行业动态

下面将为大家介绍使用脚本离线自动安装SaltStack Master 服务，同时安装saltstack 的API服务以便我们可以在master 上对minion 主机进行自动化运维管控，同时我们还可以基于saltstack 提供的API接口进行二次开发，例如我们可以开发自己的自动化运维软件，将平时需要在命令行进行的运维操作可以在界面上达到同样的效果。

[root@my-server script]# tree . . ├── api.conf ├── auth.conf ├── bootstrap-saltapi.sh ├── master ├── README.txt ├── salt3006.tar.gz └── salt.sql

上面是本次安装所需要的脚本及离线文件：

[root@my-server script]# cat api.conf rest_cherrypy: host: port: 8000 ssl_crt: /etc/pki/tls/certs/localhost.crt ssl_key: /etc/pki/tls/certs/localhost.key

api.conf 是SaltStack 的API 配置服务，使用yml格式，其中host 指定本机暴露的IP地址或者域名，port 暴露服务端口，ssl_crt 是https 证书路径，saltstack 的API 服务使用的是https协议，证书在后面的脚本中自动生成，ssl_key 对应crt证书密钥。

[root@my-server script]# cat auth.conf external_auth: pam: saltapi: - .* - @wheel - @runner - @jobs

auth.conf 是SaltStack 外部认证方式配置，这里使用pam方式。用于控制通过Salt API访问Salt功能的权限。

[root@my-server script]# cat bootstrap-saltapi.sh #!/bin/bash set -x logFile=/tmp/bootstrap-saltapi.log out(){ echo `date "+%Y-%m-%d %H:%M:%S"`": $*" echo `date "+%Y-%m-%d %H:%M:%S"`": $*" >> $logFile } host=$1 checkParameters() { if [ ! $host ]; then out "host is required." exit 1 fi } validateRunAsRoot() { if [[ $EUID -ne 0 ]]; then out "ERROR: run as root is required, please swith to root ro run!" exit 1 fi out "Run AS user check passed! current user is root" } installMysql() { yum install mariadb-server -y systemctl start mariadb systemctl enable mariadb out "create salt mysql job schema." cd /opt/script mysql -e "source ./salt.sql" out "authorization all permissions of the root user." mysql -e "grant all privileges on *.* to root@% identified by root; grant all privileges on *.* to root@localhost identified by root; flush privileges;" mysql -uroot -proot -h localhost -e "show databases;use salt;show tables;" } installSaltMasterAndSaltAPI() { tar -xvf ./salt3006.tar.gz -C /opt cd /opt/salt3006 rpm -ivh --replacepkgs pciutils*.rpm salt-300*.rpm salt-api*.rpm salt-master*.rpm salt-minion*.rpm out "config salt-master then start server again..." mv /etc/salt/master /etc/salt/master.bak cp /opt/script/master /etc/salt/master -f sed -i "s/interface: 0.0.0.0/interface: ${host}/g" /etc/salt/master # add salt auth user and set password useradd -M -s /sbin/nologin saltapi echo "saltapi" | passwd saltapi --stdin # config saltapi auth. salt-call --local tls.create_self_signed_cert cp -r /opt/script/auth.conf /etc/salt/master.d/ cp -r /opt/script/api.conf /etc/salt/master.d/ sed -i "s/host:/host: ${host}/g" /etc/salt/master.d/api.conf # if current os does not have python3, install it. python3 --version hasPython3=$(echo $?) if [ $hasPython3 == 0 ];then echo "Python3 has installed." else yum install python3 -y fi # saltstack relenv pip install PyMySQL cd /opt/saltstack/salt/bin ./pip3 install /opt/salt3006/PyMySQL-1.0.2-py3-none-any.whl mkdir -p /srv/salt mkdir -p /srv/scriptfile out "start salt-master..." systemctl start salt-master systemctl enable salt-master out "start salt-api..." systemctl start salt-api systemctl enable salt-api master_status=$(systemctl status salt-master|grep Active: active | wc -l) if [ $master_status -ge 1 ]; then out "salt-master is running." fi api_status=$(systemctl status salt-api|grep Active: active | wc -l) if [ $api_status ]; then out "salt-api is running." fi } checkSaltApi() { sleep 10s curl -sSk https://$host:8000/login -H Accept: application/json -d username=saltapi -d password=saltapi -d eauth=pam } main() { validateRunAsRoot checkParameters installMysql installSaltMasterAndSaltAPI checkSaltApi } main

bootstrap-saltapi.sh 是自动安装脚本路口，里面定义了不同的函数，其中validateRunAsRoot是校验本次安装需要以root 用户运行，checkParameters校验运行此脚本需要一个ip或域名作为参数，一般是本机IP地址，例如：bash bootstrap-saltapi.sh 127.0.0.1，实际安装中将127.0.0.1 进行替换。saltstack 在执行命令后，获取命令执行结果可以使用本机文本存储，也可以使用redis进行缓存，或者 mysql来进行持久化存储，这里我们使用mysql进行持久化存储，方便我们进行二次开发过程中，对命令执行结果的获取，installMysql 既是在本机安装mysql服务的。

