SaltStack进阶
masterless
应用场景
- master 与 minion 网络不通或通信有延迟，即网络不稳定
- 想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到 masterless 了。
有了masterless，即使你只有一台主机，也能玩saltstack，而不需要你有N台主机架构。
masterless配置
修改配置文件minion
- 注释master行
- 取消注释file_client并设其值为local
- 设置file_roots
- 设置pillar_roots
[root@minion1 ~]# vim /etc/salt/minion
# Since salt uses detached ids it is possible to run multiple minions on the
# same machine but with different ids, this can be useful for salt compute
# clusters.
# id: minion \\注释此行
# also be configured on the minion:
pillar_roots: \\取消注释，设置变量环境
base:
- /srv/pillar/base
# Set the file client. The client defaults to looking on the master server for
# files, but can be directed to look at the local file directory setting
# defined below by setting it to "local". Setting a local file_client runs the
# minion in masterless mode.
file_client: local \\取消注释，并将值设置为local
file_roots: \\设置file_roots的路径和环境，可有多套环境
base:
- /srv/salt
关闭salt-minion服务
使用 masterless 模式时是不需要启动任何服务的，包括salt-master和salt-minion。
[root@minion1 ~]# systemctl stop salt-minion.service
[root@minion1 ~]# systemctl disable salt-minion.service
Removed /etc/systemd/system/multi-user.target.wants/salt-minion.service.
salt-call
masterless模式执行模块或状态时需要使用salt-call命令，而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。
[root@minion1 base]# salt-call --local cmd.run 'date'
local:
Mon Nov 30 12:36:04 EST 2021
在minion关闭防火墙
[root@minion base]# cat main.sls
firewalld.service:
service.dead:
- enable: false
[root@minion1 base]# salt-call --local state.sls 'main'
local:
----------
ID: firewalld.service
Function: service.dead
Result: True
Comment: Service firewalld.service has been disabled, and is dead
Started: 12:36:18.654208
Duration: 850.803 ms
Changes:
----------
firewalld.service:
True
Summary for local
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 850.803 ms
salt-master高可用
salt-master高可用配置
我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。salt的高可用配置非常简单，只需要改一下minion配置文件，将master用列表的形式列出即可。
salt-master高可用之数据同步
涉及到高可用时，数据的同步是个永恒的话题，我们必须保证高可用的2个master间使用的数据是一致的，包括：
- /etc/salt/master配置文件
- /etc/salt/pki目录下的所有key
- /srv/下的salt和pillar目录下的所有文件
保障这些数据同步的方案有：
- nfs挂载
- rsync同步
- 使用gitlab进行版本控制
安全相关：
为保证数据的同步与防止丢失，可将状态文件通过gitlab进行版本控制管理。
salt-syndic分布式架构
salt-syndic架构图
salt-syndic的优劣势
优势：
- 可以通过syndic实现更复杂的salt架构
- 减轻master的负担
劣势：
- syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致，所以要进行数据同步，同步方案同salt-master高可用
- 最顶层的master不知道自己有几个syndic，它只知道自己有多少个minion，并不知道这些minion是由哪些syndic来管理的
salt-syndic部署
安装salt-master与salt-syndic
[root@syndic ~]# ls /etc/yum.repos.d/
CentOS-Base.repo CentOS-fasttrack.repo CentOS-Vault.repo
CentOS-CR.repo CentOS-Media.repo salt-7.repo
CentOS-Debuginfo.repo CentOS-Sources.repo
[root@syndic ~]# yum -y install salt-master salt-syndic
配置syndic
修改syndic所在主机的master配置文件
- 取消注释syndic_master
- 将syndic_master的值设为master的IP
[root@syndic ~]# vim /etc/salt/master
1082 syndic_master: 192.168.145.188
[root@syndic ~]# systemctl enable --now salt-master
Created symlink from /etc/systemd/system/multi-user.target.wants/salt-master.service to /usr/lib/systemd/system/salt-master.service.
[root@syndic ~]# systemctl enable --now salt-syndic
Created symlink from /etc/systemd/system/multi-user.target.wants/salt-syndic.service to /usr/lib/systemd/system/salt-syndic.service.
