saltstack初步学习-白红宇

saltstack初步学习

阅读量：7102 次

发布时间：2019-06-28

本文共 10889 字，大约阅读时间需要 36 分钟。

注：本文同学看一些牛人博客及saltstack社区总结的，感谢牛人们的分享，像开源致敬

通过实验测试总结saltstack所实现的功能

1.安装软件包

2.文件分发

3.添加删除用户，组并将用户加入sudo

4.执行系统命令

还有很多功能没有测试

一、saltstack 安装配置

一般测试注意selinux和iptables，最好是关闭selinux 开启iptables但开放相应端口

1.1 环境

centos 6.2 192.168.101.77 salt-master

centos 6.2 192.168.101.88 salt-minion

1.2 Master 安装配置

rpm -ivh http://mirrors.ustc.edu.cn/fedora/epel//6/x86_64/epel-release-6-8.noarch.rpm

yum -y install salt-master

master配置文件简单

[root@open-source ~]# cat /etc/salt/master |grep -v "#"|grep -v "^$"

interface: 192.168.101.77 #监听地址

publish_port: 4505

ret_port: 4506

pidfile: /var/run/salt-master.pid #

file_roots:

base:

- /srv/salt/

pillar_roots:

base:

- /srv/pillar

nodegroups: #可以根据mimion不同分组管理

group1: 'L@foo.domain.com,bar.domain.com,baz.domain.com and bl*.domain.com'

group2: 'G@os:Debian and foo.domain.com'

添加iptables

[root@open-source ~]# iptables -I INPUT -p tcp --dport 4505 -j ACCEPT

[root@open-source ~]# iptables -I INPUT -p tcp --dport 4506 -j ACCEPT

启动mater

[root@open-source ~]# /etc/init.d/salt-master restart

1.3 client 安装配置

rpm -ivh http://mirrors.ustc.edu.cn/fedora/epel//6/x86_64/epel-release-6-8.noarch.rpm

yum -y install salt-minion

[root@open2 ~]# vim /etc/salt/minion

master: 192.168.101.77

[root@open2 ~]# /etc/init.d/salt-minion start #启动

Starting salt-minion daemon: [ OK ]

[root@open2 ~]# tail -f /var/log/salt/minion #查看日志

1.4 server 端查看连接过来的key

[root@open-source ~]# salt-key list

Accepted Keys:

Unaccepted Keys:

open2 #可以看到连接过来的客户端

Rejected Keys:

1.5 接收客户端key

[root@open-source ~]# salt-key -a open2

The following keys are going to be accepted:

Unaccepted Keys:

open2

Proceed? [n/Y] Y

Key for minion open2 accepted.

1.6 客户端key存放位置

[root@open-source ~]# ls /etc/salt/pki/master/minions

open2

1.7 下面是几个测试命令

[root@open-source ~]# salt '*' cmd.run "hostname"

open2:

open2

[root@open-source ~]# salt '*' test.ping

open2:

True

[root@open-source ~]# salt '*' disk.usage

二、 salt 常用命令

-E 后面正则表达式

[root@open-source ~]# salt -E 'open*' test.ping

open2:

True

不带-E 后面可以带shell正则

[root@open-source ~]# salt 'open*' cmd.run 'uname -a'

-L 后面可以跟多个客户端

[root@open-source ~]# salt -L 'open1,open2,open3' cmd.run 'uname -a'

-N 后面可以按组分

-L 列出客户端

[root@open-source ~]# salt-key -L

Accepted Keys:

open2

Unaccepted Keys:

Rejected Keys:

cmd.run 一个很强大的命令，可以远程执行shell命令

例如：远程简历用户

[root@open-source ~]# salt -E 'open2' cmd.run 'useradd testuser'

grain 责采集客户端一些基本信息

minion基本信息管理

salt '*' grains.ls 查看grains分类

salt '*' grains.items 查看grains所有信息

salt '*' grains.item osrelease 查看grains某个信息

pillar

# mkdir /srv/pillar/

[root@open-source pillar]# cat top.sls

base:

'*':

- data

[root@open-source pillar]# cat data.sls

info: some data

[root@open-source pillar]# salt '*' pillar.data

三、 salt-stack安装rpm包及文件分发

例如安装LNMP并分发配置文件到各个minion

3.1 目录组织结构

[root@open-source salt]# tree

├── conf

│?? ├── mysql.sls

│?? ├── nginx.sls

│?? ├── pack.sls

│?? ├── php.sls

│?? └── software.sls

├── mysql

│?? └── my.cnf

├── nginx

│?? └── nginx.conf

├── php

│?? └── php.ini

├── software

│?? ├── mysql-5.6.14.tar.gz

│?? ├── nginx-1.5.6.tar.gz

│?? └── php-5.5.5.tar.gz

└── top.sls

3.2 建立所需目录，前期准备

[root@open-source ~]# cd /srv/salt/

[root@open-source salt]# mkdir -p {conf,nginx,php,mysql,software}

[root@open-source salt]# cp -p /usr/local/mysql/my.cnf mysql/

[root@open-source salt]# cp -p /usr/local/app/nginx/conf/nginx.conf nginx/

[root@open-source salt]# cp -p /usr/local/php/etc/php.ini php/

[root@open-source salt]# cd software/

[root@open-source software]# cp -p /usr/src/php-5.5.5.tar.gz .

[root@open-source software]# cp -p /usr/src/nginx-1.5.6.tar.gz .

[root@open-source software]# cp -p /usr/src/mysql-5.6.14.tar.gz .

[root@open-source software]# cd ../conf/

[root@open-source conf]# touch nginx.sls mysql.sls php.sls pack.sls software.sls

3.3 入口文件top配置

在/srv/salt目录下面新建top.sls文件，该文件是Saltstack入口配置文件。

Saltstack "top.sls"文件开头一般用base:书写，通配符'*'表示所有的minion，

-conf.pack表示conf目录下面的pack.sls文件，在这里我定义的是RPM软件包管理。

[root@open-source salt]# vim top.sls

base:

'*':

- conf.nginx

- conf.mysql

- conf.php

- conf.pack

- conf.software

3.4 安装mysql rpm包

创建软件包管理的配置文件pack.sls 文件，httpd表示要安装软件包，pkg:表示Saltstack安装包管理，

-name表示安装软件包名称，-installed表示安装，-removed表示卸载，service:表示Saltstack服务管理，

后两行保证mysql的服务是开启的。

[root@open-source conf]# cat pack.sls

mysql:

pkg:

- name: mysql

- installed

service:

- running

- enable: True

3.5 推送my.cnf文件

创建Nginx sls配置文件nginx.sls ,第一行表示分发到minion文件路径，-managed表示Saltstack文件管理，

-source:表示master端配置文件地址，是从master配置文件定义的路径/srv/salt开始查找的，下面三行表示文件的属性。

[root@open-source conf]# cat mysql.sls

/usr/local/mysql/conf/my.cnf:

file:

- managed

- source: salt://mysql/my.cnf

- user: mysql

- group: mysql

- mode: 644

- backup: minion

3.6 测试结果

[root@open-source conf]# salt '*' state.highstate

open2:

----------

State: - file

Name: /usr/local/mysql/conf/my.cnf

Function: managed

Result: True

Comment: File /usr/local/mysql/conf/my.cnf updated

Changes: diff: New file

group: mysql

user: mysql

----------

State: - pkg

Name: mysql

Function: installed

Result: True

Comment: The following packages were installed/updated: mysql.