installSaltMasterAndSaltAPI用于在本机安装 salt-master 和 salt-api服务。checkSaltApi用于安装完服务后验证 salt-api服务时否正常。main 函数为脚本路口。 [root@my-server script]# cat master | grep -v -e ^# -e ^$ interface: 0.0.0.0 publish_port: 4505 user: root ret_port: 4506 pidfile: /var/run/salt-master.pid conf_file: /etc/salt/master cachedir: /var/cache/salt/master keep_jobs: 24 show_jid: True auto_accept: True file_roots: base: - /srv/salt order_masters: True syndic_wait: 5 log_file: /var/log/salt/master mysql.host: localhost mysql.user: root mysql.pass: mysqlpass mysql.db: salt mysql.port: 3306 event_return: mysql return: mysql master_job_cache: mysql

master 文件是saltstack 中 salt-master 服务的配置文件，这里简要说明下相关配置：

interface 指定Salt Master监听的IP地址。0.0.0.0表示监听所有可用的网络接口。

publish_port 指定发送命令服务端口为4505

user 指定以root权限执行

ret_port 指定命令结果获取端口为4506

conf_file指定当前配置文件路径

auto_accept表示自动接受minion密钥请求

order_masters为True表示按顺序连接多个Master，这里安装的salt-master 为顶层master, saltstack 可以通过salt-syndic 进行扩展为三层结构，可以用于管理数万台虚拟机，一般小批量的使用两层结构即可，即master-minion 结构

最下面mysql开头的是用于配置存储命令结果的mysql配置。

在剩下的文件中 salt3006.tar.gz 是saltstack的离线安装包，如何获取离线安装包在后续文章中会讲到。salt.sql 是用于初始化salt的表结构。

[root@my-server script]# cat salt.sql /* SQLyog Ultimate v11.27 (32 bit) MySQL - 5.5.68-MariaDB : Database - salt ********************************************************************* */ /*!40101 SET NAMES utf8 */; /*!40101 SET SQL_MODE=*/; /*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */; /*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */; /*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE=NO_AUTO_VALUE_ON_ZERO */; /*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */; CREATE DATABASE /*!32312 IF NOT EXISTS*/`salt` /*!40100 DEFAULT CHARACTER SET latin1 */; USE `salt`; /*Table structure for table `jids` */ DROP TABLE IF EXISTS `jids`; CREATE TABLE `jids` ( `jid` varchar(255) NOT NULL, `load` mediumtext NOT NULL, UNIQUE KEY `jid` (`jid`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; /*Table structure for table `salt_events` */ DROP TABLE IF EXISTS `salt_events`; CREATE TABLE `salt_events` ( `id` bigint(20) NOT NULL AUTO_INCREMENT, `tag` varchar(255) NOT NULL, `data` mediumtext NOT NULL, `alter_time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP, `master_id` varchar(255) NOT NULL, PRIMARY KEY (`id`), KEY `tag` (`tag`) ) ENGINE=InnoDB AUTO_INCREMENT=3790 DEFAULT CHARSET=utf8; /*Table structure for table `salt_returns` */ DROP TABLE IF EXISTS `salt_returns`; CREATE TABLE `salt_returns` ( `fun` varchar(50) NOT NULL, `jid` varchar(255) NOT NULL, `return` mediumtext NOT NULL, `id` varchar(255) NOT NULL, `success` varchar(10) NOT NULL, `full_ret` mediumtext NOT NULL, `alter_time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP, KEY `id` (`id`), KEY `jid` (`jid`), KEY `fun` (`fun`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; /*!40101 SET SQL_MODE=@OLD_SQL_MODE */; /*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */; /*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;

使用ifconfig 查看本机IP：

[root@my-server script]# ifconfig br-811be7c31e57: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 172.18.0.1 netmask 255.255.0.0 broadcast 172.18.255.255 inet6 fe80::42:69ff:fe90:81b4 prefixlen 64 scopeid 0x20<link> ether 02:42:69:90:81:b4 txqueuelen 0 (Ethernet) RX packets 8214 bytes 807377 (788.4 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8214 bytes 807377 (788.4 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255 inet6 fe80::42:f0ff:fece:2ab prefixlen 64 scopeid 0x20<link> ether 02:42:f0:ce:02:ab txqueuelen 0 (Ethernet) RX packets 202385 bytes 51320096 (48.9 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 218371 bytes 983738284 (938.1 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 172.22.236.175 netmask 255.255.240.0 broadcast 172.22.239.255 inet6 fe80::216:3eff:fe00:6162 prefixlen 64 scopeid 0x20<link> ether 00:16:3e:00:61:62 txqueuelen 1000 (Ethernet) RX packets 27961541 bytes 9347094567 (8.7 GiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 22301197 bytes 4160742107 (3.8 GiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 1000 (Local Loopback) RX packets 8214 bytes 807377 (788.4 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8214 bytes 807377 (788.4 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

执行命令开始自动安装 bash bootstrap-saltapi.sh 172.22.236.175

查看安装的服务状态：systemctl status salt-master salt-api