配置minion1
[root@minion1 ~]# ls /etc/yum.repos.d/
CentOS-Stream-AppStream.repo CentOS-Stream-Media.repo
CentOS-Stream-BaseOS.repo CentOS-Stream-PowerTools.repo
CentOS-Stream-Debuginfo.repo CentOS-Stream-RealTime.repo
CentOS-Stream-Extras.repo salt.repo
CentOS-Stream-HighAvailability.repo
[root@minion1 ~]# yum -y install salt-minion
[root@minion1 ~]# vim /etc/salt/minion
17 master: 192.168.145.196 //syndic主机IP
[root@minion ~]# systemctl enable --now salt-minion
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.
[root@minion1 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
└── minion
├── minion.pem
└── minion.pub
2 directories, 2 files
minion2
[root@minion2 ~]# ls /etc/yum.repos.d/
CentOS-Stream-AppStream.repo CentOS-Stream-Media.repo
CentOS-Stream-BaseOS.repo CentOS-Stream-PowerTools.repo
CentOS-Stream-Debuginfo.repo CentOS-Stream-RealTime.repo
CentOS-Stream-Extras.repo salt.repo
CentOS-Stream-HighAvailability.repo
[root@minion2 ~]# yum -y install salt-minion
[root@minion2 ~]# vim /etc/salt/minion
17 master: 192.168.145.196 //syndic主机IP
[root@minion2 ~]# systemctl enable --now salt-minion
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.
[root@minion2 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
└── minion
├── minion.pem
└── minion.pub
2 directories, 2 files
在syndic上接受minion主机的key
minion1
[root@syndic ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
minion1
Rejected Keys:
[root@syndic ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
minion1
Key for minion minion accepted.
[root@syndic ~]# salt-key -L
Accepted Keys:
minion1
Denied Keys:
Unaccepted Keys:
Rejected Keys:
minion2
[root@syndic ~]# salt-key -L
Accepted Keys:
minion1
Denied Keys:
Unaccepted Keys:
minion2
Rejected Keys:
[root@syndic ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
minion2
Key for minion minion accepted.
[root@syndic ~]# salt-key -L
Accepted Keys:
minion1
minion2
Denied Keys:
Unaccepted Keys:
Rejected Keys:
在master上接受syndic主机的key
[root@master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
syndic
Rejected Keys:
[root@master ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
syndic
Key for minion syndic accepted.
[root@master ~]# salt-key -L
Accepted Keys:
syndic
Denied Keys:
Unaccepted Keys:
Rejected Keys:
测试
[root@master ~]# salt '*' test.ping
minion1:
True
minion2:
True
[root@syndic ~]# vim /etc/salt/master
file_roots:
base:
- /srv/salt/base
pillar_roots:
base:
- /srv/pillar/base
[root@syndic ~]# systemctl restart salt-master salt-syndic
[root@master ~]# scp -r /srv/* 192.168.145.188:/srv/
[root@syndic ~]# tree /srv/salt/base/
/srv/salt/base/
└── init
├── basepkg
│ └── main.sls
├── chrony
│ ├── files
│ │ └── chrony.conf
│ └── main.sls
├── firewall
│ └── main.sls
├── history
│ └── main.sls
├── kernel
│ ├── files
│ │ ├── limits.conf
│ │ └── sysctl.conf
│ └── main.sls
├── main.sls
├── salt-minion
│ ├── files
│ │ ├── minion
│ │ └── multi-minion
│ └── main.sls
├── selinux
│ ├── files
│ │ └── config
│ └── main.sls
├── timeout
│ └── main.sls
└── yum
├── files
│ ├── centos-7.repo
│ ├── centos-8.repo
│ ├── epel-7.repo
│ ├── epel-8.repo
│ ├── salt-7.repo
│ └── salt-8.repo
└── main.sls
15 directories, 22 files
[root@master ~]# salt '*' test.ping
minion1:
True
minion2:
True
[root@master ~]# salt 'minion1' state.sls init.history.main
minion1:
----------
ID: /etc/profile
Function: file.managed
Result: True
Comment: File /etc/profile exists with proper permissions. No changes made.
Started: 12:50:48.497745
Duration: 10.238 ms
Changes:
Summary for minion
------------
Succeeded: 1
Failed: 0
------------
Total states run: 1
Total run time: 10.238 ms