masterless、salt-master高可用、salt-syndic_综合

SaltStack进阶

masterless的应用

应用场景
master 与 minion 网络不通或通信有延迟，即网络不稳定
想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到 masterless 了。

masterless配置

修改配置文件minion

注释master行
取消注释file_client并设其值为local
设置file_roots
设置pillar_roots

[root@node1 ~]# vim /etc/salt/minion
# master: salt
#master: 192.168.71.128  /
file_client: local  /file_roots:  base:- /srv/salt/basepillar_roots:  //设置pillar，pillar变量存放位置base:- /srv/pillar/base关闭salt-minion
[root@node1 base]# systemctl stop salt-minion.service

salt-call命令

[root@node1 base]# tree packages/
packages/
└── main.sls0 directories, 1 file
[root@node1 base]# cat packages/main.sls 
wget:pkg.installed[root@node1 base]# salt-call --local state.sls packages.main
local:
----------ID: wgetFunction: pkg.installedResult: TrueComment: All specified packages are already installedStarted: 16:28:37.129878Duration: 548.88 msChanges:   Summary for local
------------
Succeeded: 1
Failed:    0
------------
Total states run:     1
Total run time: 548.880 ms

salt-call

[root@node1 base]# tree packages/
packages/
└── main.sls0 directories, 1 file
[root@node1 base]# cat packages/main.sls 
wget:pkg.installed[root@node1 base]# salt-call --local state.sls packages.main
local:
----------ID: wgetFunction: pkg.installedResult: TrueComment: All specified packages are already installedStarted: 23:12:37.129878Duration: 548.88 msChanges:   Summary for local
------------
Succeeded: 1
Failed:    0
------------
Total states run:     1
Total run time: 548.880 ms

salt-master高可用
我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。

系统	IP	主机名
redhat8	192.168.71.128	master
redhat8	192.168.71.142	master-2
redhat8	192.168.71.143	node1

//其他两台也一样
curl -fsSL https://repo.saltproject.io/py3/redhat/8/x86_64/latest.repo | sudo tee /etc/yum.repos.d/salt.repo

// 在两台master上做下面的操作
yum -y install salt-master
[root@node1 ~]# yum -y install salt-minion

修改node1的配置文件

[root@node1 ~]# vim /etc/salt/minion
17 master: 192.168.71.128[root@node1 ~]# systemctl start salt-minion.service   //开启salt-minion服务，然后到/etc/salt/pki/minion查看是否生成两个公钥文件[root@master ~]# salt-key -ya node1 
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@master ~]# salt-key -L
Accepted Keys:
node1

测试连通性

[root@master ~]# salt node1 test.ping
node1:True

master-2

//将master上的公钥文件拷贝到master02上
[root@master master]# scp /etc/salt/pki/master/master.p* 192.168.71.142:/etc/salt/pki/master/[root@node1 ~]# vim /etc/salt/minion
master: 192.168.71.142
[root@node1 ~]# systemctl restart salt-minion.service[root@master02 minion]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
Rejected Keys:[root@master02 minion]# salt-key -yA

测试连通性

[root@master02 srv]# salt node1 test.ping
node1:True

salt-master高可用之数据同步
涉及到高可用时，数据的同步是个永恒的话题，我们必须保证高可用的2个master间使用的数据是一致的，包括：

/etc/salt/master配置文件
/etc/salt/pki目录下的所有key
/srv/下的salt和pillar目录下的所有文件
保障这些数据同步的方案有：

nfs挂载
rsync同步
使用gitlab进行版本控制
修改配置文件node1上的配置

[root@node1 ~]# vim /etc/salt/minion
master: - 192.168.71.128- 192.168.71.142master_type: failover  //这个表示高可用，故障转移
master_alive_interval: 10  //这个表示当主节点的master宕机10秒后去接管备的master
[root@node1 ~]# systemctl restart salt-minion.service  //重启服务

测试

[root@master ~]# salt node1 test.ping
node1:True[root@master-2 ~]# salt node1 test.ping
node1:Minion did not return. [No response]The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:salt-run jobs.lookup_jid 20211130012202357218// 模拟主节点故障
[root@master ~]# systemctl stop salt-master.service [root@master-2 ~]# salt node1 test.ping
node1:True

