@minion ~]# systemctl restart salt-minion.service
[root@master ~]# salt minion test.ping
minion:
True
[root@master2 ~]# salt minion test.ping
No minions matched the target. No command was sent, no jid was assigned.
ERROR: No return received
[root@master ~]# systemctl stop salt-master.service
[root@master2 ~]# salt minion test.ping
minion:
True
salt-syndic部署
syndic1
[root@syndic1 ~]# yum -y install salt-master salt-syndic
syndic2
[root@syndic2 ~]# yum -y install salt-master salt-syndic
node1
[root@node1 ~]# yum -y install salt-minion
node2
[root@node2 ~]# yum -y install salt-minion
配置master
修改主master的master配置文件
取消注释order_master
将order_master的值设为True
[root@master ~]# vim /etc/salt/master
......
# masters' syndic interfaces.
order_masters: True # 修改(不要顶格)
# 重启
[root@master ~]# systemctl restart salt-master
配置syndic
修改syndic所在主机的master配置文件(syndic2同样操作)
取消注释syndic_master
将syndic_master的值设为主master的IP
[root@syndic1 ~]# vim /etc/salt/master
......
1080 # this master where to receive commands from.
1081 syndic_master: 192.168.197.131 # 指向主masterIP
# 启动
[root@syndic1 ~]# systemctl start salt-syndic
[root@syndic1 ~]# systemctl start salt-master
配置minion
配置minion,将master指向syndic所在主机
node1
[root@node1 ~]# vim /etc/salt/minion
......
# resolved, then the minion will fail to start.
master: 192.168.197.129 # IP指向syndic1
......
# 启动
[root@node1 ~]# systemctl start salt-minion
node2
[root@node2 ~]# vim /etc/salt/minion
......
15 # resolved, then the minion will fail to start.
16 master: 192.168.197.132 # IP指向syndic2
....
# 启动
[root@node2 ~]# systemctl start salt-minion
[root@syndic1 ~]# salt-key -L # 查看key
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
Rejected Keys:
[root@syndic1 ~]# salt-key -ya node1 # 接收key
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@syndic1 ~]# salt-key -L # 确认已接收
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@syndic2 ~]# salt-key -L # 查看key
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node2
Rejected Keys:
[root@syndic2 ~]# salt-key -yA # 接收key
The following keys are going to be accepted:
Unaccepted Keys:
node2
Key for minion node2 accepted.
[root@syndic2 ~]# salt-key -L # 确认已接收
Accepted Keys:
node2
Denied Keys:
Unaccepted Keys:
Rejected Keys:
主master接收syndic的key
[root@master ~]# salt-key -L # 查看
Accepted Keys:
Denied Keys:
Unaccepted Keys:
syndic1
syndic2
Rejected Keys:
[root@master ~]# salt-key -yA # 接收所有
The following keys are going to be accepted:
Unaccepted Keys:
syndic1
syndic2
Key for minion syndic1 accepted.
Key for minion syndic2 accepted.
[root@master ~]# salt-key -L # 确认已接收
Accepted Keys:
syndic1
syndic2
Denied Keys:
Unaccepted Keys:
Rejected Keys:
主master测试 ping
[root@master ~]# salt '*' test.ping
node1:
True
node2:
True
同步数据
将主master的srv目录同步到syndic主机上,启用syndic主机配置文件中的file_roots和pillar_roots
重启syndic的master,syndic
[root@master ~]# scp -r /srv/* 192.168.101.120:/srv/ # 同步到syndic1
[root@master ~]# scp -r /srv/* 192.168.101.200:/srv/ # 同步到syndic2
# 修改syndic主机配置文件/etc/salt/master
(syndic2操作一致)
[root@syndic1 srv]# vim /etc/salt/master
......
667 file_roots: # 取消对应注释
668 base:
669 - /srv/salt/base
670 # dev:
671 # - /srv/salt/dev/services
672 # - /srv/salt/dev/states
673 prod:
674 - /srv/salt/prod
675 # - /srv/salt/prod/states
......
# 重启
[root@syndic1 srv]# systemctl restart salt-master
[root@syndic1 srv]# systemctl restart salt-syndic
主master测试连通性
[root@master ~]# salt '*' test.ping
node1:
True
node2:
True