saltstack初步学习
注：本文同学看一些牛人博客及saltstack社区总结的，感谢牛人们的分享，像开源致敬通过实验测试总结saltstack所实现的功能
1.安装软件包
2.文件分发
3.添加删除用户，组并将用户加入sudo
4.执行系统命令
还有很多功能没有测试
一、saltstack 安装配置
一般测试注意selinux和iptables，最好是关闭selinux 开启iptables但开放相应端口
1.1 环境
centos 6.2 192.168.101.77 salt-master
centos 6.2 192.168.101.88 salt-minion
1.2 Master 安装配置
rpm -ivh http://mirrors.ustc.edu.cn/fedora/epel//6/x86_64/epel-release-6-8.noarch.rpm
yum -y install salt-master
master配置文件简单
# cat /etc/salt/master |grep -v "#"|grep -v "^$"
interface: 192.168.101.77 #监听地址
publish_port: 4505
ret_port: 4506
pidfile: /var/run/salt-master.pid#
file_roots:
base:
- /srv/salt/
pillar_roots:
base:
- /srv/pillar
nodegroups: #可以根据mimion不同分组管理
group1: 'L@foo.domain.com,bar.domain.com,baz.domain.com and bl*.domain.com'
group2: 'G@os:Debian and foo.domain.com'
添加iptables
# iptables -I INPUT -p tcp --dport 4505 -j ACCEPT
# iptables -I INPUT -p tcp --dport 4506 -j ACCEPT
启动mater
# /etc/init.d/salt-master restart
1.3 client 安装配置
rpm -ivh http://mirrors.ustc.edu.cn/fedora/epel//6/x86_64/epel-release-6-8.noarch.rpm
yum -y install salt-minion
# vim /etc/salt/minion
master: 192.168.101.77
# /etc/init.d/salt-minion start #启动
Starting salt-minion daemon:
# tail -f /var/log/salt/minion#查看日志
1.4 server 端查看连接过来的key
# salt-key list
Accepted Keys:
Unaccepted Keys:
open2 #可以看到连接过来的客户端
Rejected Keys:
1.5 接收客户端key
# salt-key -a open2
The following keys are going to be accepted:
Unaccepted Keys:
open2
Proceed? Y
Key for minion open2 accepted.
1.6 客户端key存放位置
# ls /etc/salt/pki/master/minions
open2
1.7 下面是几个测试命令
# salt '*' cmd.run "hostname"
open2:
open2
# salt '*' test.ping
open2:
True
# salt '*' disk.usage
二、 salt 常用命令
-E 后面正则表达式
# salt -E 'open*' test.ping
open2:
True
不带-E 后面可以带shell正则
# salt 'open*' cmd.run 'uname -a'
-L 后面可以跟多个客户端
# salt -L 'open1,open2,open3' cmd.run 'uname -a'
-N 后面可以按组分
-L 列出客户端
# salt-key -L
Accepted Keys:
open2
Unaccepted Keys:
Rejected Keys:
cmd.run 一个很强大的命令，可以远程执行shell命令
例如：远程简历用户
# salt -E 'open2' cmd.run 'useradd testuser'
grain 责采集客户端一些基本信息
minion基本信息管理
salt '*' grains.ls查看grains分类
salt '*' grains.items 查看grains所有信息
salt '*' grains.item osrelease 查看grains某个信息
pillar
# mkdir /srv/pillar/
# cat top.sls
base:
'*':
- data
# cat data.sls
info: some data
# salt '*' pillar.data
三、 salt-stack安装rpm包及文件分发
例如安装LNMP并分发配置文件到各个minion
3.1 目录组织结构
# tree
.
