- 1.masterless
- 1.1 应用场景
- 1.2 masterless配置
- 1.2.1 修改minion配置文件
- 1.2.2 关闭salt-minion服务
- 1.2.3 salt-call
- 2. salt-master高可用
- 2.1 salt-master高可用配置
- 2.2 salt-master高可用之数据同步
- 3. salt-syndic分布式架构
- 3.1 salt-syndic架构图
- 3.2 salt-syndic的优劣势
- 3.3 salt-syndic部署
- 3.3.1 环境说明
- master 与 minion 网络不通或通信有延迟，即网络不稳定
- 想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到 masterless 了。
有了masterless，即使你只有一台主机，也能玩saltstack，而不需要你有N台主机架构。
1.2 masterless配置 1.2.1 修改minion配置文件- 注释master行
- 取消注释file_client并设其值为local
- 设置file_roots
- 设置pillar_roots
//安装salt-minion
[root@localhost ~]# yum -y install salt-minion
//修改minion配置文件
[root@localhost ~]# vim /etc/salt/minion
......
15 # resolved, then the minion will fail to start.
16 #master: salt //注释此行，不指定master
......
607 # minion in masterless mode.
608 file_client: local //取消注释并将其值设为local
......
625 file_roots: //设置file_roots的路径和环境，可定义多个
626 base:
627 - /srv/salt/base
......
663 pillar_roots: //设置pillar_roots的路径和环境，可定义多个
664 base:
665 - /srv/pillar/base
......
//创建目录
[root@localhost ~]# mkdir /srv/{pillar,salt}/base -p
1.2.2 关闭salt-minion服务
使用 masterless 模式时是不需要启动salt-minion
[root@localhost ~]# systemctl status salt-minion.service
● salt-minion.service - The Salt Minion
Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; disabled; vendor preset: disabled)
Active: inactive (dead)
Docs: man:salt-minion(1)
file:///usr/share/doc/salt/html/contents.html
https://docs.saltproject.io/en/latest/contents.html
1.2.3 salt-call
masterless模式执行模块或状态时需要使用salt-call命令，而不再是salt或者salt-ssh。需要注意的是要使用salt-call的–local选项。
//执行模块
[root@localhost ~]# salt-call --local test.ping
local:
True
[root@localhost ~]# salt-call --local cmd.run 'date'
local:
Mon Nov 29 19:01:27 CST 2021
//执行状态
[root@localhost ~]# cat /srv/salt/base/init/firewall/main.sls
firewalld.service:
service.dead:
- enable: false
[root@localhost ~]# salt-call --local state.sls init.firewall.main
local:
----------
ID: firewalld.service
Function: service.dead
Result: True
Comment: Service firewalld.service has been disabled, and is dead
Started: 19:03:51.166040
Duration: 726.519 ms
Changes:
----------
firewalld.service:
True
Summary for local
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 726.519 ms
[root@localhost ~]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
2. salt-master高可用
2.1 salt-master高可用配置
我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。salt的高可用配置非常简单，只需要改一下minion配置文件，将master用列表的形式列出即可。
| 主机名 | IP | 安装的服务 |
|---|---|---|
| master(主) | 192.168.237.167 | salt-master |
| master2(备) | 192.168.237.137 | salt-master |
| node1 | 192.168.237.138 | salt-minion |
- 先部署出来一个salt-master和salt-minion架构，并且保证两种可以正常通讯
//下载minion
[root@node1 ~]# yum -y install salt-minion
//修改配置文件
[root@node1 ~]# vim /etc/salt/minion
......
#master: salt
master: 192.168.237.167
......
//启动服务
[root@node1 ~]# systemctl enable --now salt-minion.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.
