SaltStack學(xué)習(xí)筆記

saltstack

簡(jiǎn)介

名字來(lái)源于鹽湖城
使用python語(yǔ)言開(kāi)發(fā)

運(yùn)行方式：

local
master/minion
salt ssh

功能：

遠(yuǎn)程執(zhí)行
配置管理
云管理

實(shí)戰(zhàn)

環(huán)境：

一臺(tái)master，兩臺(tái)minion
CentOS 6
配置好epel源

安裝

yum 安裝

yum install salt-master salt-minion -y 
yum install salt-minion -y

chkconfig salt-master on
chkconfig salt-minion on

/etc/init.d/salt-master start

修改minion配置文件 master 和 id

/etc/init.d/salt-minion start

秘鑰認(rèn)證

# 通過(guò)pki秘鑰認(rèn)證锅锨，啟動(dòng)時(shí)生成：
/etc/salt/pki/{master,minion}
# salt-key來(lái)管理秘鑰叽赊，支持通配符
salt-key -a '*'# 同意秘鑰

salt-key -h

遠(yuǎn)程管理實(shí)例：

salt '*' test.ping
salt '*' cmd.run 'uptime'

# 安裝apache
## master 配置文件(不能用tab)
file_roots：
  base:
    - /srv/salt
    
mkdir /srv/salt && /srv/salt
vim apache.sls
apache-install:
  pkg.installed:
    - names:
      - httpd
      - httpd-devel

apache-service:
  service.running:
    - name: httpd
    - enable: True
    - reload: True

salt '*' state.sls apache

## 入口狀態(tài)文件，top.sls
base：
  '*':
    - apache
    
salt '*' state.highstate

salt-call -version

saltstack數(shù)據(jù)系統(tǒng)

Grains
Pillar

image.png

Grains

minion端

salt 'linux-node1' grains.ls
salt 'linux-node1' grains.items
salt 'linux-node1' grains.item fqdn
salt 'linux-node1' grains.get fqdn
salt 'linux-node1' grains.get ip_interfaces:eth0
salt -G os:CentOS cmd.run 'w'

vi /etc/salt/minion 自定義grains必搞，重啟minion服務(wù)生效
salt -G 'roles:memcache' cmd.run 'echo hehe'

vi /etc/salt/grains
web: nginx
salt -G 'web: nginx' cmd.run 'echo hehe'

vi /salt/salt/top.sls
base:
  'web: nginx'
    - match: grain
    - apache

Pillar

給minion指定想要的數(shù)據(jù)
salt '*' pillar.items # 默認(rèn)是關(guān)閉的

開(kāi)啟pillar

vi /etc/salt/master
pillar_opts: True # /etc/init.d/salt-master restart

定義pillar配置文件

vi /etc/salt/master
pillar_roots:
  base:
    - /srv/pillar

pillar也有top file

mkdir /srv/pillar
vi /srv/pillar/apache.sls
{% if grains['os'] == 'CentOS' %}
apache: httpd
{% if grains['os'] == 'CentOS' %}
apache: apache2
{% endif %}

指定哪些minion可見(jiàn)

vi /srv/pillar/top.sls
base:
  '*':
    - apache
    
salt '*' pillar.items

salt '*' saltutil.refresh_pillar # 刷新后才能使用
salt -I 'apache:httpd' test.ping

遠(yuǎn)程執(zhí)行

https://docs.saltstack.com/en/latest/
https://docs.saltstack.com/en/latest/topics/execution/index.html

配置管理

基于遠(yuǎn)程執(zhí)行
https://docs.saltstack.com/en/latest/topics/states/index.html

使用的yaml語(yǔ)法：
冒號(hào)和兩個(gè)空格層級(jí)關(guān)系
短橫線(xiàn)代表列表必指，短橫線(xiàn)后面有一個(gè)空格

jinjia2 模板：
標(biāo)識(shí)狀態(tài)：
-template：jinjia
變量：

defaults：
DNS_SERVER: 10.0.0.2
{{}}標(biāo)識(shí)標(biāo)量：
nameserver {{DNS_SERVER}}
{{ grains['fqdn_ip4'] }}

文件管理:

/etc/resolve.conf:
  file.managed:
    - source: salt://files/resolve.conf
    - user: root
    - group: root
    - mode: 644

案例：

image.png

思路：

系統(tǒng)初始化
功能模塊
業(yè)務(wù)模塊

狀態(tài)模塊：
onlyif：返回ture時(shí)執(zhí)行
unless：返回false執(zhí)行
require：依賴(lài)某個(gè)狀態(tài)
watch：關(guān)注某個(gè)狀態(tài)

saltstack是并行的，ansible是串行的

配置基礎(chǔ)環(huán)境恕洲，執(zhí)行slat '*' state.highstate test=True測(cè)試

# grep -Ev "^$|^#" /etc/salt/master
file_roots:
  base:
    - /srv/salt/base
  dev:
    - /srv/salt/dev
  prod:
    - /srv/salt/prod
# service salt-master restart

