循环语句
[root@master base]# cat test.sls
{% for user in ["user001","user002","user003"] %}
{{ user }}:
user.present
{% endfor %}
[root@node2 ~]# id user001
id: “user001”：无此用户
[root@node2 ~]# id user002
id: “user002”：无此用户
[root@node2 ~]# id user003
id: “user003”：无此用户
[root@master base]# salt 'node2' state.sls test
node2:
----------
ID: user001
Function: user.present
Result: True
Comment: New user user001 created
Started: 09:51:27.512294
Duration: 352.924 ms
Changes:
----------
fullname:
gid:
1001
groups:
- user001
home:
/home/user001
homephone:
name:
user001
other:
passwd:
x
roomnumber:
shell:
/bin/bash
uid:
1001
workphone:
----------
ID: user002
Function: user.present
Result: True
Comment: New user user002 created
Started: 09:51:27.865420
Duration: 291.818 ms
Changes:
----------
fullname:
gid:
1002
groups:
- user002
home:
/home/user002
homephone:
name:
user002
other:
passwd:
x
roomnumber:
shell:
/bin/bash
uid:
1002
workphone:
----------
ID: user003
Function: user.present
Result: True
Comment: New user user003 created
Started: 09:51:28.157484
Duration: 295.113 ms
Changes:
----------
fullname:
gid:
1003
groups:
- user003
home:
/home/user003
homephone:
name:
user003
other:
passwd:
x
roomnumber:
shell:
/bin/bash
uid:
1003
workphone:
Summary for node2
------------
Succeeded: 3 (changed=3)
Failed: 0
------------
Total states run: 3
Total run time: 939.855 ms
[root@node2 ~]# id user003
uid=1003(user003) gid=1003(user003) 组=1003(user003)
[root@node2 ~]# id user002
uid=1002(user002) gid=1002(user002) 组=1002(user002)
[root@node2 ~]# id user001
uid=1001(user001) gid=1001(user001) 组=1001(user001)
判断语句
[root@master base]# cat test.sls
test_nginx_install:
pkg.installed:
{% if grains['os'] == 'CentOS Stream' %}
- name: httpd
{% elif grains['os'] == 'Ubuntu' %}
- name: apache2
{% endif %}
[root@master base]# salt 'node2' state.sls test
node2:
----------
ID: test_nginx_install
Function: pkg.installed
Name: httpd
Result: True
Comment: The following packages were installed/updated: httpd
Started: 10:04:37.277457
Duration: 10364.097 ms
Changes:
----------
apr:
----------
new:
1.6.3-11.el8
old:
apr-util:
----------
new:
1.6.1-6.el8
old:
apr-util-bdb:
----------
new:
1.6.1-6.el8
old:
apr-util-openssl:
----------
new:
1.6.1-6.el8
old:
centos-logos-httpd:
----------
new:
85.8-1.el8
old:
httpd:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
httpd-filesystem:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
httpd-tools:
----------
new:
2.4.37-40.module_el8.5.0+852+0aafc63b
old:
mod_http2:
----------
new:
1.15.7-3.module_el8.4.0+778+c970deab
old:
Summary for node2
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 10.364 s
[root@node2 ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
[root@node2 ~]# systemctl start httpd
[root@node2 ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
应用场景
- master 与 minion 网络不通或通信有延迟，即网络不稳定
- 想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion
从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到masterless
了。
有了masterless，即使你只有一台主机，也能玩saltstack，而不需要你有N台主机架构。
masterless配置
修改配置文件minion
- 注释master行
- 取消注释file_client并设其值为local
- 设置file_roots
- 设置pillar_roots
配置salt-minion
[root@node1 ~]# vim /etc/salt/minion
# resolved, then the minion will fail to start.
master: salt
# minion in masterless mode.
file_client: local
file_roots:
base:
- /srv/salt/base
pillar_roots:
base:
- /srv/pillar/base
[root@node1 ~]# mkdir -p /srv/salt/base /srv/pillar/base
[root@node1 ~]# tree /srv
/srv
├── pillar
│ └── base
└── salt
└── base
4 directories, 0 files
关闭salt-minion服务
使用 masterless 模式时是不需要启动任何服务的，包括salt-master和salt-minion。
[root@node2 ~]# systemctl stop salt-minion
salt-call
masterless模式执行模块或状态时需要使用salt-call命令，而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。
[root@node1 ~]# salt-call --local cmd.run 'date'
local:
Wed Jul 21 09:29:08 EDT 2021
[root@node1 ~]# salt-call --local cmd.run 'ls -l /root'
local:
total 4
-rw-------. 1 root root 1030 Jun 3 14:36 anaconda-ks.cfg
masterless高可用
salt-master高可用配置
我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。salt的高可用配置非常简单，只需要改一下minion配置文件，将master用列表的形式列出即可。
salt-master高可用之数据同步
涉及到高可用时，数据的同步是个永恒的话题，我们必须保证高可用的2个master间使用的数据是一致的，包括：
- /etc/salt/master配置文件
- /etc/salt/pki目录下的所有key
- /srv/下的salt和pillar目录下的所有文件
保障这些数据同步的方案有：
- nfs挂载
- rsync同步
- 使用gitlab进行版本控制
安全相关：
为保证数据的同步与防止丢失，可将状态文件通过gitlab进行版本控制管理。
环境：
| 服务 | 主机 | IP地址 |
|---|
| master | master1 | 192.168.100.10 | | master | master2 | 192.168.100.77 | | minion | node1 | 192.168.100.20 |
[root@master1 ~]# scp /etc/salt/master 192.168.100.10:/etc/salt/master
[root@master1 ~]# scp -r /etc/salt/pki 192.168.100.10:/etc/salt
[root@master2 ~]# systemctl start salt-master
[root@node1 ~]# vim /etc/salt/minion
master:
- 192.168.100.10
- 192.168.100.77
[root@master2 ~]# systemctl start salt-master
[root@master2 ~]# salt-key -L
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
Rejected Keys:
[root@master1 ~]# salt '*' test.ping
node1:
True
[root@master2 ~]# salt '*' test.ping
node1:
True
[root@node1 minion]# vim /etc/salt/minion
# beacons) without a master connection
master_type: failover
# of TCP connections, such as load balancers.)
master_alive_interval: 3
[root@master1 ~]# salt '*' test.ping
node1:
True
[root@master2 ~]# salt '*' test.ping
node1：
Minion did not return. [No response]
[root@master1 ~]# systemctl stop salt-master
[root@master2 ~]# salt '*' test.ping
node1:
True
|