Changes: openssl: { new : 1.0.1e-16.el6_5

old : 1.0.0-27.el6_4.2

}

openssl-devel: { new : 1.0.1e-16.el6_5

old : 1.0.0-27.el6_4.2

}

mysql-libs: { new : 5.1.71-1.el6

old : 5.1.52-1.el6_0.1

}

mysql: { new : 5.1.71-1.el6

old :

}

openssl-perl: { new : 1.0.1e-16.el6_5

old : 1.0.0-27.el6_4.2

}

openssl-static: { new : 1.0.1e-16.el6_5

old : 1.0.0-27.el6_4.2

}

----------

State: - service

Name: mysql

Function: running

Result: False

Comment: The named service mysql is not available

Changes:

Summary

------------

Succeeded: 2

Failed: 1

------------

Total: 3

注：提示3个成功一个失败，mysql服务没启动成功，应该是pack.sls配置文件的错误

[root@open-source conf]# cat pack.sls

mysqld: #这儿是服务名应该是mysqld我上边写的是mysql所以报服务没起来错误

pkg:

- name: mysql #这儿是包名

- installed

service:

- running

- enable: True

[root@open-source conf]# salt '*' state.highstate

open2:

----------

State: - file

Name: /usr/local/mysql/conf/my.cnf

Function: managed

Result: True

Comment: File /usr/local/mysql/conf/my.cnf is in the correct state

Changes:

----------

State: - pkg

Name: mysql

Function: installed

Result: True

Comment: Package mysql is already installed

Changes:

----------

State: - service

Name: mysqld

Function: running

Result: True

Comment: Service mysqld has been enabled, and is in the desired state

Changes: mysqld: True

Summary

------------

Succeeded: 3

Failed: 0

------------

Total: 3

卸载RPM软件包

[root@open-source conf]# cat smb.sls

smb:

pkg:

- name: samba

- removed

运行结果：

[root@open-source conf]# salt '*' state.sls conf.smb

open2:

----------

State: - pkg

Name: samba

Function: removed

Result: True

Comment: All targeted packages were removed.

Changes: samba: { new :

old : 3.6.9-167.el6_5

}

Summary

------------

Succeeded: 1

Failed: 0

------------

Total: 1

其它

altstack通过cp.get_file可以将master文件分发到minion,/software/httpd-2.4.3.tar.bz2表示把文件分发到minion上的文件路径，

makedirs=True表示如果目录不存在自动创建,在传输大文件的时候还支持压缩传输，在传输大文件的时候还支持压缩传输gzip。

[root@salt-server ~]# salt '*' cp.get_file salt://software/httpd-2.4.3.tar.bz2 /usr/src/httpd-2.4.3.tar.bz2 makedirs=True

bt-199-034.bta.net.cn:

/usr/src/httpd-2.4.3.tar.bz2

cp.get_dir和cp.get_file一样，不过get_dir是用来下载整个目录的，也支持压缩传输。

[root@salt-server ~]# salt '*' cp.get_dir salt://software/ /usr/src/ gzip=5

四、用户管理

4.1 添加harry用户

生成密码

[root@open-source ~]# openssl passwd -1 -salt 'harry'

Password:

$1$harry$DDLDUWLoTFUMB0biMDIv..

top.sls文件

[root@open-source salt]# cat top.sls

base:

'*':

- conf.nginx

- conf.mysql

- conf.php

- conf.pack

- conf.software

- user.users

- user.userdel

- user.addsudo

- user.addgroup

- user.delgroup

[root@open-source user]# cat users.sls

harry:

user.present:

- fullname: harry D

- shell: /bin/bash

- password: '$1$harry$DDLDUWLoTFUMB0biMDIv..'

- home: /home/jarry

- uid: 10001

- gid: 10001

- groups:

- root

- harry

- require:

- group: harry

group.present:

- gid: 10001

运行结果

因为有多个.sls文件，如果想单独运行某个的话

salt '*' state.sls xxx

[root@open-source user]# salt '*' state.sls user.users

open2:

----------

State: - group

Name: harry

Function: present

Result: True

Comment: Added group harry

Changes: passwd: x

gid: 10001

members: []