#mkdir /srv/salt/base
#cd /srv/salt/base/
#mkdir files init

#cat init/dns.sls 
/etc/resolv.conf:
  file.managed:
    - source: salt://init/files/resolv.conf
    - user: root
    - group: root
    - mode: 644

#cp /etc/resolv.conf files/

#cat init/history.sls 
/etc/profile:
  file.append:
    - text:
      - export HISTTIMEFORMAT="%F %T `whoami`"

#cat init/audit.sls 
/etc/bashrc:
  file.append:
    - text:
      - export PROMPT_COMMAND='{ msg=$(history 1|{ read x y; echo $y; });logger "[euid=$(whoami)]":$(who am i):[`pwd`]"$msg";}'

# cat init/sysctl.sls 
vm.swappiness:
  sysctl.present:
    - value: 0

net.ipv4.ip_local_port_range:
  sysctl.present:
    - value: 10000 65000

fs.file-max:
  sysctl.present:
    - value: 100000

#cat init/env_init.sls
include:
  - init.dns
  - init.history
  - init.audit
  - init.sysctl

# cat top.sls 
base:
  '*':
    - init.env_init

# tree
.
├── files
│   └── resolv.conf
├── init
│   ├── audit.sls
│   ├── dns.sls
│   ├── env_init.sls
│   ├── history.sls
│   └── sysctl.sls
└── top.sls

編譯基礎(chǔ)環(huán)境

# mkdir -p /srv/salt/prod/pkg

# cd /srv/salt/prod/
# cat pkg/pkg-init.sls 
pkg-init:
  pkg.installed:
    - names:
      - gcc
      - gcc-c++
      - glibc
      - make
      - autoconf
      - openssl
      - openssl-devel

haproxy 模塊,執(zhí)行salt 'linux-node1' state.sls haproxy.install env=prod test=True 測(cè)試

# mkdir -p /srv/salt/prod/haproxy{,/files}
# tree /srv/salt/prod/
/srv/salt/prod/
├── haproxy
│   └── files
└── pkg

# curl -o haproxy/files/haproxy-1.6.2.tar.gz http://www.haproxy.org/download/1.6/src/haproxy-1.6.2.tar.gz
# cd /srv/salt/prod/haproxy/
# cat install.sls 
include:
  - pkg.pkg-init

haproxy-install:
  file.managed:
    - name: /usr/local/src/haproxy-1.6.2.tar.gz
    - source: salt://haproxy/files/haproxy-1.6.2.tar.gz
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - name:  tar zxf /usr/local/src/haproxy-1.6.2.tar.gz && cd /usr/local/src/haproxy-1.6.2 && make TARGET=linux26 PREFIX=/usr/local/haproxy && make install PREFIX=/usr/local/haproxy
    - unless: test -d /usr/local/haproxy
    - require:
      - pkg: pkg-init
      - file: haproxy-install

net.ipv4.ip_nonlocal_bind:
  sysctl.present:
    - value: 1

haproxy-config-dir:
  file.directory:
    - name: /etc/haproxy
    - user: root
    - group: root
    - mode: 755

haproxy-init:
  file.managed:
    - name: /etc/init.d/haproxy
    - source: salt://haproxy/files/haproxy.init
    - user: root
    - group: root
    - mode: 755
    - require:
      - cmd: haproxy-install
  cmd.run:
    - name: chkconfig --add haproxy
    - unless: chkconfig --list | grep haproxy
    - require:
      - file: haproxy-init 
      - cmd: haproxy-install

創(chuàng)建集群配置文件

# mkdir -p /srv/salt/prod/cluster{,/files}
# cat haproxy-outside.sls
include:
 - haproxy.install

haproxy-service:
  file.managed:
    - name: /etc/haproxy/haproxy.cfg
    - source: salt://cluster/files/haproxy-outside.cfg
    - user: root
    - group: root
    - mode: 644
  service.running:
    - name: haproxy
    - enable: True
    - reload: True
    - require:
      - cmd: haproxy-init
    - watch:
      - file: haproxy-service

# cat /srv/salt/base/top.sls 
base:
  '*':
    - init.env_init

prod:
  '*':
    - cluster.haproxy-outside

keepalive安裝

# curl -o /usr/local/src/keepalived-1.2.19.tar.gz http://www.keepalived.org/software/keepalived-1.2.19.tar.gz
# mkdir keepalived
# mkdir keepalived/files

