4.5 Saltstack进阶之master高可用和salt-syndic分布式架构

1. masterless

1.1 应用场景

• master 与 minion 网络不通或通信有延迟，即网络不稳定
• 想在 minion 端直接执行状态

传统的 SaltStack 需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态就需要用到masterless 了。

有了masterless，即使只有一台主机，也能使用saltstack，而不需要有N台主机架构。

1.2 masterless配置

1.2.1 修改配置文件minion

• 注释master行
• 取消注释file_client并设其值为local
• 设置file_roots
• 设置pillar_roots

[root@localhost ~]# vi /etc/salt/minion
....
#master: salt
file_client: local
file_roots:
  base:
    - /srv/salt/base
  prod:
    - /srv/salt/prod
pillar_roots:
  base:
    - /srv/pillar/base
  prod:
    - /srv/pillar/prod

1.2.2 关闭salt-minion服务

使用 masterless 模式时不需要启动salt任何服务，包括salt-master和salt-minion。

[root@localhost ~]# systemctl disable --now salt-minion
[root@localhost ~]# systemctl status salt-minion
● salt-minion.service - The Salt Minion
   Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:salt-minion(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltstack.com/en/latest/contents.html

1.2.3 salt-call

masterless模式执行模块或状态时使用salt-call命令，而不再是salt或者salt-ssh。
注意：使用salt-call需要加–local选项。

[root@localhost ~]# salt-call --local cmd.run 'ls /root'
local:
    anaconda-ks.cfg
[root@localhost ~]# salt-call --local cmd.run 'uptime'
local:
     22:36:51 up 4 days, 13:50,  2 users,  load average: 0.00, 0.01, 0.05

2. salt-master高可用

2.1 salt-master高可用配置

本次实验使用三台设备：master、node01、node02。其中node01作为备master，node02为minion端
1.安装salt

[root@master ~]# yum -y install salt-master
[root@master ~]# systemctl start salt-master

[root@node01 ~]# yum -y install salt-master
 
[root@node02 ~]# yum -y install salt-minion

2. 在master端介绍minion端key

[root@master~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node02.example.com
Rejected Keys:
[root@master ~]# salt-key -Ay
The following keys are going to be accepted:
Unaccepted Keys:
node02.example.com
Key for minion node02.example.com accepted.

3. 在master上开启master_sign_pubkey

[root@master ~]# vi /etc/salt/master
...省略N行
master_sign_pubkey: True
···
[root@master ~]# systemctl restart salt-master
[root@master ~]# tree /etc/salt/pki/
.
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── master_sign.pem
│   ├── master_sign.pub
│   ├── minions
│   │   └── node02.example.com
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   │   └── node02.example.com
│   ├── minions_rejected
│   └── ssh
│       ├── salt-ssh.rsa
│       └── salt-ssh.rsa.pub
└── minion
    ├── minion_master.pub
    ├── minion.pem
    └── minion.pub

8 directories, 11 files

4. 在node01同步master数据，将master的pki中的所有数据同步到node01

[root@master pki]# scp /etc/salt/master [email protected]:/etc/salt/
[root@master pki]# scp -r /etc/salt/pki/* [email protected]:/etc/salt/pki/

5. 在node01上重启服务,查看

[root@node01 pki]# systemctl restart salt-master
[root@node01 pki]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── master_sign.pem
│   ├── master_sign.pub
│   ├── minions
│   │   └── node02.example.com
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   ├── minions_rejected
│   └── ssh
│       ├── salt-ssh.rsa
│       └── salt-ssh.rsa.pub
└── minion
    ├── minion_master.pub
    ├── minion.pem
    └── minion.pub

8 directories, 10 files

6. 将master的/etc/salt/pki/master/master_sign.pub 传到minion端node02上面去

[root@master pki]# scp /etc/salt/pki/master/master_sign.pub [email protected]:/etc/salt/pki/minion/
[root@node02 ~]# tree /etc/salt/pki/minion/
/etc/salt/pki/minion/
├── master_sign.pub
├── minion_master.pub
├── minion.pem
└── minion.pub