----------

State: - user

Name: harry

Function: present

Result: True

Comment: New user harry created

Changes: shell: /bin/bash

workphone:

uid: 10001

passwd: x

roomnumber:

gid: 10001

groups: ['harry', 'root']

home: /home/jarry

fullname: harry D

password: $1$harry$DDLDUWLoTFUMB0biMDIv..

homephone:

Summary

------------

Succeeded: 2

Failed: 0

------------

Total: 2

4.2 删除用户

[root@open-source user]# cat userdel.sls

harry:

user.absent:

- purge: True #设置清除用户的文件(家目录)

- force: True #如果用户当前已登录，则absent state会失败. 设置force选项为True时，就算用户当前处于登录状态也会删除本用户.

运行结果

[root@open-source user]# salt '*' state.sls user.userdel

open2:

----------

State: - user

Name: harry

Function: absent

Result: True

Comment: Removed user harry

Changes: harry group: removed

harry: removed

Summary

------------

Succeeded: 1

Failed: 0

------------

Total: 1

4.3 添加sudo用户

[root@open-source user]# cat addsudo.sls

harry:

user.present:

- fullname: harry D

- shell: /bin/bash

- password: '$1$harry$DDLDUWLoTFUMB0biMDIv..'

- home: /home/jarry

- uid: 10001

- gid: 10001

- groups:

- root

- harry

- require:

- group: harry

group.present:

- gid: 10001

/etc/sudoers:

file.append:

- text:

- "harry ALL=(ALL) NOPASSWD: ALL"

执行结果

[root@open-source user]# salt '*' state.sls user.addsudo

open2:

----------

State: - group

Name: harry

Function: present

Result: True

Comment: Added group harry

Changes: passwd: x

gid: 10001

members: []

----------

State: - user

Name: harry

Function: present

Result: True

Comment: New user harry created

Changes: shell: /bin/bash

workphone:

uid: 10001

passwd: x

roomnumber:

gid: 10001

groups: ['harry', 'root']

home: /home/jarry

fullname: harry D

password: $1$harry$DDLDUWLoTFUMB0biMDIv..

homephone:

----------

State: - file

Name: /etc/sudoers

Function: append

Result: True

Comment: Appended 1 lines

Changes: diff: ---

+++

@@ -113,3 +113,4 @@

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)

#includedir /etc/sudoers.d

+harry ALL=(ALL) NOPASSWD: ALL

Summary

------------

Succeeded: 3

Failed: 0

------------

Total: 3

4.4 添加组：

[root@open-source user]# cat addgroup.sls

devgroup:

group.present:

- gid: 10002

yunwei:

group.present:

- gid: 1003

运行结果：

[root@open-source user]# salt '*' state.sls user.addgroup

open2:

----------

State: - group

Name: devgroup

Function: present

Result: True

Comment: No change

Changes:

----------

State: - group

Name: yunwei

Function: present

Result: True

Comment: No change

Changes:

Summary

------------

Succeeded: 2

Failed: 0

------------

Total: 2

4.5 删除组

[root@open-source user]# cat delgroup.sls

devgroup:

group.absent

运行结果

[root@open-source user]# salt '*' state.sls user.delgroup

open2:

----------

State: - group

Name: devgroup

Function: absent

Result: True

Comment: Removed group devgroup

Changes: devgroup:

Summary

------------

Succeeded: 1

Failed: 0

------------

Total: 1

转载于:https://blog.51cto.com/leeforget/1343117

你可能感兴趣的文章

MFC中编辑框数字限制范围

查看>>

【BZOJ2705】【SDOI2012】Longge的问题

spring security基本知识(三) 过滤详细说明

查看>>

python with语句上下文管理的两种实现方法

POJ3048 HDU2710 Max Factor

查看>>

KMP算法（C语言版）

查看>>

HDU 5726 GCD 求给定序列中与查询段相等的GCD个数

查看>>

Ionic + Cordova 跨平台移动开发环境配置

查看>>

Fedora 17配置Postgresql自动启动

查看>>

运行 python *.py 文件出错，如：python a.py

查看>>