saltstack-api使用详解

目录

1.1 salt-api安装

1.2 编写python脚本请求salt api接口

1.1 salt-api安装

  参考博客:https://www.jianshu.com/p/012ccdff93cc

  1、介绍

    1. saltsatck本身就提供了一套算完整的api,使用 CherryPy 来实现 restful 的 api,供外部的程序调用。

    2. salt-api需要安装,然后进行一些配置才可以正常使用

  2、安装salt-api,并设置开机启动

    yum -y install salt-api pyOpenSSL

    systemctl enable salt-api

  3、配置自签名证书

      cd /etc/pki/tls/certs/

      make testcert

saltstack-api使用详解
Enter pass phrase:    ===>  输入加密短语,这里我使用salt2017
Verifying - Enter pass phrase:    ===>  确认加密短语
umask 77 ; /usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt -set_serial 0
Enter pass phrase for /etc/pki/tls/private/localhost.key:    ===>  再次输入相同的加密短语
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ., the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your servers hostname) []:
Email Address []:

交互模式输入密码等
交互模式输入密码等

  4、解密key文件,生成无密码的key文件

    注:过程中需要输入key密码,该密码为之前生成证书时设置的密码

    cd /etc/pki/tls/private/

    openssl rsa -in localhost.key -out localhost_nopass.key

  5、修改文件权限

    chmod 755 /etc/pki/tls/certs/localhost.crt
    chmod 755 /etc/pki/tls/private/localhost.key
    chmod 755 /etc/pki/tls/private/localhost_nopass.key

  6、添加用户

    注:生产环境请使用密码复杂度高的密码,这里我使用 chnsys@2016

    useradd -M -s /sbin/nologin saltapi          # 创建用户 saltapi

    passwd saltapi                                    # 为用户saltapi设置密码

  7、配置salt-api

    sed -i ‘/#default_include/s/#default/default/g‘ /etc/salt/master

  8、创建/etc/salt/master.d/目录    

    mkdir -p /etc/salt/master.d/
    cd /etc/salt/master.d/
    touch eauth.conf
    touch api.conf

saltstack-api使用详解
external_auth:
  pam:
    saltapi:   # 用户
      - .*     # 该配置文件给予saltapi用户所有模块使用权限,出于安全考虑一般只给予特定模块使用权限
eauth.conf
saltstack-api使用详解
rest_cherrypy:
  port: 8001
  ssl_crt: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/private/localhost_nopass.key
api.conf

  9、启动salt-api

    systemctl restart salt-master
    systemctl start salt-api
    ps -ef|grep salt-api
    netstat -lnput|grep 8001

  10、测试获取token

    curl -k https://192.168.56.11:8001/login -H "Accept: application/x-yaml"  -d username=‘saltapi‘  -d password=‘chnsys@2016‘  -d eauth=‘pam‘

  11、调用test.ping

    curl -k https://192.168.56.11:8001/ -H "Accept: application/x-yaml" -H "X-Auth-Token: 87cbb68e0babf3d0ad6b3741795667dbe62b3c11" -d client=‘local‘ -d tgt=‘*‘ -d fun=‘test.ping‘

1.2 编写python脚本请求salt api接口

  1、使用python简单测试接口执行命令

saltstack-api使用详解
#!/usr/bin/env python
# _*_ coding:utf-8 _*_
__author__ = junxi


import requests
import json
try:
    import cookielib
except:
    import http.cookiejar as cookielib

# 使用urllib2请求https出错,做的设置
import ssl
context = ssl._create_unverified_context()

# 使用requests请求https出现警告,做的设置
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


salt_api = "https://192.168.56.11:8001/"


class SaltApi:
    """
    定义salt api接口的类
    初始化获得token
    """
    def __init__(self, url):
        self.url = url
        self.username = "saltapi"
        self.password = "chnsys@2016"
        self.headers = {
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36",
            "Content-type": "application/json"
        }
        self.params = {client: local, fun: ‘‘, tgt: ‘‘}
        self.login_url = salt_api + "login"
        self.login_params = {username: self.username, password: self.password, eauth: pam}
        self.token = self.get_data(self.login_url, self.login_params)[token]
        self.headers[X-Auth-Token] = self.token

    def get_data(self, url, params):
        send_data = json.dumps(params)
        request = requests.post(url, data=send_data, headers=self.headers, verify=False)
        response = request.json()
        result = dict(response)
        return result[return][0]

    def salt_command(self, tgt, method, arg=None):
        """远程执行命令,相当于salt ‘client1‘ cmd.run ‘free -m‘"""
        if arg:
            params = {client: local, fun: method, tgt: tgt, arg: arg}
        else:
            params = {client: local, fun: method, tgt: tgt}
        print 命令参数: , params
        result = self.get_data(self.url, params)
        return result

def main():
    salt = SaltApi(salt_api)
    salt_client = *
    salt_test = test.ping
    result1 = salt.salt_command(salt_client, salt_test)
    print result1
    # 返回结果:{u‘linux-node1.example.com‘: True, u‘linux-node2.example.com‘: True}

if __name__ == __main__:
    main()