├── conf
│?? ├── mysql.sls
│?? ├── nginx.sls
│?? ├── pack.sls
│?? ├── php.sls
│?? └── software.sls
├── mysql
│?? └── my.cnf
├── nginx
│?? └── nginx.conf
├── php
│?? └── php.ini
├── software
│?? ├── mysql-5.6.14.tar.gz
│?? ├── nginx-1.5.6.tar.gz
│?? └── php-5.5.5.tar.gz
└── top.sls
3.2 建立所需目录，前期准备
# cd /srv/salt/
# mkdir -p {conf,nginx,php,mysql,software}
# cp -p /usr/local/mysql/my.cnf mysql/
# cp -p /usr/local/app/nginx/conf/nginx.conf nginx/
# cp -p /usr/local/php/etc/php.ini php/
# cd software/
# cp -p /usr/src/php-5.5.5.tar.gz .
# cp -p /usr/src/nginx-1.5.6.tar.gz .
# cp -p /usr/src/mysql-5.6.14.tar.gz .
# cd ../conf/
# touch nginx.sls mysql.sls php.sls pack.sls software.sls
3.3 入口文件top配置
在/srv/salt目录下面新建top.sls文件，该文件是Saltstack入口配置文件。
Saltstack "top.sls"文件开头一般用base:书写，通配符'*'表示所有的minion，
-conf.pack表示conf目录下面的pack.sls文件，在这里我定义的是RPM软件包管理。
# vim top.sls
base:
'*':
- conf.nginx
- conf.mysql
- conf.php
- conf.pack
- conf.software
3.4 安装mysql rpm包
创建软件包管理的配置文件pack.sls 文件，httpd表示要安装软件包，pkg:表示Saltstack安装包管理，
-name表示安装软件包名称，-installed表示安装，-removed表示卸载，service:表示Saltstack服务管理，
后两行保证mysql的服务是开启的。
# cat pack.sls
mysql:
pkg:
- name: mysql
- installed
service:
- running
- enable: True
3.5 推送my.cnf文件
创建Nginx sls配置文件nginx.sls ,第一行表示分发到minion文件路径，-managed表示Saltstack文件管理，
-source:表示master端配置文件地址，是从master配置文件定义的路径/srv/salt开始查找的，下面三行表示文件的属性。
# cat mysql.sls
/usr/local/mysql/conf/my.cnf:
file:
- managed
- source: salt://mysql/my.cnf
- user: mysql
- group: mysql
- mode: 644
- backup: minion
3.6 测试结果
# salt '*' state.highstate
open2:
----------
State: - file
Name: /usr/local/mysql/conf/my.cnf
Function:managed
Result: True
Comment: File /usr/local/mysql/conf/my.cnf updated
Changes: diff: New file
group: mysql
user: mysql
----------
State: - pkg
Name: mysql
Function:installed
Result: True
Comment: The following packages were installed/updated: mysql.
Changes: openssl: { new : 1.0.1e-16.el6_5
old : 1.0.0-27.el6_4.2
}
openssl-devel: { new : 1.0.1e-16.el6_5
old : 1.0.0-27.el6_4.2
}
mysql-libs: { new : 5.1.71-1.el6
old : 5.1.52-1.el6_0.1
}
mysql: { new : 5.1.71-1.el6
old :
}
openssl-perl: { new : 1.0.1e-16.el6_5
old : 1.0.0-27.el6_4.2
}
openssl-static: { new : 1.0.1e-16.el6_5
old : 1.0.0-27.el6_4.2
}
----------
State: - service
Name: mysql
Function:running
Result: False
Comment: The named service mysql is not available
Changes:
Summary
------------
Succeeded: 2
Failed: 1
------------
Total: 3
注：提示3个成功一个失败，mysql服务没启动成功，应该是pack.sls配置文件的错误
# cat pack.sls
mysqld: #这儿是服务名应该是mysqld我上边写的是mysql所以报服务没起来错误
pkg:
- name: mysql #这儿是包名
- installed
service:
- running
- enable: True
# salt '*' state.highstate
open2:
----------
State: - file
Name: /usr/local/mysql/conf/my.cnf
Function:managed
Result: True
Comment: File /usr/local/mysql/conf/my.cnf is in the correct state
Changes:
----------
State: - pkg
Name: mysql
Function:installed
Result: True
Comment: Package mysql is already installed
Changes:
----------
State: - service
Name: mysqld
Function:running
Result: True
Comment: Service mysqld has been enabled, and is in the desired state
Changes: mysqld: True
Summary
------------
Succeeded: 3
Failed: 0
------------
Total: 3
卸载RPM软件包
# cat smb.sls
smb:
pkg:
- name: samba
- removed
运行结果：
# salt '*' state.sls conf.smb
open2:
----------
State: - pkg
Name: samba
Function:removed
Result: True
Comment: All targeted packages were removed.
