SaltStack之salt-ssh

salt-ssh介绍

salt-ssh可以让我们不需要在受控机上安装salt-minion客户端也能够实现管理操作。

salt-ssh的特点

• 远程系统需要Python支持，除非使用-r选项发送原始ssh命令
• salt-ssh是一个软件包，需安装之后才能使用，命令本身也是salt-ssh
• salt-ssh不会取代标准的Salt通信系统，它只是提供了一个基于SSH的替代方案，不需要ZeroMQ和agent

请注意，由于所有与Salt SSH的通信都是通过SSH执行的，因此它比使用ZeroMQ的标准Salt慢得多

salt-ssh远程管理的方式

salt-ssh有两种方式实现远程管理，一种是在配置文件中记录所有客户端的信息，诸如 IP
地址、端口号、用户名、密码以及是否支持sudo等；另一种是使用密钥实现远程管理，不需要输入密码

salt-ssh管理

[root@master ~]# yum -y install salt-ssh

通过使用用户名密码的SSH实现远程管理

修改配置文件，添加受控机信息

[root@master ~]# vim /etc/salt/roster
node2:
  host: 192.168.100.30
  user: root
  passwd: 10

                      

测试连通性

[root@master ~]# salt-ssh '*' test.ping
Permission denied for host node2, do you want to deploy the salt-ssh key? (password required):
[Y/n] Y
Password for root@node2: 
node2:
    root@192.168.100.30: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

从上面的信息可以看出，第一次访问时需要输入 yes/no ，但是 saltstack
是不支持交互式操作的，所以为了解决这个问题，我们需要对其进行设置，让系统不进行主机验证。

[root@master ~]# salt-ssh '*' -r 'yum -y install python3' 

[root@master ~]# vim ~/.ssh/config
StrictHostKeyChecking no

[root@master ~]# salt-ssh '*' test.ping
node2:
    True

通过salt-ssh初始化系统安装salt-minion

安装salt-ssh

[root@master ~]# yum -y install salt-ssh

修改roter配置文件，添加受控主机

[root@master ~]# vim /etc/salt/roster
node2:        
  host: 192.168.100.30
  user: root
  passwd: 10
~              

测试连通性

[root@master ~]# salt-ssh '*' test.ping
node2:
    True

执行状态命令，初始化系统，安装salt-minion

[root@master ~]# mkdir -p /srv/salt/base/{repo,files}
[root@master base]# cp /etc/yum.repos.d/salt.repo /srv/salt/base/repo/
[root@master ~]# cp /etc/salt/minion /srv/salt/base/files/

[root@master ~]# vim /srv/salt/base/repo.sls
salt-repo:
  file.managed:
    - name: /etc/yum.repos.d/salt.repo
    - source: salt://repo/salt.repo
    - user: root
    - group: root
    - mode: 0640
[root@master ~]# vim /srv/salt/base/minion.sls
salt-minion-install:
  pkg.installed:
    - name: salt-minion

salt-minion-conf:
  file.managed:
    - name: /etc/salt/minion
    - source: salt://files/minion
    - user: root
    - group: root
    - mode: 0640

salt-minion-service:
  service.running:
    - name: salt-minion
    - enable: yes

[root@master ~]# salt-ssh '*' state.sls repo
node2:
----------
          ID: salt-repo
    Function: file.managed
        Name: /etc/yum.repos.d/salt.repo
      Result: True
     Comment: File /etc/yum.repos.d/salt.repo updated
     Started: 08:16:37.775209
    Duration: 62.941 ms
     Changes:   
              ----------
              diff:
                  New file
              mode:
                  0640

Summary for node2
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time:  62.941 ms

