3、SaltStack之远程执行
远程执行主要为：目标、模块、返回值执行格式： salt '<target>' <function>
target(目标)
使用通配符
salt '*' test.ping
salt '*.heboan.com' test.ping
salt 'redis-node?-heboan.com' test.ping
使用正则表达式
salt -E 'c.heboan.com' test.ping
使用列表
salt -L 'c1.heboan.com,c2.heboan.com' test.ping
使用grains
salt -G 'os:CentOS' test.ping
使用pillar(要自己定义)
salt -I 'apache:httpd' test.ping
# cd /srv/pillar/
apache.slstop.sls
# cat apache.sls
{% if grains['os'] == 'CentOS' %}
apache: httpd
{% elif grains['os'] == 'Debian' %}
apache: apache2
{% endif %}
# cat top.sls
base:
'*':
- apache
混合方式
salt -C 'G@os:Ubuntu and webser* or E@database.*' test.ping
使用节点组
salt -N 'web' test.ping
//定义组
# vim /etc/salt/master
...
nodegroups:
web: 'L@c2.heboan.com,c3.heboan.com'
...
使用ip方式
salt -S '192.168.88.2' test.ping
salt -S '192.168.88.0/24' test.ping
function 模块
sys.list_modules查看所有模块列表
# salt 'c2.heboan.com' sys.list_modules
c2.heboan.com:
- acl
- aliases
-> - apache
- archive
- artifactory
- blockdev
- btrfs
- buildout
- cloud
- cmd
- composer
- config
- container_resource
- cp
- cron
- data
- defaults
- devmap
- disk
- django
- dnsmasq
- dnsutil
- drbd
- elasticsearch
- environ
- etcd
- event
- extfs
- file
- gem
- genesis
- gnome
- grains
- group
- hashutil
- hg
- hipchat
- hosts
- http
- img
- incron
- ini
- introspect
- ip
- iptables
- jboss7
- jboss7_cli
- key
- keyboard
- kmod
- locale
- locate
- logrotate
- lowpkg
- match
- mine
- modjk
- mount
- network
- openstack_config
- pagerduty
- partition
- pillar
- pip
- pkg
- pkg_resource
- postfix
- publish
- pyenv
- random
- random_org
- rbenv
- ret
- rsync
- runit
- rvm
- s3
- saltutil
- schedule
- scsi
- sdb
- seed
- serverdensity_device
- service
- shadow
- slack
- smtp
- sqlite3
- ssh
- state
- status
- supervisord
- sys
- sysctl
- syslog_ng
- system
- test
- timezone
- user
- vbox_guest
- virtualenv
- webutil
- xfs
sys.doc模块可以很方便的查看相关模块的介绍和用法
//查看service模块的用法
salt 'c2.heboan.com' sys.doc service
普通用户运行模块acl控制
创建一个普通用户heboan
添加权限，否则普通用户无法执行salt命令
chmod 777/var/log/salt/master
编辑master配置文件，配置client_acl
# vim /etc/salt/master
client_acl: //用户heboan只能执行test.ping模块和sys.doc模块
heboan:
- test.ping
- sys.doc
测试
# su - heboan
$ salt '*' test.ping //正常执行
c2.heboan.com:
True
c3.heboan.com:
True
$ salt '*' cmd.run 'w' //没有权限
Failed to authenticate! This is most likely because this user is not permitted
to execute commands, but there is a small possibility that a disk error occurred
(check disk/inode usage).
黑名单设置
//禁止root用户，非sudo用户执行salt
//禁止执行cmd模块
# vim /etc/salt/master
...
client_acl_blacklist:
users:
- root
- '^(?!sudo_).*$' #all non sudo users
modules:
- cmd
...
返回值
执行任务后，任务结果会被每个salt minion返回给salt master。这些结果存储在/var/cache/salt/master/jobs
默认返回值是临时缓存，将被存储24小时。我们可以通过更改master配置文件中的keep_jobs参数来调整时间。单位是小时
keep_jobs: 24
默认的返回值缓存有时可能成为大型部署的负担，我们可以通过更改master配置文件将job_cache设置为false将其禁用,或者设置keep_jobs选项为较小的值，因而减小负担
我们还可以把返回值存储到外部系统中，比如mysql，redis等等，这里演示存储到mysql
创建数据库和表
CREATE DATABASE`salt` DEFAULT CHARACTER SET utf8
DEFAULT COLLATE utf8_general_ci;
USE `salt`;
--
-- Table structure for table `jids`
--
DROP TABLE IF EXISTS `jids`;
CREATE TABLE `jids` (
`jid` varchar(255) NOT NULL,
`load` mediumtext NOT NULL,
UNIQUE KEY `jid` (`jid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE INDEX jid ON jids(jid) USING BTREE;
--
-- Table structure for table `salt_returns`
--
DROP TABLE IF EXISTS `salt_returns`;
CREATE TABLE `salt_returns` (
`fun` varchar(50) NOT NULL,
`jid` varchar(255) NOT NULL,
`return` mediumtext NOT NULL,
`id` varchar(255) NOT NULL,
`success` varchar(10) NOT NULL,
`full_ret` mediumtext NOT NULL,
`alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
KEY `id` (`id`),
KEY `jid` (`jid`),
KEY `fun` (`fun`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
--
-- Table structure for table `salt_events`
--
DROP TABLE IF EXISTS `salt_events`;
CREATE TABLE `salt_events` (
`id` BIGINT NOT NULL AUTO_INCREMENT,
`tag` varchar(255) NOT NULL,
`data` mediumtext NOT NULL,
`alter_time` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
`master_id` varchar(255) NOT NULL,
PRIMARY KEY (`id`),
KEY `tag` (`tag`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
创建数据库授权账号
grant all privileges on salt.* to 'salt'@'192.168.88.%'>
flush privileges;
安装mysql驱动模块
yum install gcc gcc-c++
yum install python-devel
yum install -y mysql-devel
pip install mysql-python
修改salt master配置文件，末尾添加如下配置
# vim /etc/salt/master #return: mysql
master_job_cache: mysql
mysql.host: '192.168.88.1'
mysql.user: 'salt'
mysql.pass: 'salt'
mysql.db: 'salt'
mysql.port: 3306
# systemctl restart salt-master
测试执行，看看返回结果是否记录到数据库
# salt 'c2.heboan.com' cmd.run 'uptime' --return mysql
c2.heboan.com:
15:26:03 up 1 day,1:03,1 user,load average: 0.00, 0.01, 0.05
查看数据库结果，发现已经存入到数据库了
https://images2017.cnblogs.com/blog/861231/201711/861231-20171116153148624-845255041.png
页:
[1]