7. 设置node02的配置文件,重启服务

[root@node02 ~]# tail /etc/salt/minion
#event_match_type: startswith
master:
  - 192.168.80.130
  - 192.168.80.10
master_type: failover
master_shuffle: True
master_alive_interval: 1

verify_master_pubkey_sign: True
alway_verify_signature: True
[root@node02 ~]# systemctl restart salt-minion

8. 在node02测试一下

[root@node02 ~]# salt-minion -l debug
/usr/lib/python2.7/site-packages/salt/scripts.py:212: DeprecationWarning: Python 2.7 will reach the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 won't be maintained after that date.  Salt will drop support for Python 2.7 in the Sodium release or later.
[DEBUG   ] Reading configuration from /etc/salt/minion
[DEBUG   ] Including configuration from '/etc/salt/minion.d/_schedule.conf'
[DEBUG   ] Reading configuration from /etc/salt/minion.d/_schedule.conf
[DEBUG   ] Using cached minion ID from /etc/salt/minion_id: node02.example.com
[DEBUG   ] Configuration file path: /etc/salt/minion
[WARNING ] Insecure logging configuration detected! Sensitive data may be logged.
[INFO    ] Setting up the Salt Minion "node02.example.com"
[INFO    ] An instance is already running. Exiting the Salt Minion
[INFO    ] Shutting down the Salt Minion
[DEBUG   ] Stopping the multiprocessing logging queue listener
[DEBUG   ] closing multiprocessing queue
[DEBUG   ] joining multiprocessing queue thread
[DEBUG   ] Stopped the multiprocessing logging queue listener
The Salt Minion is shutdown.

9. 进行测试,当在master可以ping通minion端，node01就ping不通

[root@master pki]# salt '*' test.ping
node02.example.com:
    True
[root@node01 pki]# salt '*' test.ping
node02.example.com:
    Minion did not return. [No response]

10. 停止master的服务，node01就能ping通

[root@master pki]# systemctl stop salt-master
[root@node01 pki]# salt '*' test.ping
node02.example.com:
    True

3. salt-syndic分布式架构

3.1 salt-syndic架构

3.2 salt-syndic部署

3.2.1 环境说明

主机ip	角色	主机名	安装应用
192.168.80.130	master	master	salt-master
192.168.80.10	syndic	node01	salt-master salt-syndic
192.168.80.11	minion	node02	salt-minion

3.2.2 安装软件

在master上安装salt-master

[root@master ~]# yum -y install salt-master

在syndic上安装salt-master和salt-syndic

[root@node01 ~]# yum -y install salt-master salt-syndic

在minion上安装salt-minion

[root@node02 ~]# yum -y install salt-minion

3.2.3 配置master端

在master的配置文件将order_master的值设为True

[root@master ~]# vim /etc/salt/master
...省略N行
order_masters: True

3.2.4 配置syndic端

在syndic的配置文件上将syndic_master的值设为master的IP

[root@node01 ~]# vi /etc/salt/master
...省略N行
syndic_master: 192.168.80.130
...

3.2.5 配置minion端

在minion上将master指向syndic所在主机

[root@node02 salt]# vim /etc/salt/minion
···省略N行
master: 192.168.80.10
···

3.2.6 syndic接受minion主机的key

[root@node01 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node02.example.com
Rejected Keys:
[root@node01 ~]# salt-key -Ay
The following keys are going to be accepted:
Unaccepted Keys:
node02.example.com
Key for minion node02.example.com accepted.

3.7 master接受syndic主机的key

[root@master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node01.example.com
Rejected Keys:
[root@master ~]# salt-key -Ay
The following keys are going to be accepted:
Unaccepted Keys:
node01.example.com
Key for minion node01.example.com accepted.

3.8 在master端进行测试

master进行的ping的时候是minion端进行答应，而不是syndic

[root@master ~]# salt '*' test.ping
node02.example.com:
    True