SaltStack配置管理
作者：互联网
YAML语言
YAML是一种直观的能够被电脑识别的数据序列化格式，是一个可读性高并且容易被人类阅读，容易和脚本语言交互，用来表达资料序列的编程语言。
它类似于标准通用标记语言的子集XML的数据描述语言，语法比XML简单很多。
YAML语言的格式如下：
house:
family:
name: Doe
parents:
- John
- Jane
children:
- Paul
- Mark
- Simone
address:
number: 34
street: Main Street
city: Nowheretown
zipcode: 12345
YAML的基本规则：
- 使用缩进来表示层级关系，每层2个空格，禁止使用TAB键
- 当冒号不是处于最后时，冒号后面必须有一个空格
- 用 - 表示列表，-的后面必须有一个空格 用 # 表示注释
YAML配置文件要放到SaltStack让我们放的位置，可以在SaltStack的 Master 配置文件中查找file_roots即可看到。
[root@master ~]# cd /etc/salt/
[root@master salt]# ls
cloud cloud.maps.d master minion.d proxy
cloud.conf.d cloud.profiles.d master.d minion_id proxy.d
cloud.deploy.d cloud.providers.d minion pki roster
[root@master salt]# vim master
677 #file_roots:
678 # base:
679 # - /srv/salt
680 #
## 在配置文件里面加入以下内容
681 file_roots:
682 base: ## 基础环境
683 - /srv/salt/base
684 test: ## 测试环境
685 - /srv/salt/test
686 dev: ## 开发环境
687 - /srv/salt/dev
688 prod: ## 生产环境
689 - /srv/salt/prod
// 创建刚刚配置文件里面写的目录
[root@master salt]# ls /srv/
[root@master salt]# mkdir -p /srv/salt/{base,test,dev,prod}
[root@master salt]# tree /srv/
/srv/
└── salt
├── base
├── dev
├── prod
└── test
5 directories, 0 files
// 因为改了master的配置文件所以要重启master
[root@master salt]# systemctl restart salt-master
需要注意：
base是默认的位置，如果file_roots只有一个，则base是必备的且必须叫base，不能改名
用SaltStack配置一个apache实例
[root@master ~]# cd /srv/salt/base/
[root@master base]# ls
[root@master base]# mkdir web/{nginx,apache} -p
[root@master base]# tree
.
└── web
├── apache
└── nginx
3 directories, 0 files
// 进入web/apache下面，写一个apache.sls状态文件
// YAML 配置文件中顶格写的被称作ID，必须全局唯一，不能重复
// SaltStack 读 YAML 配置文件时是从上往下读，所以要把先执行的写在前面
[root@master base]# vim web/apache/apache.sls
apache-install:
pkg.installed:
- name: httpd
apache-service:
service.running:
- name: httpd
- enable: true
[root@master base]# tree
.
└── web
├── apache
│ └── apache.sls
└── nginx
3 directories, 1 file
// 在minion2上执行apache.sls状态文件
[root@master base]# salt 'minion' state.sls web.apache.apache saltenv=base
state意思是执行，state.sls意思就是执行状态；整句意思是执行base环境下面的web下面的apache下面的apache。
如果用的是base环境的话，saltenv=base可以省略；但是如果是dev、prod、test的话就必须加上saltenv=dev、prod、test
网慢所以才导致安装慢，等一小会就好了。
minion2:
Minion did not return. [No response]
The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:
salt-run jobs.lookup_jid 20211102102604498582 #如果报了以上这种错误，并没有任何影响，不用管它，然后执行这条命令就可以看见minion2的信息
ERROR: Minions returned with non-zero exit code
//查看状态文件执行的结果
[root@master base]# salt-run jobs.lookup_jid 20211102102604498582
minion:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: The following packages were installed/updated: httpd
Started: 18:26:08.273303
Duration: 11811.171 ms
Changes:
----------
apr:
----------
new:
1.4.8-7.el7
old:
apr-util:
----------
new:
1.5.2-6.el7
old:
httpd:
----------
new:
2.4.6-97.el7.centos.1
old:
httpd-tools:
----------
new:
2.4.6-97.el7.centos.1
old:
mailcap:
----------
new:
2.1.41-2.el7
old:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: True
Comment: Service httpd has been enabled, and is running
Started: 18:26:20.103534
Duration: 29395.506 ms
Changes:
----------
httpd:
True
Summary for minion2
------------
Succeeded: 2 (changed=2) ## 如果再次执行一遍，整个字体都是绿色的，而且这里也没用changed，就说明已经达到了目标状态，已经达到了目标状态就不做任何事。如果它没有达到目标状态那就要让它去达到目标状态。
Failed: 0
------------
Total states run: 2
Total run time: 41.207 s
//在minion上检查
// 在minion上查看安装的apache服务
[root@minion ~]# rpm -qa|grep httpd
httpd-tools-2.4.6-97.el7.centos.1.x86_64
httpd-2.4.6-97.el7.centos.1.x86_64
[root@minion ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 :::80 :::*
LISTEN 0 128 :::22 :::*
LISTEN 0 100 ::1:25 :::*
[root@minion ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since 二 2021-11-02 18:26:49 CST; 15min ago
Docs: man:httpd(8)
man:apachectl(8)
Main PID: 57712 (httpd)
Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec"
CGroup: /system.slice/httpd.service
├─57712 /usr/sbin/httpd -DFOREGROUND
├─58241 /usr/sbin/httpd -DFOREGROUND
├─58242 /usr/sbin/httpd -DFOREGROUND
├─58243 /usr/sbin/httpd -DFOREGROUND
├─58244 /usr/sbin/httpd -DFOREGROUND
└─58245 /usr/sbin/httpd -DFOREGROUND
top file介绍
直接通过命令执行sls文件时够自动化吗？答案是否定的，因为我们还要告诉某台主机要执行某个任务，自动化应该是我们让它干活时，它自己就知道哪台主机要干什么活，但是直接通过命令执行sls文件并不能达到这个目的，为了解决这个问题，top file 应运而生。
top file就是一个入口，top file的文件名可通过在 Master的配置文件中搜索top.sls找出，且此文件必须在 base 环境中，默认情况下此文件必须叫top.sls。
top file的作用就是告诉对应的主机要干什么活，比如让web服务器启动web服务，让数据库服务器安装mysql等等。
top file 实例：
//查看有几台主机
[root@master salt]# salt-key -L
Accepted Keys:
master
minion
minion2
Denied Keys:
Unaccepted Keys:
Rejected Keys:
//编写文件
[root@master salt]# cd /srv/salt/base/
[root@master base]# tree
.
└── web
└── apache
└── apache.sls
[root@master base]# mv web/apache/apache.sls web/apache/install.sls
[root@master base]# mkdir web/nginx
[root@master base]# vim web/nginx/install.sls
[root@master base]# cat web/nginx/install.sls
nginx-install:
pkg.installed:
- name: nginx
nginx-service:
service.running:
- name: nginx
- enable: Ture
[root@master base]# tree
.
├── top.sls
└── web
├── apache
│ └── install.sls
└── nginx
└── install.sls
3 directories, 3 files
//编写文本
[root@master base]# ls
web
[root@master base]# vim top.sls
[root@master base]# cat top.sls
base: #要执行状态文件的环境
'minion': #要执行状态文件的目标
- web.apache.install #要执行的状态文件
'minion2':
- web.nginx.install
//使用高级状态来执行
[root@master base]# salt '*' state.highstate
master:
----------
ID: states
Function: no.None
Result: False
Comment: No Top file or master_tops data matches found. Please see master log for details.
