ICode9

精准搜索请尝试: 精确搜索
首页 > 其他分享> 文章详细

SaltStack进阶

2021-11-30 13:01:27  阅读:143  来源: 互联网

标签:进阶 minion root syndic repo master SaltStack salt


SaltStack进阶

masterless

应用场景

  • master 与 minion 网络不通或通信有延迟,即网络不稳定
  • 想在 minion 端直接执行状态

传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理,但是当网络不稳定的时候,当想在minion本地执行状态的时候,当在只有一台主机的时候,想执行状态该怎么办呢?这就需要用到 masterless 了。

有了masterless,即使你只有一台主机,也能玩saltstack,而不需要你有N台主机架构。

masterless配置

修改配置文件minion

  • 注释master行
  • 取消注释file_client并设其值为local
  • 设置file_roots
  • 设置pillar_roots
[root@minion1 ~]# vim /etc/salt/minion
# Since salt uses detached ids it is possible to run multiple minions on the
# same machine but with different ids, this can be useful for salt compute
# clusters.
# id: minion   \\注释此行

# also be configured on the minion:
pillar_roots:  \\取消注释,设置变量环境
  base:
    - /srv/pillar/base

# Set the file client. The client defaults to looking on the master server for
# files, but can be directed to look at the local file directory setting
# defined below by setting it to "local". Setting a local file_client runs the
# minion in masterless mode.
file_client: local   \\取消注释,并将值设置为local

file_roots:   \\设置file_roots的路径和环境,可有多套环境
  base:
    - /srv/salt

关闭salt-minion服务

使用 masterless 模式时是不需要启动任何服务的,包括salt-master和salt-minion。

[root@minion1 ~]# systemctl stop salt-minion.service 
[root@minion1 ~]# systemctl disable salt-minion.service 
Removed /etc/systemd/system/multi-user.target.wants/salt-minion.service.

salt-call

masterless模式执行模块或状态时需要使用salt-call命令,而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。

[root@minion1 base]# salt-call --local cmd.run 'date'
local:
    Mon Nov 30 12:36:04 EST 2021
    
在minion关闭防火墙
[root@minion base]# cat main.sls 
firewalld.service:
  service.dead:
    - enable: false
    
[root@minion1 base]# salt-call --local state.sls 'main'
local:
----------
          ID: firewalld.service
    Function: service.dead
      Result: True
     Comment: Service firewalld.service has been disabled, and is dead
     Started: 12:36:18.654208
    Duration: 850.803 ms
     Changes:   
              ----------
              firewalld.service:
                  True

Summary for local
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time: 850.803 ms

salt-master高可用

salt-master高可用配置

我们需要用salt来管理公司的所有机器,那么salt的master就不能宕机,否则就会整个瘫痪,所以我们必须要对salt进行高可用。salt的高可用配置非常简单,只需要改一下minion配置文件,将master用列表的形式列出即可。

salt-master高可用之数据同步

涉及到高可用时,数据的同步是个永恒的话题,我们必须保证高可用的2个master间使用的数据是一致的,包括:

  • /etc/salt/master配置文件
  • /etc/salt/pki目录下的所有key
  • /srv/下的salt和pillar目录下的所有文件

保障这些数据同步的方案有:

  • nfs挂载
  • rsync同步
  • 使用gitlab进行版本控制

安全相关:

为保证数据的同步与防止丢失,可将状态文件通过gitlab进行版本控制管理。

salt-syndic分布式架构

salt-syndic架构图

 

salt-syndic的优劣势

优势:

  • 可以通过syndic实现更复杂的salt架构
  • 减轻master的负担

劣势:

  • syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致,所以要进行数据同步,同步方案同salt-master高可用
  • 最顶层的master不知道自己有几个syndic,它只知道自己有多少个minion,并不知道这些minion是由哪些syndic来管理的

salt-syndic部署

安装salt-master与salt-syndic
[root@syndic ~]# ls /etc/yum.repos.d/
CentOS-Base.repo       CentOS-fasttrack.repo  CentOS-Vault.repo
CentOS-CR.repo         CentOS-Media.repo      salt-7.repo
CentOS-Debuginfo.repo  CentOS-Sources.repo
[root@syndic ~]# yum -y install salt-master salt-syndic

配置syndic

修改syndic所在主机的master配置文件

  • 取消注释syndic_master
  • 将syndic_master的值设为master的IP
[root@syndic ~]# vim /etc/salt/master
1082 syndic_master: 192.168.145.188
[root@syndic ~]# systemctl enable --now salt-master
Created symlink from /etc/systemd/system/multi-user.target.wants/salt-master.service to /usr/lib/systemd/system/salt-master.service.
[root@syndic ~]# systemctl enable --now salt-syndic
Created symlink from /etc/systemd/system/multi-user.target.wants/salt-syndic.service to /usr/lib/systemd/system/salt-syndic.service.