执行状态模块

[root@master ~]# scp /etc/salt/master 192.168.71.142:/etc/salt/master
[root@master-2 ~]# mkdir -p /srv/{pillar,salt}/base[root@master ~]# scp -r  /srv/salt/base/* 192.168.71.142:/srv/salt/base/[root@master ~]# scp  /srv/pillar/base/* 192.168.71.142:/srv/pillar/base[root@master-2 init]# pwd
/srv/salt/base/init[root@master-2 yum]# tree   //执行此状态文件
.
├── files
│   ├── centos-7.repo
│   ├── centos-8.repo
│   ├── epel-7.repo
│   ├── epel-8.repo
│   ├── salt-7.repo
│   └── salt-8.repo
└── main.sls[root@master-2 yum]# salt node1 state.sls init.yum.main saltenv=base
node1:
----------ID: /etc/yum.repos.d/centos-8.repoFunction: file.managedResult: TrueComment: File /etc/yum.repos.d/centos-8.repo updatedStarted: 22:00:29.543836Duration: 173.194 msChanges:   ----------diff:New filemode:0644
----------ID: /etc/yum.repos.d/epel-8.repoFunction: file.managedResult: TrueComment: File /etc/yum.repos.d/epel-8.repo updatedStarted: 00:00:29.717251Duration: 32.064 msChanges:   ----------diff:New filemode:0644
----------ID: /etc/yum.repos.d/salt-8.repoFunction: file.managedResult: TrueComment: File /etc/yum.repos.d/salt-8.repo updatedStarted: 00:00:29.749628Duration: 44.853 msChanges:   ----------diff:New filemode:0644Summary for node1
------------
Succeeded: 3 (changed=3)
Failed:    0
------------
Total states run:     3
Total run time: 250.111 ms

salt-syndic分布式架构

salt-syndic架构图
在这里插入图片描述
salt-syndic的优劣势
优势：
可以通过syndic实现更复杂的salt架构
减轻master的负担

劣势：
syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致，所以要进行数据同步，同步方案同salt-master高可用
最顶层的master不知道自己有几个syndic，它只知道自己有多少个minion，并不知道这些minion是由哪些syndic来管理的

salt-syndic部署

环境说明：

主机	IP	角色	安装的应用
redhat8	192.168.71.128	master	salt-master
redhat8	192.168.71.142	Syndic	salt-master salt-syndic
redhat8	192.168.71.143	minion	salt-minion
redhat8	192.168.71.144	minion	salt-minion

安装salt-master与salt-syndic

在Syndic主机上安装salt-master和salt-syndic

先安装salt源
[root@syndic ~]# curl -fsSL https://repo.saltproject.io/py3/redhat/8/x86_64/latest.repo | sudo tee /etc/yum.repos.d/salt.repo[root@syndic ~]# yum -y install salt-master salt-syndic在minion端安装salt-minion
[root@minion01 ~]# curl -fsSL https://repo.saltproject.io/py3/redhat/8/x86_64/latest.repo | sudo tee /etc/yum.repos.d/salt.repo[root@minion01 ~]# yum -y install salt-minion
[root@minion02 ~]# yum -y install salt-minion

配置master
修改master的master配置文件

取消注释order_master
将order_master的值设为True

[root@master salt]# vim /etc/salt/master
order_masters: True
[root@master salt]# systemctl restart salt-master.service

配置syndic
修改syndic所在主机的master配置文件

取消注释syndic_master
将syndic_master的值设为master的IP

[root@syndic ~]# vim /etc/salt/master
syndic_master: 192.168.71.128//将salt-master和salt-syndic设置为开机自启
[root@syndic ~]# systemctl enable --now salt-master.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.
[root@syndic ~]# systemctl enable --now salt-syndic.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-syndic.service → /usr/lib/systemd/system/salt-syndic.service.

配置minion
配置minion，将master指向syndic所在主机

[root@minion01 ~]# vim /etc/salt/minion
master: 192.168.71.142[root@minion02 ~]# vim /etc/salt/minion
master: 192.168.71.142重启服务并设置开机自启
[root@minion01 ~]# systemctl restart salt-minion.service 
[root@minion01 ~]# systemctl enable --now salt-minion.service [root@minion02 ~]# systemctl restart salt-minion.service 
[root@minion02 ~]# systemctl enable --now salt-minion.service

在所有minion上做同样的操作，注意，要设置minion配置文件中的id参数，指向minion自身的ip地址或主机名，必须能够唯一标识minion本机。

在syndic上接受minion主机的key
[root@syndic ~]# salt-key -yA在master上接受syndic主机的key
[root@master salt]# salt-key -ya syndic

在master上执行模块或状态检验有几个minion应答

[root@master salt]# salt '*' test.ping
node3:True
Minion01:True[root@syndic ~]# mkdir -p  /srv/salt/base
[root@master ~]# scp -r /srv/salt/base/init/* 192.168.71.142:/srv/salt/base/[root@master ~]# salt '*' state.sls init.history.main
node3:
----------ID: /etc/profileFunction: file.appendResult: TrueComment: Appended 1 linesStarted: 10:45:18.572951Duration: 73.275 msChanges:   ----------diff:--- +++ @@ -83,3 +83,4 @@. /etc/bashrcfifi+export HISTTIMEFORMAT="%F %T `whoami`" Summary for node3
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time:  73.275 ms
Minion01:
----------ID: /etc/profileFunction: file.appendResult: TrueComment: Appended 1 linesStarted: 10:45:20.060263Duration: 51.445 msChanges:   ----------diff:--- +++ @@ -83,3 +83,4 @@. /etc/bashrcfifi+export HISTTIMEFORMAT="%F %T `whoami`" Summary for Minion01
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time:  51.445 ms