Changes:
Summary for master
------------
Succeeded: 0
Failed: 1
------------
Total states run: 1
Total run time: 0.000 ms
minion:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: All specified packages are already installed
Started: 00:11:40.829402
Duration: 2367.728 ms
Changes:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: True
Comment: Service httpd is already enabled, and is running
Started: 00:11:43.207717
Duration: 5222.255 ms
Changes:
----------
httpd:
True
Summary for minion
------------
Succeeded: 2 (changed=1)
Failed: 0
------------
Total states run: 2
Total run time: 7.590 s
minion2:
----------
ID: nginx-install
Function: pkg.installed
Name: nginx
Result: True
Comment: The following packages were installed/updated: nginx
Started: 12:11:40.481486
Duration: 11596.268 ms
Changes:
----------
nginx:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-all-modules:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-filesystem:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-http-image-filter:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-http-perl:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-http-xslt-filter:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-mail:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
nginx-mod-stream:
----------
new:
1:1.14.1-9.module_el8.0.0+184+e34fea82
old:
----------
ID: nginx-service
Function: service.running
Name: nginx
Result: True
Comment: Service nginx is already disabled, and is running
Started: 12:11:52.089903
Duration: 209.789 ms
Changes:
----------
nginx:
True
Summary for minion2
------------
Succeeded: 2 (changed=2)
Failed: 0
------------
Total states run: 2
Total run time: 11.806 s
ERROR: Minions returned with non-zero exit code
[root@master base]# salt '*' state.highstate
master:
----------
ID: states
Function: no.None
Result: False
Comment: No Top file or master_tops data matches found. Please see master log for details.
Changes:
Summary for master
------------
Succeeded: 0
Failed: 1
------------
Total states run: 1
Total run time: 0.000 ms
minion:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: All specified packages are already installed
Started: 00:12:09.437621
Duration: 1779.37 ms
Changes:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: True
Comment: The service httpd is already running
Started: 00:12:11.218339
Duration: 62.777 ms
Changes:
Summary for minion
------------
Succeeded: 2
Failed: 0
------------
Total states run: 2
Total run time: 1.842 s
minion2:
----------
ID: nginx-install
Function: pkg.installed
Name: nginx
Result: True
Comment: All specified packages are already installed
Started: 12:12:12.729336
Duration: 1568.737 ms
Changes:
----------
ID: nginx-service
Function: service.running
Name: nginx
Result: True
Comment: The service nginx is already running
Started: 12:12:14.300042
Duration: 58.622 ms
Changes:
Summary for minion2
------------
Succeeded: 2
Failed: 0
------------
Total states run: 2
Total run time: 1.627 s
//在mioion上检查httpd
[root@minion ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2021-11-03 00:11:48 CST; 42s ago
Docs: man:httpd.service(8)
Main PID: 54442 (httpd)
Status: "Running, listening on: port 80"
Tasks: 213 (limit: 23364)
Memory: 40.7M
CGroup: /system.slice/httpd.service
├─54442 /usr/sbin/httpd -DFOREGROUND
├─54922 /usr/sbin/httpd -DFOREGROUND
├─54923 /usr/sbin/httpd -DFOREGROUND
├─54924 /usr/sbin/httpd -DFOREGROUND
└─54925 /usr/sbin/httpd -DFOREGROUND
Nov 03 00:11:43 minion systemd[1]: Starting The Apache HTTP Server...
Nov 03 00:11:48 minion httpd[54442]: AH00558: httpd: Could not reliably determine the server's fu>
Nov 03 00:11:48 minion systemd[1]: Started The Apache HTTP Server.
Nov 03 00:11:53 minion httpd[54442]: Server configured, listening on: port 80
//在mioion2上检查nginx
[root@minion2 salt]# systemctl status nginx
● nginx.service - The nginx HTTP and reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2021-11-02 12:11:52 EDT; 46s ago
Process: 86688 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
Process: 86686 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
Process: 86684 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
Main PID: 86689 (nginx)
Tasks: 5 (limit: 23364)
Memory: 10.3M
CGroup: /system.slice/nginx.service
├─86689 nginx: master process /usr/sbin/nginx
├─86690 nginx: worker process
├─86691 nginx: worker process
├─86692 nginx: worker process
└─86693 nginx: worker process
Nov 02 12:11:52 minion2 systemd[1]: Starting The nginx HTTP and reverse proxy server...
Nov 02 12:11:52 minion2 nginx[86686]: nginx: the configuration file /etc/nginx/nginx.conf syntax >
Nov 02 12:11:52 minion2 nginx[86686]: nginx: configuration file /etc/nginx/nginx.conf test is suc>
Nov 02 12:11:52 minion2 systemd[1]: Started The nginx HTTP and reverse proxy server.