//公钥和私钥已生成
[root@node1 ~]# ls /etc/salt/pki/minion/
minion.pem minion.pub
//在master上接受公钥
[root@master ~]# salt-key -ya node1 //接受公钥
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@master ~]# salt-key -L
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
master
Rejected Keys:
//测试连通性
[root@master ~]# salt 'node1' test.ping
node1:
True
- 在备机上安装salt-master，并且要将主master上的key拷贝到备主机上。然后启动备机的服务
//安装salt-master [root@master2 ~]# yum -y install salt-master //此时备节点master没有key [root@master2 ~]# tree /etc/salt/pki /etc/salt/pki ├── master └── minion 2 directories, 0 files //拷贝主master上的key到备节点，只拷贝master的key，不拷贝minion的key [root@master pki]# pwd /etc/salt/pki [root@master pki]# ls master/ master.pem master.pub minions minions_autosign minions_denied minions_pre minions_rejected ssh [root@master pki]# scp master/master.p* 192.168.237.137:/etc/salt/pki/master/ //拷贝master.pem、master.pub root@192.168.237.137's password: master.pem 100% 1679 1.5MB/s 00:00 master.pub 100% 451 543.0KB/s 00:00 //备节点已接收主节点的key [root@master2 ~]# tree /etc/salt/pki /etc/salt/pki ├── master │ ├── master.pem │ └── master.pub └── minion 2 directories, 2 files //启动服务 [root@master2 ~]# systemctl enable --now salt-master.service Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.
- minion端连接备节点
[root@node1 ~]# vim /etc/salt/minion
......
#master: salt
master: 192.168.237.137
......
//重启服务
[root@node1 ~]# systemctl restart salt-minion.service
//备节点接收key
[root@master2 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
Rejected Keys:
[root@master2 ~]# salt-key -ya node1
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@master2 ~]# salt-key -L
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
Rejected Keys:
//测试连通性
[root@master2 ~]# salt 'node1' test.ping
node1:
True
- 修改minion配置文件，配置主备
[root@node1 ~]# vim /etc/salt/minion
......
master:
- 192.168.237.167
- 192.168.237.137
......
# beacons) without a master connection
master_type: failover //故障转移，主备切换
......
# of TCP connections, such as load balancers.)
master_alive_interval: 3 //转移时间
//重启minion
[root@node1 ~]# systemctl restart salt-minion.service
//此时只有主节点能ping通node1，备节点无法ping通
[root@master ~]# salt 'node1' test.ping
node1:
True
[root@master2 ~]# salt 'node1' test.ping
node1:
Minion did not return. [No response]
The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:
salt-run jobs.lookup_jid 20211130043805387446
ERROR: Minions returned with non-zero exit code
//模拟主节点故障
//主节点停止salt-master
[root@master ~]# systemctl stop salt-master.service
//备节点测试能否接管服务
[root@master2 ~]# salt 'node1' test.ping
node1:
True
//在node1上查看状态，提示主节点已切换
[root@node1 ~]# systemctl status salt-minion.service
● salt-minion.service - The Salt Minion
Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2021-11-30 12:36:38 CST; 4min 21s ago
Docs: man:salt-minion(1)
Main PID: 130040 (salt-minion)
Tasks: 6 (limit: 11217)
Memory: 100.9M
CGroup: /system.slice/salt-minion.service
├─130040 /usr/bin/python3.6 /usr/bin/salt-minion
├─130068 /usr/bin/python3.6 /usr/bin/salt-minion
└─130070 /usr/bin/python3.6 /usr/bin/salt-minion
11月 30 12:36:37 node1 systemd[1]: salt-minion.service: Succeeded.
11月 30 12:36:37 node1 systemd[1]: Stopped The Salt Minion.
11月 30 12:36:37 node1 systemd[1]: Starting The Salt Minion...
11月 30 12:36:38 node1 systemd[1]: Started The Salt Minion.
11月 30 12:36:43 node1 salt-minion[130040]: [CRITICAL] 'master_type' set to 'failover' but 'retry_dns' is not 0. Setting 'retry_dns' to 0 to failover to the next master on DNS errors.