# cat keepalived/install.sls
include:
  - pkg.pkg-init

keepalived-install:
  file.manage:
    - name: /usr/local/src/keepalived-1.2.19.tar.gz
    - source: salt://keepalived/files/keepalived-1.2.19.tar.gz
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - mame: tar xzf /usr/local/src/keepalived-1.2.19.tar.gz && cd /usr/local/src/keepalived-1.2.19 && ./configure --prefix=/usr/local/keepalived --disable-fwmark && make && make install
    - unless: test -d /usr/local/keepalived
    - require:
      - pkg: pkg-init
      - file: keepalived-install

keepalived-init:
  file.managed:
    - name: /etc/init.d/keeplived
    - source: salt://keepalived/files/keepalived.init
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - name: chkconfig --add keepalived
    - unless: chkconfig --list | grep keepalived
    - require:
      - file: keepalived-init

/etc/sysconfig/keepalived:
  file.manage:
    - source: salt://keepalived/files/keepalived.sysconfig
    - user: root
    - group: root
    - mode: 644

/etc/keepalived:
  file.directory:
    - user: root
    - group: root
    - mode: 755

keepalived 業(yè)務(wù)引用

# cat cluster/haproxy-outside-keepalived.sls
include:
  - keepalived.install

keepalived-service:
  file.managed:
    - name: /etc/keepalived/keepalived.conf
    - user: root
    - group: root
    - mode: 644
    - template: jinjia
    {% if grains['fqdn'] == 'linux-node1' %}
    - ROUTEID: haproxy_ha
    - STATEID: MASTER
    - PRIORITYID: 150
    {% elif grains['fqdn'] == 'linux-node2' %}
    - ROUTEID: haproxy_ha
    - STATEID: BACKUP
    - PRIORITYID: 100
    {% endif %}
  service.running:
    - name: keepalived
    - enable: True
    - watch:
      - file: keepalived-service

# cat ../base/top.sls 
base:
  '*':
    - init.env_init

prod:
  '*':
    - cluster.haproxy-outside
    - cluster.haproxu-outside-keepalived

zabbix.sls

# pwd
/srv/salt/base

# cat zabbix_agent.sls
zabbix-agent-install:
  pkg.installed:
    - name: zabbix-agent
  file.managed:
    - name: /etc/zabbix/zabbix_agentd.conf
    - source: salt://init/files/zabbix_agentd.conf
    - template: jinjia
    - defaults:
      Server: {{ pillar['zabbix-agent']['Zabbix_Server'] }}
    - require:
      - pkg: zabbix-agent-install
  service.running:
    - name: zabbix-agent
    - enable: True
    - watch:
      - pkg: zabbix-agent-install
      - file: zabbix-agent-install

# grep -Ev "^$|^#" /etc/salt/master 
file_roots:
  base:
    - /srv/salt/base
  dev:
    - /srv/salt/dev
  prod:
    - /srv/salt/prod
pillar_roots:
  base:
    - /srv/pillar/base

# mkdir -p /srv/pillar/base
# cd /srv/pillar/base

# vi zabbix.sls
# cat top.sls 
base:
  '*':
    - zabbix
[root@linux-node1 base]# cat zabbix.sls 
zabbix-agent:
  Zabbix_Server: 10.0.0.7

未完成：

使用saltstack完成nginx+php Memcached的自動(dòng)化安裝和配置

https://github.com/unixhot/saltbook-code
底層基于zeroMQ 監(jiān)聽(tīng)端口：4505 4506
minion和master保持長(zhǎng)連接狀態(tài)