注意：
- 若top file里面的目标是用 * 表示的，要注意的是，top file里面的 * 表示的是所有要执行状态的目标，而 salt ‘*’ state.highstate 里面的 * 表示通知所有机器干活，而是否要干活则是由top file来指定的
高级状态highstate的使用
管理SaltStack时一般最常用的管理操作就是执行高级状态
[root@master ~]# salt ‘*’ state.highstate //生产环境禁止这样使用salt命令
注意：
上面让所有人执行高级状态，但实际工作当中，一般不会这么用，工作当中一般都是通知某台或某些台目标主机来执行高级状态，具体是否执行则是由top file来决定的。
若在执行高级状态时加上参数test=True，则它会告诉我们它将会做什么，但是它不会真的去执行这个操作。
//先确定httpd服务是关闭的，在执行下面命令
[root@master base]# salt 'minion' state.highstate test=true
minion:
----------
ID: apache-install
Function: pkg.installed
Name: httpd
Result: True
Comment: All specified packages are already installed
Started: 00:19:05.958736
Duration: 1582.476 ms
Changes:
----------
ID: apache-service
Function: service.running
Name: httpd
Result: None
Comment: Service httpd is set to start
Started: 00:19:07.542999
Duration: 49.079 ms
Changes:
Summary for minion
------------
Succeeded: 2 (unchanged=1)
Failed: 0
------------
Total states run: 2
Total run time: 1.632 s
//查看httpd服务
[root@minion ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Wed 2021-11-03 00:18:55 CST; 36s ago
Docs: man:httpd.service(8)
Process: 54442 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=0/SUCCESS)
Main PID: 54442 (code=exited, status=0/SUCCESS)
Status: "Running, listening on: port 80"
Nov 03 00:11:43 minion systemd[1]: Starting The Apache HTTP Server...
Nov 03 00:11:48 minion httpd[54442]: AH00558: httpd: Could not reliably determine the server's fu>
Nov 03 00:11:48 minion systemd[1]: Started The Apache HTTP Server.
Nov 03 00:11:53 minion httpd[54442]: Server configured, listening on: port 80
Nov 03 00:18:54 minion systemd[1]: Stopping The Apache HTTP Server...
Nov 03 00:18:55 minion systemd[1]: httpd.service: Succeeded.
Nov 03 00:18:55 minion systemd[1]: Stopped The Apache HTTP Server.
//由此可见高级状态并没有执行，因为httpd并没有启动
SaltStack数据系统组件
Grains
Grains是SaltStack的一个组件，其存放着minion启动时收集到的信息。
Grains是SaltStack组件中非常重要的组件之一，因为我们在做配置部署的过程中会经常使用它，Grains是SaltStack记录minion的一些静态信息的组件。可简单理解为Grains记录着每台minion的一些常用属性，比如CPU、内存、磁盘、网络信息等。我们可以通过grains.items查看某台minion的所有Grains信息。
Grains的功能：
收集资产信息
Grains应用场景：
- 信息查询
- 在命令行下进行目标匹配
- 在top file中进行目标匹配
- 在模板中进行目标匹配
模板中进行目标匹配请看：https://docs.saltstack.com/en/latest/topics/pillar/
信息查询实例：
//列出所有grains的key和value
[root@master ~]# salt 'minion' grains.items
minion:
----------
biosreleasedate: //bios的时间
07/29/2019
biosversion: //bios的版本
6.00
cpu_flags: //cpu相关的属性
- fpu
- vme
- de
- pse
- tsc
- msr
- pae
- mce
- cx8
- apic
- sep
- mtrr
- pge
- mca
- cmov