11月 30 12:39:40 node1 salt-minion[130040]: [WARNING ] Master ip address changed from 192.168.237.167 to 192.168.237.137
11月 30 12:39:40 node1 salt-minion[130040]: [WARNING ] Master ip address changed from 192.168.237.167 to 192.168.237.137
2.2 salt-master高可用之数据同步
涉及到高可用时，数据的同步是个永恒的话题，我们必须保证高可用的2个master间使用的数据是一致的，包括：
- /etc/salt/master配置文件
- /etc/salt/pki目录下的所有key
- /srv/下的salt和pillar目录下的所有文件
保障这些数据同步的方案有：
- nfs挂载
- rsync同步
- 使用gitlab进行版本控制
安全相关：
为保证数据的同步与防止丢失，可将状态文件通过gitlab进行版本控制管理。
优势：
- 可以通过syndic实现更复杂的salt架构
- 减轻master的负担
劣势：
- syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致，所以要进行数据同步，同步方案同salt-master高可用
- 最顶层的master不知道自己有几个syndic，它只知道自己有多少个minion，并不知道这些minion是由哪些syndic来管理的
| 主机IP | 角色 | 安装的应用 |
|---|---|---|
| 192.168.237.167 | Master | salt-master |
| 192.168.237.137 | Syndic | salt-master salt-syndic |
| 192.168.237.138 | Minion | salt-minion |
| 192.168.237.131 | Minion | salt-minion |
- 根据环境说明在相应的主机上安装相应的软件
[root@master ~]# yum -y install salt-master [root@syndic ~]# yum -y install salt-master [root@syndic ~]# yum -y install salt-syndic [root@node1 ~]# yum -y install salt-minion [root@node2 ~]# yum -y install salt-minion
- 修改master的master的配置文件 #这里的master是角色master这台主机
- 取消注释order_master
- 将order_master的值设为True
[root@master ~]# vim /etc/salt/master ...... # masters' syndic interfaces. order_masters: true ...... [root@master ~]# systemctl restart salt-master.service
- 修改syndic所在主机的master配置文件
- 取消注释syndic_master
- 将syndic_master的值设为master的IP //这里的IP指的是角色为master的主机IP
[root@syndic ~]# vim /etc/salt/master ...... syndic_master: 192.168.237.167 ...... [root@syndic ~]# systemctl enable --now salt-master.service Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service. [root@syndic ~]# systemctl enable --now salt-syndic.service Created symlink /etc/systemd/system/multi-user.target.wants/salt-syndic.service → /usr/lib/systemd/system/salt-syndic.service.
- 配置所有的minion，将master指向syndic所在的主机
[root@node1 ~]# vim /etc/salt/minion ...... #master: salt master: 192.168.237.137 ...... [root@node1 ~]# systemctl enable --now salt-minion.service Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service. [root@node2 ~]# vim /etc/salt/minion ...... #master: salt master: 192.168.237.137 ...... [root@node2 ~]# systemctl enable --now salt-minion.service Created symlink from /etc/systemd/system/multi-user.target.wants/salt-minion.service to /usr/lib/systemd/system/salt-minion.service.
- 在syndic上接受minion端的主机key(公钥)
[root@syndic ~]# salt-key -L Accepted Keys: Denied Keys: Unaccepted Keys: node1 node2 Rejected Keys: [root@syndic ~]# salt-key -yA The following keys are going to be accepted: Unaccepted Keys: node1 node2 Key for minion node1 accepted. Key for minion node2 accepted. [root@syndic ~]# salt-key -L Accepted Keys: node1 node2 Denied Keys: Unaccepted Keys: Rejected Keys:
- 在master上接受syndic主机的key(公钥)
[root@master ~]# salt-key -L Accepted Keys: Denied Keys: Unaccepted Keys: master syndic Rejected Keys: [root@master ~]# salt-key -ya syndic The following keys are going to be accepted: Unaccepted Keys: syndic Key for minion syndic accepted. [root@master ~]# salt-key -L Accepted Keys: syndic Denied Keys: Unaccepted Keys: master Rejected Keys:
- 执行模块
[root@master ~]# salt '*' test.ping
node1:
True
node2:
True
[root@master ~]# salt '*' cmd.run date
node1:
Tue Nov 30 14:01:45 CST 2021
node2:
Tue Nov 30 14:01:47 CST 2021