配置minion1
[root@minion1 ~]# ls /etc/yum.repos.d/
CentOS-Stream-AppStream.repo         CentOS-Stream-Media.repo
CentOS-Stream-BaseOS.repo            CentOS-Stream-PowerTools.repo
CentOS-Stream-Debuginfo.repo         CentOS-Stream-RealTime.repo
CentOS-Stream-Extras.repo            salt.repo
CentOS-Stream-HighAvailability.repo
[root@minion1 ~]# yum -y install salt-minion
[root@minion1 ~]# vim /etc/salt/minion
 17 master: 192.168.145.196    //syndic主机IP
[root@minion ~]# systemctl enable --now salt-minion
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.
[root@minion1 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
└── minion
    ├── minion.pem
    └── minion.pub

2 directories, 2 files

minion2

[root@minion2 ~]# ls /etc/yum.repos.d/
CentOS-Stream-AppStream.repo         CentOS-Stream-Media.repo
CentOS-Stream-BaseOS.repo            CentOS-Stream-PowerTools.repo
CentOS-Stream-Debuginfo.repo         CentOS-Stream-RealTime.repo
CentOS-Stream-Extras.repo            salt.repo
CentOS-Stream-HighAvailability.repo
[root@minion2 ~]# yum -y install salt-minion
[root@minion2 ~]# vim /etc/salt/minion
 17 master: 192.168.145.196    //syndic主机IP
[root@minion2 ~]# systemctl enable --now salt-minion
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.
[root@minion2 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
└── minion
    ├── minion.pem
    └── minion.pub

2 directories, 2 files

在syndic上接受minion主机的key

minion1
[root@syndic ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
minion1
Rejected Keys:
[root@syndic ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
minion1
Key for minion minion accepted.
[root@syndic ~]# salt-key -L
Accepted Keys:
minion1
Denied Keys:
Unaccepted Keys:
Rejected Keys:

minion2
[root@syndic ~]# salt-key -L
Accepted Keys:
minion1
Denied Keys:
Unaccepted Keys:
minion2
Rejected Keys:
[root@syndic ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
minion2
Key for minion minion accepted.
[root@syndic ~]# salt-key -L
Accepted Keys:
minion1
minion2
Denied Keys:
Unaccepted Keys:
Rejected Keys:

在master上接受syndic主机的key

[root@master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
syndic
Rejected Keys:
[root@master ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
syndic
Key for minion syndic accepted.
[root@master ~]# salt-key -L
Accepted Keys:
syndic
Denied Keys:
Unaccepted Keys:
Rejected Keys:

测试

[root@master ~]# salt '*' test.ping
minion1:
    True
minion2:
    True

[root@syndic ~]# vim /etc/salt/master
file_roots:
  base:
    - /srv/salt/base
pillar_roots:
  base:
   - /srv/pillar/base
[root@syndic ~]# systemctl restart salt-master salt-syndic

[root@master ~]# scp -r /srv/* 192.168.145.188:/srv/
[root@syndic ~]# tree /srv/salt/base/
/srv/salt/base/
└── init
    ├── basepkg
    │   └── main.sls
    ├── chrony
    │   ├── files
    │   │   └── chrony.conf
    │   └── main.sls
    ├── firewall
    │   └── main.sls
    ├── history
    │   └── main.sls
    ├── kernel
    │   ├── files
    │   │   ├── limits.conf
    │   │   └── sysctl.conf
    │   └── main.sls
    ├── main.sls
    ├── salt-minion
    │   ├── files
    │   │   ├── minion
    │   │   └── multi-minion
    │   └── main.sls
    ├── selinux
    │   ├── files
    │   │   └── config
    │   └── main.sls
    ├── timeout
    │   └── main.sls
    └── yum
        ├── files
        │   ├── centos-7.repo
        │   ├── centos-8.repo
        │   ├── epel-7.repo
        │   ├── epel-8.repo
        │   ├── salt-7.repo
        │   └── salt-8.repo
        └── main.sls

15 directories, 22 files

[root@master ~]# salt '*' test.ping
minion1:
    True
minion2:
    True
[root@master ~]# salt 'minion1' state.sls init.history.main
minion1:
----------
          ID: /etc/profile
    Function: file.managed
      Result: True
     Comment: File /etc/profile exists with proper permissions. No changes made.
     Started: 12:50:48.497745
    Duration: 10.238 ms
     Changes:   

Summary for minion
------------
Succeeded: 1
Failed:    0
------------
Total states run:     1
Total run time:  10.238 ms

标签:进阶,minion,root,syndic,repo,master,SaltStack,salt
来源: https://www.cnblogs.com/Aimmi/p/15623704.html

本站声明: 1. iCode9 技术分享网(下文简称本站)提供的所有内容,仅供技术学习、探讨和分享;
2. 关于本站的所有留言、评论、转载及引用,纯属内容发起人的个人观点,与本站观点和立场无关;
3. 关于本站的所有言论和文字,纯属内容发起人的个人观点,与本站观点和立场无关;
4. 本站文章均是网友提供,不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属;如您发现该文章侵犯了您的权益,可联系我们第一时间进行删除;
5. 本站为非盈利性的个人网站,所有内容不会用来进行牟利,也不会利用任何形式的广告来间接获益,纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。

专注分享技术,共同学习,共同进步。侵权联系[81616952@qq.com]

Copyright (C)ICode9.com, All Rights Reserved.

ICode9版权所有