- pat
- pse36
- clflush
- mmx
- fxsr
- sse
- sse2
- ss
- ht
- syscall
- nx
- pdpe1gb
- rdtscp
- lm
- constant_tsc
- arch_perfmon
- nopl
- xtopology
- tsc_reliable
- nonstop_tsc
- cpuid
- pni
- pclmulqdq
- vmx
- ssse3
- fma
- cx16
- pcid
- sse4_1
- sse4_2
- x2apic
- movbe
- popcnt
- tsc_deadline_timer
- aes
- xsave
- avx
- f16c
- rdrand
- hypervisor
- lahf_lm
- abm
- 3dnowprefetch
- invpcid_single
- ssbd
- ibrs
- ibpb
- stibp
- ibrs_enhanced
- tpr_shadow
- vnmi
- ept
- vpid
- ept_ad
- fsgsbase
- tsc_adjust
- bmi1
- avx2
- smep
- bmi2
- invpcid
- mpx
- rdseed
- adx
- smap
- clflushopt
- xsaveopt
- xsavec
- xsaves
- arat
- pku
- ospke
- md_clear
- flush_l1d
- arch_capabilities
cpu_model:
Intel(R) Core(TM) i5-10300H CPU @ 2.50GHz
cpuarch:
x86_64
cwd:
/
disks:
- sr0
- sda
dns:
----------
domain:
ip4_nameservers:
- 114.114.114.114
- 8.8.8.8
ip6_nameservers:
nameservers:
- 114.114.114.114
- 8.8.8.8
options:
search:
sortlist:
domain:
efi:
False
efi-secure-boot:
False
fqdn:
minion
fqdn_ip4:
- 192.168.122.1
- 192.168.126.20
fqdn_ip6:
- fe80::20c:29ff:fe82:9884
fqdns:
- minion
gid:
0
gpus:
|_
----------
model:
SVGA II Adapter
vendor:
vmware
groupname:
root
host:
minion
hwaddr_interfaces:
----------
ens33:
00:0c:29:82:98:84
lo:
00:00:00:00:00:00
virbr0:
52:54:00:4c:fa:ce
virbr0-nic:
52:54:00:4c:fa:ce
id:
minion
init:
systemd
ip4_gw:
192.168.126.2
ip4_interfaces:
----------
ens33:
- 192.168.126.20
lo:
- 127.0.0.1
virbr0:
- 192.168.122.1
virbr0-nic:
ip6_gw:
False
ip6_interfaces:
----------
ens33:
- fe80::20c:29ff:fe82:9884
lo:
- ::1
virbr0:
virbr0-nic:
ip_gw:
True
ip_interfaces:
----------
ens33:
- 192.168.126.20
- fe80::20c:29ff:fe82:9884
lo:
- 127.0.0.1
- ::1
virbr0:
- 192.168.122.1
virbr0-nic:
ipv4:
- 127.0.0.1
- 192.168.126.20
- 192.168.122.1
ipv6:
- ::1
- fe80::20c:29ff:fe82:9884
kernel:
Linux
kernelparams:
|_
- BOOT_IMAGE
- (hd0,msdos1)/vmlinuz-4.18.0-305.3.1.el8.x86_64
|_
- root
- /dev/mapper/cl-root
|_
- ro
- None
|_
- crashkernel
- auto
|_
- resume
- /dev/mapper/cl-swap
|_
- rd.lvm.lv
- cl/root
|_
- rd.lvm.lv
- cl/swap
|_
- rhgb
- None
|_
- quiet
- None
kernelrelease:
4.18.0-305.3.1.el8.x86_64
kernelversion:
#1 SMP Tue Jun 1 16:14:33 UTC 2021
locale_info:
----------
defaultencoding:
UTF-8
defaultlanguage:
en_US
detectedencoding:
UTF-8
timezone:
CST
localhost:
minion
lsb_distrib_codename:
CentOS Linux 8
lsb_distrib_id:
CentOS Linux
lvm:
----------
cl:
- root
- swap
machine_id:
868470355ad14738912944290fb138ed
manufacturer:
VMware, Inc.