Changes: samba: { new :
old : 3.6.9-167.el6_5
}
Summary
------------
Succeeded: 1
Failed: 0
------------
Total: 1
其它
altstack通过cp.get_file可以将master文件分发到minion,/software/httpd-2.4.3.tar.bz2表示把文件分发到minion上的文件路径，
makedirs=True表示如果目录不存在自动创建,在传输大文件的时候还支持压缩传输，在传输大文件的时候还支持压缩传输gzip。
# salt '*' cp.get_file salt://software/httpd-2.4.3.tar.bz2 /usr/src/httpd-2.4.3.tar.bz2 makedirs=True
bt-199-034.bta.net.cn:
/usr/src/httpd-2.4.3.tar.bz2
cp.get_dir和cp.get_file一样，不过get_dir是用来下载整个目录的，也支持压缩传输。
# salt '*' cp.get_dir salt://software/ /usr/src/ gzip=5
四、用户管理
4.1 添加harry用户
生成密码
# openssl passwd -1 -salt 'harry'
Password:
$1$harry$DDLDUWLoTFUMB0biMDIv..
top.sls文件
# cat top.sls
base:
'*':
- conf.nginx
- conf.mysql
- conf.php
- conf.pack
- conf.software
- user.users
- user.userdel
- user.addsudo
- user.addgroup
- user.delgroup
# cat users.sls
harry:
user.present:
- fullname: harry D
- shell: /bin/bash
- password: '$1$harry$DDLDUWLoTFUMB0biMDIv..'
- home: /home/jarry
- uid: 10001
- gid: 10001
- groups:
- root
- harry
- require:
- group: harry
group.present:
- gid: 10001
运行结果
因为有多个.sls文件，如果想单独运行某个的话
salt '*' state.sls xxx
# salt '*' state.sls user.users
open2:
----------
State: - group
Name: harry
Function:present
Result: True
Comment: Added group harry
Changes: passwd: x
gid: 10001
name: harry
members: []
----------
State: - user
Name: harry
Function:present
Result: True
Comment: New user harry created
Changes: shell: /bin/bash
workphone:
uid: 10001
passwd: x
roomnumber:
gid: 10001
groups: ['harry', 'root']
home: /home/jarry
fullname: harry D
password: $1$harry$DDLDUWLoTFUMB0biMDIv..
homephone:
name: harry
Summary
------------
Succeeded: 2
Failed: 0
------------
Total: 2
4.2 删除用户
# cat userdel.sls
harry:
user.absent:
- purge: True#设置清除用户的文件(家目录)
- force: True#如果用户当前已登录，则absent state会失败. 设置force选项为True时，就算用户当前处于登录状态也会删除本用户.
运行结果
# salt '*' state.sls user.userdel
open2:
----------
State: - user
Name: harry
Function:absent
Result: True
Comment: Removed user harry
Changes: harry group: removed
harry: removed
Summary
------------
Succeeded: 1
Failed: 0
------------
Total: 1
4.3 添加sudo用户
# cataddsudo.sls
harry:
user.present:
- fullname: harry D
- shell: /bin/bash
- password: '$1$harry$DDLDUWLoTFUMB0biMDIv..'
- home: /home/jarry
- uid: 10001
- gid: 10001
- groups:
- root
- harry
- require:
- group: harry
group.present:
- gid: 10001
/etc/sudoers:
file.append:
- text:
- "harry ALL=(ALL) NOPASSWD: ALL"
执行结果
# salt '*' state.sls user.addsudo
open2:
----------
State: - group
Name: harry
Function:present
Result: True
Comment: Added group harry
Changes: passwd: x
gid: 10001
name: harry
members: []
----------
State: - user
Name: harry
Function:present
Result: True
Comment: New user harry created
Changes: shell: /bin/bash
workphone:
uid: 10001
passwd: x
roomnumber:
gid: 10001
groups: ['harry', 'root']
home: /home/jarry
fullname: harry D
password: $1$harry$DDLDUWLoTFUMB0biMDIv..
homephone:
name: harry
----------
State: - file
Name: /etc/sudoers
Function:append
Result: True
Comment: Appended 1 lines
Changes: diff: ---
+++
@@ -113,3 +113,4 @@
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
+harry ALL=(ALL) NOPASSWD: ALL
Summary
------------
Succeeded: 3
Failed: 0
------------
Total: 3
4.4 添加组：
# cat addgroup.sls
devgroup:
group.present:
- gid: 10002
yunwei:
group.present:
- gid: 1003
运行结果：
# salt '*' state.sls user.addgroup
open2:
----------
State: - group
Name: devgroup
Function:present
Result: True
Comment: No change
Changes:
----------
State: - group
Name: yunwei
Function:present
Result: True
Comment: No change
Changes:
Summary
------------
Succeeded: 2
Failed: 0
------------
Total: 2
4.5 删除组
# cat delgroup.sls
devgroup:
group.absent
运行结果
# salt '*' state.sls user.delgroup
open2:
----------
State: - group
Name: devgroup
Function:absent
Result: True
Comment: Removed group devgroup
Changes: devgroup:
Summary
------------
Succeeded: 1
Failed: 0
------------
Total: 1
页:
[1]