加etcd實(shí)現(xiàn)自動(dòng)化擴(kuò)容

基于etcd_pilar 模塊

最后編輯于：2017.12.09 20:20:38

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者

人面猴
序言：七十年代末塔橡，一起剝皮案震驚了整個(gè)濱河市，隨后出現(xiàn)的幾起案子研侣，更是在濱河造成了極大的恐慌谱邪，老刑警劉巖，帶你破解...
沈念sama閱讀 218,036評(píng)論 6贊 506
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件庶诡，死亡現(xiàn)場(chǎng)離奇詭異惦银，居然都是意外死亡，警方通過(guò)查閱死者的電腦和手機(jī)，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 93,046評(píng)論 3贊 395
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門(mén)扯俱，熙熙樓的掌柜王于貴愁眉苦臉地迎上來(lái)书蚪，“玉大人，你說(shuō)我怎么就攤上這事迅栅∈庑＃” “怎么了？”我有些...
開(kāi)封第一講書(shū)人閱讀 164,411評(píng)論 0贊 354
道士緝兇錄：失蹤的賣(mài)姜人
文/不壞的土叔我叫張陵读存，是天一觀的道長(zhǎng)为流。經(jīng)常有香客問(wèn)我，道長(zhǎng)让簿，這世上最難降的妖魔是什么敬察？我笑而不...
開(kāi)封第一講書(shū)人閱讀 58,622評(píng)論 1贊 293
?港島之戀（遺憾婚禮）
正文為了忘掉前任，我火速辦了婚禮尔当，結(jié)果婚禮上莲祸，老公的妹妹穿的比我還像新娘。我一直安慰自己椭迎，他們只是感情好锐帜，可當(dāng)我...
茶點(diǎn)故事閱讀 67,661評(píng)論 6贊 392
惡毒庶女頂嫁案：這布局不是一般人想出來(lái)的
文/花漫我一把揭開(kāi)白布。她就那樣靜靜地躺著畜号，像睡著了一般缴阎。火紅的嫁衣襯著肌膚如雪。梳的紋絲不亂的頭發(fā)上简软，一...
開(kāi)封第一講書(shū)人閱讀 51,521評(píng)論 1贊 304
城市分裂傳說(shuō)
那天药蜻，我揣著相機(jī)與錄音，去河邊找鬼替饿。笑死，一個(gè)胖子當(dāng)著我的面吹牛贸典，可吹牛的內(nèi)容都是我干的视卢。我是一名探鬼主播，決...
沈念sama閱讀 40,288評(píng)論 3贊 418
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開(kāi)眼廊驼，長(zhǎng)吁一口氣：“原來(lái)是場(chǎng)噩夢(mèng)啊……” “哼据过！你這毒婦竟也來(lái)了？” 一聲冷哼從身側(cè)響起妒挎，我...
開(kāi)封第一講書(shū)人閱讀 39,200評(píng)論 0贊 276
萬(wàn)榮殺人案實(shí)錄
序言：老撾萬(wàn)榮一對(duì)情侶失蹤绳锅，失蹤者是張志新（化名）和其女友劉穎，沒(méi)想到半個(gè)月后酝掩，有當(dāng)?shù)厝嗽跇?shù)林里發(fā)現(xiàn)了一具尸體鳞芙，經(jīng)...
沈念sama閱讀 45,644評(píng)論 1贊 314
?護(hù)林員之死
正文獨(dú)居荒郊野嶺守林人離奇死亡，尸身上長(zhǎng)有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點(diǎn)故事閱讀 37,837評(píng)論 3贊 336
?白月光啟示錄
正文我和宋清朗相戀三年，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了原朝。大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片驯嘱。...
茶點(diǎn)故事閱讀 39,953評(píng)論 1贊 348
活死人
序言：一個(gè)原本活蹦亂跳的男人離奇死亡，死狀恐怖喳坠，靈堂內(nèi)的尸體忽然破棺而出鞠评，到底是詐尸還是另有隱情，我是刑警寧澤壕鹉，帶...
沈念sama閱讀 35,673評(píng)論 5贊 346
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布剃幌，位于F島的核電站，受9級(jí)特大地震影響晾浴，放射性物質(zhì)發(fā)生泄漏负乡。R本人自食惡果不足惜，卻給世界環(huán)境...
茶點(diǎn)故事閱讀 41,281評(píng)論 3贊 329
男人毒藥：我在死后第九天來(lái)索命
文/蒙蒙一怠肋、第九天我趴在偏房一處隱蔽的房頂上張望敬鬓。院中可真熱鬧，春花似錦笙各、人聲如沸钉答。這莊子的主人今日做“春日...
開(kāi)封第一講書(shū)人閱讀 31,889評(píng)論 0贊 22
一樁弒父案杈抢，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽(yáng)数尿。三九已至，卻和暖如春惶楼，著一層夾襖步出監(jiān)牢的瞬間右蹦，已是汗流浹背。一陣腳步聲響...
開(kāi)封第一講書(shū)人閱讀 33,011評(píng)論 1贊 269
情欲美人皮
我被黑心中介騙來(lái)泰國(guó)打工歼捐，沒(méi)想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留何陆，地道東北人。一個(gè)月前我還...
沈念sama閱讀 48,119評(píng)論 3贊 370
代替公主和親
正文我出身青樓豹储，卻偏偏與公主長(zhǎng)得像贷盲，于是被迫代替她去往敵國(guó)和親。傳聞我的和親對(duì)象是個(gè)殘疾皇子剥扣，可洞房花燭夜當(dāng)晚...
茶點(diǎn)故事閱讀 44,901評(píng)論 2贊 355