master:
192.168.126.18
mdadm:
mem_total:
3709
nodename:
minion
num_cpus:
4
num_gpus:
1
os:
CentOS
os_family:
RedHat
osarch:
x86_64
oscodename:
CentOS Linux 8
osfinger:
CentOS Linux-8
osfullname:
CentOS Linux
osmajorrelease:
8
osrelease:
8.4.2105
osrelease_info:
- 8
- 4
- 2105
path:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
pid:
1793
productname:
VMware Virtual Platform
ps:
ps -efHww
pythonexecutable:
/usr/bin/python3.6
pythonpath:
- /usr/bin
- /usr/lib64/python36.zip
- /usr/lib64/python3.6
- /usr/lib64/python3.6/lib-dynload
- /usr/lib64/python3.6/site-packages
- /usr/lib/python3.6/site-packages
pythonversion:
- 3
- 6
- 8
- final
- 0
saltpath:
/usr/lib/python3.6/site-packages/salt
saltversion:
3004
saltversioninfo:
- 3004
selinux:
----------
enabled:
False
enforced:
Disabled
serialnumber:
VMware-56 4d d4 04 45 6b 31 6d-2a 30 34 3c 57 82 98 84
server_id:
279719642
shell:
/bin/sh
ssds:
swap_total:
2047
systemd:
----------
features:
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy
version:
239
systempath:
- /usr/local/sbin
- /usr/local/bin
- /usr/sbin
- /usr/bin
transactional:
False
uid:
0
username:
root
uuid:
04d44d56-6b45-6d31-2a30-343c57829884
virtual:
VMware
zfs_feature_flags:
False
zfs_support:
False
zmqversion:
4.3.4
//只查询所有的grains的key
[root@master ~]# salt 'minion' grains.ls
minion:
- biosreleasedate
- biosversion
- cpu_flags
- cpu_model
- cpuarch
- cwd
- disks
- dns
- domain
- efi
- efi-secure-boot
- fqdn
- fqdn_ip4
- fqdn_ip6
- fqdns
- gid
- gpus
- groupname
- host
- hwaddr_interfaces
- id
- init
- ip4_gw
- ip4_interfaces
- ip6_gw
- ip6_interfaces
- ip_gw
- ip_interfaces
- ipv4
- ipv6
- kernel
- kernelparams
- kernelrelease
- kernelversion
- locale_info
- localhost
- lsb_distrib_codename
- lsb_distrib_id
- lvm
- machine_id
- manufacturer
- master
- mdadm
- mem_total
- nodename
- num_cpus
- num_gpus
- os
- os_family
- osarch
- oscodename
- osfinger
- osfullname
- osmajorrelease
- osrelease
- osrelease_info
- path
- pid
- productname
- ps
- pythonexecutable
- pythonpath
- pythonversion
- saltpath
- saltversion
- saltversioninfo
- selinux
- serialnumber
- server_id
- shell
- ssds
- swap_total
- systemd
- systempath
- transactional
- uid
- username
- uuid
- virtual
- zfs_feature_flags
- zfs_support
- zmqversion
//查询某个key的值，比如想获取ip地址
[root@master ~]# salt '*' grains.get fqdn_ip4
master:
- 192.168.122.1
- 192.168.126.18
minion:
- 192.168.122.1
- 192.168.126.20
minion2:
- 192.168.122.1
- 192.168.126.16
[root@master ~]# salt '*' grains.get ip4_interfaces
minion:
----------
ens33:
- 192.168.126.20
lo:
- 127.0.0.1
virbr0:
- 192.168.122.1
virbr0-nic:
minion2:
----------
ens33:
- 192.168.126.16
lo:
- 127.0.0.1
virbr0:
- 192.168.122.1
virbr0-nic:
master:
----------
ens33:
- 192.168.126.18
lo:
- 127.0.0.1
virbr0:
- 192.168.122.1
目标匹配实例：
用Grains来匹配minion：
[root@master ~]# salt -G 'os:CentOS' cmd.run 'uptime'
minion2:
12:44:26 up 12 min, 2 users, load average: 0.19, 0.21, 0.17
minion:
09:43:32 up 12 min, 2 users, load average: 0.14, 0.11, 0.14
master:
10:39:37 up 12 min, 2 users, load average: 0.03, 0.17, 0.16
在top file里面使用Grains：
[root@master ~]# vim /srv/salt/base/top.sls
base:
'os:CentOS Stream' //为所有系统为CentOS Stream版本的主机安装nginx