使用python简单测试接口执行命令
使用python简单测试接口执行命令

  2、使用requests模块获取基本信息

saltstack-api使用详解
#! /usr/bin/env python
# -*- coding: utf-8 -*-
import requests
import json
import logging
logging.captureWarnings(True)  # 屏蔽由于访问https时没有证书警告问题

SALT_BASE_URL = https://192.168.56.11:8001/
SALT_USER = saltapi
SALT_PWD = chnsys@2016


class SaltAPI(object):
    __token_id = ‘‘

    def __init__(self):
        self.__url = SALT_BASE_URL
        self.__user = SALT_USER
        self.__password = SALT_PWD

    def token_id(self):
        """
            用户登陆和获取token
        :return:
        """
        params = {eauth: pam, username: self.__user, password: self.__password}
        content = self.postRequest(self.__url + /login, data=params)
        try:
            self.__token_id = content[0][token]
        except Exception as e:
            print **** Failed to get token, {} ****.format(str(e))

    def postRequest(self, url, data=None):
        headers = {"X-Auth-Token": self.__token_id}
        ret = requests.post(url=url, data=data, json=json, headers=headers, verify=False)
        if ret.status_code == 200:
            return ret.json()[return]
        return ret.text

    def remote_execution_module(self, tgt, fun, arg):
        """
            远程执行模块,有参数
        :param tgt: minion list
        :param fun: 模块
        :param arg: 参数
        :return: dict, {‘minion1‘: ‘ret‘, ‘minion2‘: ‘ret‘}
        """
        params = {client: local, tgt: tgt, fun: fun, arg: arg}
        self.token_id()
        return self.postRequest(self.__url, params)

    def salt_alive(self, tgt):
        ‘‘‘
        salt主机存活检测
        ‘‘‘
        params = {client: local, tgt: tgt, fun: test.ping}
        self.token_id()
        return self.postRequest(self.__url, params)


if __name__ == __main__:
    salt = SaltAPI()
    minions_list = [
        cloud:type,
        cluster:domain,
        cluster:name,
        cpu_model,
        fqdn_ip4,
        hospital:type,
        kernelrelease,
        nodename,
        os,
        osmajorrelease,
        osrelease,
        saltversion,
        serialnumber,
        virtual,
        num_cpus,
        mem_total,
        cloud:region,
        ipv4,
    ]
    ret = salt.remote_execution_module(*, grains.item, minions_list)
    print json.dumps(ret, ensure_ascii=False)


‘‘‘
[{
    "linux-node1.example.com": {
        "osrelease": "7.6.1810",
        "fqdn_ip4": ["192.168.56.11"],
        "serialnumber": "VMware-56 4d 26 83 60 7c bb 5a-14 17 6a ab c2 45 f2 7a",
        "nodename": "linux-node1.example.com",
        "kernelrelease": "3.10.0-957.1.3.el7.x86_64",
        "cloud:type": "",
        "num_cpus": 1,
        "saltversion": "2018.3.3",
        "cpu_model": "Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz",
        "virtual": "VMware",
        "cluster:domain": "",
        "cluster:name": "",
        "osmajorrelease": 7,
        "hospital:type": "",
        "cloud:region": "",
        "os": "CentOS",
        "ipv4": ["127.0.0.1", "192.168.56.11"],
        "mem_total": 1819
    },
    "linux-node2.example.com": {
        "osrelease": "7.6.1810",
        "fqdn_ip4": ["192.168.56.12"],
        "serialnumber": "VMware-56 4d 09 af 9d 33 70 99-e9 7b 6d b2 5a 3b 7f 22",
        "nodename": "linux-node2.example.com",
        "kernelrelease": "3.10.0-957.1.3.el7.x86_64",
        "cloud:type": "",
        "num_cpus": 1,
        "saltversion": "2018.3.3",
        "cpu_model": "Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz",
        "virtual": "VMware",
        "cluster:domain": "",
        "cluster:name": "",
        "osmajorrelease": 7,
        "hospital:type": "",
        "cloud:region": "",
        "os": "CentOS",
        "ipv4": ["127.0.0.1", "192.168.56.12"],
        "mem_total": 1819
    }
}]
‘‘‘

使用requests模块获取基本信息
使用requests模块获取基本信息

  3、解决访问无证书https报错:requests.exceptions.SSLError: HTTPSConnectionPool

    参考博客:https://blog.csdn.net/qq_31077649/article/details/79013199

    1)安装相关模块:

      pip install cryptography
      pip install pyOpenSSL
      pip install certifi

    2)关闭证书验证(verify=False)

      ret = requests.post(url=url, data=data, json=‘json‘, headers=headers, verify=False)

saltstack-api使用详解

上一篇:python格式化字符串的三种方式


下一篇:dotnet C# 反射扫描程序集所有类型会不会触发类型静态构造函数