The keys that have been rejected, accepted, and pending acceptance are listed.The easiest way to accept the minion key is to accept all pending keys:
salt-key -A
注解
Keys should be verified! The secure thing to do before accepting a key isto runsalt-key
-f minion-id to print the fingerprint of the minion'spublic key. This fingerprint can then be compared against the fingerprintgenerated on the minion.
On the master:
If they match, approve the key with
salt-key -a foo.domain.com.
测试
现在minion已经连接到master并且通过认证，master可以发送命令到minion。
Salt命令允许执行海量的函数库，并且可以针对特殊的minions和minions组为目标执行。
salt 命令包含命令选项，目标说明，要执行的函数，和函数的参数。
一个简单的入门级命令看起来像是这样:
salt '*' test.ping
* 是指向所有minions的目标。
test.ping 告诉minon运行
test.ping 函数。
In the case of test.ping,
test refers to a execution module. ping refers to theping
function contained in the aforementionedtestmodule.
注解
Execution modules are the workhorses of Salt. They do the work on thesystem to perform various tasks, such as manipulating files and restartingservices.
运行这条命令的结果将会是master指示所有的minions并行执行
test.ping 并返回结果。
这不是真正的ICMP ping，而是一个简单的函数返回 True。使用
test.ping 是确认一个minion是否连接正常的好方法。
注解
每个minion使用唯一的minion ID注册自身，但是也能够通过使用minion配置中的
id 选项来明确定义。
Of course, there are hundreds of other modules that can be called just astest.ping can. For example, the following would return disk usage on alltargeted minions:
注解
一些自定义的Linux和其他发行版的衍生版可能不能被Salt正确检测。如果上述命令返回
pkg.install is not available的错误信息，那么你可能就需要重写pkg provider。这个过程在 这里 有详解。
模块函数`network.interfaces <salt.modules.network.interfaces>` 将会列出minion上的所有接口，以及它们的IP地址，子网掩码，MAC地址等：
salt '*' network.interfaces
Changing the Output Format
The default output format used for most Salt commands is called the
nestedoutputter, but there are several other outputters that can be used to changethe way the output is displayed. For instance, thepprint outputter can beused to display the return data using Python'spprint
module:
The full list of Salt outputters, as well as example output, can be foundhere.
salt-call
The examples so far have described running commands from the Master using thesalt command, but when troubleshooting it can be more beneficial to loginto the minion directly and usesalt-call.
Doing so allows you to see the minion log messages specific to the command youare running (which arenot part of the return data you see when running thecommand from the Master usingsalt), making it unnecessary to
tail theminion log. More information onsalt-call and how to use it can be foundhere.
grains是minion启动时加载的，在运行过程中不会发生变化，所以是静态数据。grains中包含诸如运行的内核版本，操作系统等信息。
Salt使用一个叫做 :doc:`Grains <../targeting/grains>`的系统来建立关于minions的静态数据。这个数据包含了关于操作系统运行状态，CPU架构等信息。grains系统贯穿Salt用于发送平台数据到许多组件和用户。
Grains can also be statically set, this makes it easy to assign values tominions for grouping and managing.
A common practice is to assign grains to minions to specify what the role orroles a minion might be. These static grains can be set in the minionconfiguration file or via thegrains.setvalfunction.
Targeting
Salt allows for minions to be targeted based on a wide range of criteria. Thedefault targeting system uses globular expressions to match minions, hence ifthere are minions namedlarry1,
larry2,curly1, and
curly2, aglob oflarry* will match
larry1 and larry2, and a glob of
*1will match larry1 and
curly1.
除了通配符之外还有许多其他的目标系统可以使用，这些系统包括:
正则表达式
使用PCRE引擎的正则表达式的目标
grains是minion启动时加载的，在运行过程中不会发生变化，所以是静态数据。grains中包含诸如运行的内核版本，操作系统等信息。
基于grains数据的目标: Targeting with Grains
nodegroups:
group1: 'L@foo.domain.com,bar.domain.com,baz.domain.com or bl*.domain.com'
group2: 'G@os:Debian and foo.domain.com'
注解
The L within group1 is matching a list of minions, while theG ingroup2 is matching specific grains. See thecompound
matchers documentation for more details.
通过 -N 参数在命令行指定运行的节点组:
salt -N group1 test.ping
To match a nodegroup in your top file, make sure to put-
match:nodegroup on the line directly following the nodegroup name.
base:
group1:
- match: nodegroup
- webserver
注解
When adding or modifying nodegroups to a master configuration file, the master must be restartedfor those changes to be fully recognized.
A limited amount of functionality, such as targeting with -N from the command-line may beavailable without a restart.
代码如下
复制代码 salt -C 'webserv* and G@os:Debian or E@web-dc1-srv.*' test.ping
当然也可以在预先分组时将这个配置写在分组规则里。在top.sls中可以如下使用:
代码如下
复制代码 base:
'webserv* and G@os:Debian or E@web-dc1-srv.*':
– match: compound
– webserver
Batch Size
The -b (or --batch-size) option allows commands to be executed on onlya specified number of minions at a time. Both percentages and finite numbers aresupported.
salt '*' -b 10 test.ping
salt -G 'os:RedHat' --batch-size 25% apache.signal restart
This will only run test.ping on 10 of the targeted minions at a time and thenrestart apache on 25% of the minions matchingos:RedHat at a time and workthrough them all until the task is complete. This makes jobs like rolling
webserver restarts behind a load balancer or doing maintenance on BSD firewallsusing carp much easier with salt.
The batch system maintains a window of running minions, so, if there are atotal of 150 minions targeted and the batch size is 10, then the command issent to 10 minions, when one minion returns then the command is sent to oneadditional minion, so that the
job is constantly running on 10 minions.
QQ群⑧：
窥视卡
雷达卡
发表于 2015-11-26 11:24:30
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