- match: grain
- web.nginx.install
自定义Grains的两种方法：
- minion配置文件，在配置文件中搜索grains
- 在/etc/salt下生成一个grains文件，在此文件中定义(推荐方式)
[root@master ~]# vim /etc/salt/grains
[root@master ~]# cat /etc/salt/grains
test: mkf
[root@master ~]# systemctl restart salt-minion.service
[root@minion ~]# vim /etc/salt/grains
[root@minion ~]# cat /etc/salt/grains
test: mkf
[root@minion ~]# systemctl restart salt-minion.service
[root@master ~]# salt '*' grains.get test
minion2:
master:
mkf
minion:
不重启的情况下自定义Grains：
[root@minion ~]# vim /etc/salt/grains
[root@minion ~]# cat /etc/salt/grains
test: mkf
mkf: mk
[root@master ~]# salt 'minion' saltutil.sync_grains
minion:
[root@master ~]# salt 'minion' grains.get mkf
minion:
mk
SaltStack组件Pillar
Pillar也是SaltStack组件中非常重要的组件之一，是数据管理中心，经常配置states在大规模的配置管理工作中使用它。Pillar在SaltStack中主要的作用就是存储和定义配置管理中需要的一些数据，比如软件版本号、用户名密码等信息，它的定义存储格式与Grains类似，都是YAML格式。
在Master配置文件中有一段Pillar settings选项专门定义Pillar相关的一些参数：
#pillar_roots:
# base:
# - /srv/pillar
默认Base环境下Pillar的工作目录在/srv/pillar目录下。若你想定义多个环境不同的Pillar工作目录，只需要修改此处配置文件即可。
Pillar的特点：
- 可以给指定的minion定义它需要的数据
- 只有指定的人才能看到定义的数据
- 在master配置文件里设置
[root@master ~]# salt '*' pillar.items
master:
----------
minion:
----------
minion2:
----------
默认pillar是没有任何信息的，如果想查看信息，需要在 master 配置文件上把 pillar_opts的注释取消，并将其值设为 True。
[root@master ~]# vim /etc/salt/master
905 pillar_opts: Ture
[root@master ~]# systemctl restart salt-master.service
pillar自定义数据：
在master的配置文件里找pillar_roots可以看到其存放pillar的位置
[root@master ~]# vim /etc/salt/master
854 # highstate format, and is generally just key/value pairs.
855 pillar_roots:
856 base:
857 - /srv/pillar/base
858 prod:
859 - /srv/pillar/prod
860 #
861 #ext_pillar:
862 # - hiera: /etc/hiera.yaml
863 # - cmd_yaml: cat /etc/salt/yaml
[root@master ~]# vim /etc/salt/master
[root@master ~]# mkdir -p /srv/pillar/{base,prod}
[root@master ~]# tree /srv/pillar/
/srv/pillar/
├── base
└── prod
2 directories, 0 files
[root@master ~]# systemctl restart salt-master
[root@master ~]# vim /srv/pillar/base/apache.sls
[root@master ~]# cat /srv/pillar/base/apache.sls
{% if grains['os'] == 'CentOS Stream' %}
apache: httpd
{% elif grains['os'] == 'Debian' %}
apache: apache2
{% endif %}
//定义top file入口文件
[root@master ~]# vim /srv/pillar/base/top.sls
[root@master ~]# cat /srv/pillar/base/top.sls
base: //指定环境
minion: //指定目标
- apache //引用apache.sls或apache/init.sls
//这个top.sls文件的意思表示的是node1这台主机的base环境能够访问到apache这个pillar
[root@master ~]# salt 'minion' pillar.items
minion:
----------
apache:
httpd
//在salt下修改apache的状态文件，引用pillar的数据
[root@master ~]# vim /srv/salt/base/web/httpd/install.sls
[root@master ~]# cat /srv/salt/base/web/httpd/install.sls
httpd_install:
pkg.installed:
- name: {{ pillar['apache'] }}
httpd_service:
service.running:
- name: {{ pillar['apache'] }}
- enable: true
//执行高级状态文件
[root@master ~]# salt 'minion' state.highstate
Grains与Pillar的区别
| 存储位置 | 类型 | 采集方式 | 应用场景 | |
|---|---|---|---|---|
| Grains | minion | 静态 | minion启动时采集 可通过刷新避免重启minion服务 | 1.信息查询 2.在命令行下进行目标匹配 3.在top file中进行目标匹配 4.在模板中进行目标匹配 |
| Pillar | master | 动态 | 指定，实时生效 | 1.目标匹配 2.敏感数据配置 |
标签：httpd,minion,salt,配置管理,nginx,master,SaltStack,root 来源： https://blog.csdn.net/a512153770/article/details/121118299