[root@master ~]#  salt-ssh '*' state.sls minion
node2:
----------
          ID: salt-minion-install
    Function: pkg.installed
        Name: salt-minion
      Result: True
     Comment: The following packages were installed/updated: salt-minion
     Started: 08:40:50.108723
    Duration: 29373.452 ms
     Changes:   
              ----------
              dnf-plugins-core:
                  ----------
                  new:
                      4.0.21-1.el8
                  old:
                      4.0.18-1.el8
              gpg-pubkey.(none):
                  ----------
                  new:
                      8483c65d-5ccc5b19,de57bfbe-53a9be98
                  old:
                      8483c65d-5ccc5b19
              libsodium:
                  ----------
                  new:
                      1.0.18-2.el8
                  old:
              libunwind:
                  ----------
                  new:
                      1.3.1-3.el8
                  old:
              openpgm:
                  ----------
                  new:
                      5.2.122-21.el8
                  old:
              python3-babel:
                  ----------
                  new:
                      2.5.1-6.el8
                  old:
              python3-chardet:
                  ----------
                  new:
                      3.0.4-7.el8
                  old:
              python3-contextvars:
                  ----------
                  new:
                      2.4-1.el8
                  old:
              python3-distro:
                  ----------
                  new:
                      1.4.0-2.module_el8.5.0+761+faacb0fb
                  old:
              python3-dnf-plugins-core:
                  ----------
                  new:
                      4.0.21-1.el8
                  old:
                      4.0.18-1.el8
              python3-idna:
                  ----------
                  new:
                      2.5-5.el8
                  old:
              python3-immutables:
                  ----------
                  new:
                      0.15-2.el8
                  old:
              python3-jinja2:
                  ----------
                  new:
                      2.10.1-3.el8
                  old:
              python3-m2crypto:
                  ----------
                  new:
                      0.35.2-5.el8
                  old:
              python3-markupsafe:
                  ----------
                  new:
                      0.23-19.el8
                  old:
              python3-msgpack:
                  ----------
                  new:
                      0.6.2-1.el8
                  old:
              python3-psutil:
                  ----------
                  new:
                      5.4.3-10.el8
                  old:
              python3-pycurl:
                  ----------
                  new:
                      7.43.0.2-4.el8
                  old:
              python3-pysocks:
                  ----------
                  new:
                      1.6.8-3.el8
                  old:
              python3-pytz:
                  ----------
                  new:
                      2017.2-9.el8
                  old:
              python3-requests:
                  ----------
                  new:
                      2.20.0-2.1.el8_1
                  old:
              python3-urllib3:
                  ----------
                  new:
                      1.24.2-5.el8
                  old:
              python3-zmq:
                  ----------
                  new:
                      19.0.0-1.el8
                  old:
              salt:
                  ----------
                  new:
                      3003.1-1.el8
                  old:
              salt-minion:
                  ----------
                  new:
                      3003.1-1.el8
                  old:
              yum-utils:
                  ----------
                  new:
                      4.0.21-1.el8
                  old:
              zeromq:
                  ----------
                  new:
                      4.3.4-2.el8
                  old:
----------
          ID: salt-minion-conf
    Function: file.managed
        Name: /etc/salt/minion
      Result: True
     Comment: File /etc/salt/minion updated
     Started: 08:41:19.485756
    Duration: 40.13 ms
     Changes:   
              ----------
              diff:
                  --- 
                  +++ 
                  @@ -14,7 +14,7 @@
                   # Set the location of the salt master server. If the master server cannot be
                   # resolved, then the minion will fail to start.
                   #master: salt
                  -
                  +master: 192.168.100.10
                   # Set http proxy information for the minion when doing requests
                   #proxy_host:
                   #proxy_port:
----------
          ID: salt-minion-service
    Function: service.running
        Name: salt-minion
      Result: True
     Comment: Service salt-minion has been enabled, and is running
     Started: 08:41:19.534035
    Duration: 585.074 ms
     Changes:   
              ----------
              salt-minion:
                  True

Summary for node2
------------
Succeeded: 3 (changed=3)
Failed:    0
------------
Total states run:     3
Total run time:  29.999 s

[root@master ~]# salt-ssh '*' cmd.run 'systemctl restart salt-minion'

[root@master ~]# salt-key -L
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
192.168.100.30
master
Rejected Keys:

[root@master ~]# salt-key -A
The following keys are going to be accepted:
Unaccepted Keys:
192.168.100.30
master
Proceed? [n/Y] y
Key for minion 192.168.100.30 accepted.
Key for minion master accepted.
[root@master ~]# salt-key -L
Accepted Keys:
192.168.100.30
master
node1
Denied Keys:
Unaccepted Keys:
Rejected Keys:

[root@master ~]# salt-ssh '*' cmd.run 'systemctl status salt-minion'
node2:
    * salt-minion.service - The Salt Minion
       Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; enabled; vendor preset: disabled)
       Active: active (running) since Thu 2021-07-08 08:42:32 EDT; 1min 52s ago
         Docs: man:salt-minion(1)
               file:///usr/share/doc/salt/html/contents.html
               https://docs.saltstack.com/en/latest/contents.html
     Main PID: 507312 (salt-minion)
        Tasks: 4 (limit: 11200)
       Memory: 69.9M
       CGroup: /system.slice/salt-minion.service
               |-507312 /usr/bin/python3.6 /usr/bin/salt-minion
               |-507318 /usr/bin/python3.6 /usr/bin/salt-minion
               `-507320 /usr/bin/python3.6 /usr/bin/salt-minion