Saltstack 简介
• Saltstack是基于python开发的一套C/S架构配置管理工具
• 使用SSL证书签方的方式进行认证管理
• 底层使用ZeroMQ消息队列pub/sub方式通信
– 号称世界上最快的消息队列ZeroMQ能快速在成千上万台主机上进行各种操作
– 采用RSA Key方式确认身主要功能：
• Saltstack最主要的两个功能是:配置管理与远程执行
• Saltstack不只是一个配置管理工具,还是一个云计算与数据中心架构编排的利器
• Saltstack已经支持Docker相关模块
• 在友好地支持各大云平台之后,配合Saltstack的Mine实时发现功能可以实现各种云平台业务的自动扩展Saltstack架构：
• Saltstack基于C/S架构
– 服务器端称作Master
– 客户端称作Minion
• 可以实现传统处理方式,即:客户端发送请求给服务器,服务器收到请求后处理请求,再将结果返回
• 也可以使用消息队列中的发布与订阅(pub/sub)服务模式Saltstack工作机制
• Master和Minion都以守护进程的方式运行
• Master监听配置文件里定义的ret_port(接收minion请求),和publish_port(发布消息)的端口
• 当Minion运行时,它会自动连接到配置文件里定义的Master地址ret_port端口进行连接认证
• 当Master和Minion可以正常通信后,就可以进行各种各样的配置管理工作了实验环境：
Salt-master:server1 172.25.254.12 均为企业6版本虚拟机
Salt-minion:server2 172.25.254.13
Salt-minion:server3 172.25.254.14在物理主机将rhe6 的软件包放在/var/www/html里面
[root@foundation84 ~]# cd /home/kiosk/Desktop/
[root@foundation84 Desktop]# ls
ansible jisuxz_Dilraba_33.jpg rhel6.tar.gz root@172.25.254.12
[root@foundation84 Desktop]# tar zxf rhel6.tar.gz -C /var/www/html/
[root@foundation84 Desktop]# cd /var/www/html/
[root@foundation84 html]# ls
ks.cfg mysqladmin rhel6 source6.5 source7.0 source7.1
[root@foundation84 html]# chmod 555 rhel6/ -R
[root@foundation84 html]# ls
ks.cfg mysqladmin rhel6 source6.5 source7.0 source7.1
Server1、server2、server3均进行相同的操作:
演示server1的操作：
[root@server1 yum.repos.d]# vim rhel-source.repo
[root@server1 yum.repos.d]# yum repolist
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
rhel-source | 3.9 kB 00:00
salt | 2.9 kB 00:00
salt/primary_db | 16 kB 00:00
repo id repo name status
rhel-source Red Hat Enterprise Linux 6Server - x86_64 - Source 3,690
salt saltstack 29
repolist: 3,719
[root@server1 yum.repos.d]# cat rhel-source.repo
[rhel-source]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=http://172.25.254.84/source6.5
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
[salt]
name=saltstack
baseurl=http://172.25.254.84/rhel6
gpgcheck=0
在server1：
[root@server1 salt]# yum install salt-master -y
[root@server1 ~]# cd /etc/salt/
[root@server1 salt]# ls
cloud cloud.maps.d master minion.d proxy.d
cloud.conf.d cloud.profiles.d master.d pki roster
cloud.deploy.d cloud.providers.d minion proxy
[root@server1 salt]# vim master 冒号后面必须有空格，这个是YAML的语法格式
[root@server1 salt]# /etc/init.d/salt-master start
Starting salt-master daemon: [ OK ]
在server2和server3进行相同的配置：
[root@server2 ~]# yum install salt-minion -y
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Setting up Install Process
Package salt-minion-2016.11.3-1.el6.noarch already installed and latest version
Nothing to do
[root@server2 ~]# cd /etc/salt/
[root@server2 salt]# ls
cloud cloud.maps.d master minion.d proxy.d
cloud.conf.d cloud.profiles.d master.d pki roster
cloud.deploy.d cloud.providers.d minion proxy
[root@server2 salt]# vim minion 注意冒号后面有空格
[root@server2 salt]# /etc/init.d/salt-minion start
Starting salt-minion:root:server2 daemon: OK
在server1交换公钥：
[root@server1 salt]#
[root@server1 salt]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
server2
server3
Rejected Keys:
[root@server1 salt]# salt-key -A
The following keys are going to be accepted:
Unaccepted Keys:
server2
server3
Proceed? [n/Y] y
Key for minion server2 accepted.
Key for minion server3 accepted.
[root@server1 salt]# salt-key -L
Accepted Keys:
server2
server3
Denied Keys:
Unaccepted Keys:
Rejected Keys:
分别在server1，server2和server3查看密钥是否交换成功：
[root@server1 salt]# cd pki/master/
[root@server1 master]# md5sum master.pub
1a37902a4eff1dd86d773c9ebddc4a89 master.pub
server2和server3分别与其对应密钥传递成功：
进行简单的测试：
[root@server1 ~]# salt * test.ping
server2:
True
server3:
True
[root@server1 ~]# salt * cmd.run 'df -h'
server2:
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root 19G 972M 17G 6% /
tmpfs 246M 16K 246M 1% /dev/shm
/dev/vda1 485M 33M 427M 8% /boot
server3:
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup-lv_root 19G 972M 17G 6% /
tmpfs 246M 16K 246M 1% /dev/shm
/dev/vda1 485M 33M 427M 8% /boot
[root@server1 ~]# salt * cmd.run hostname
server2:
server2
server3:
server3
在server1查看信息：
[root@server1 master]# yum install -y tree
[root@server1 master]# tree
.
├── master.pem
├── master.pub
├── minions
│ ├── server2
│ └── server3
├── minions_autosign
├── minions_denied
├── minions_pre
└── minions_rejected
5 directories, 4 files
查看端口运行情况：
[root@server1 ~]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 907/sshd
tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN 1110/python2.6
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 983/master
tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN 1117/python2.6
tcp 0 0 172.25.38.1:4505 172.25.38.2:60648 ESTABLISHED 1110/python2.6
tcp 0 0 172.25.38.1:22 172.25.38.250:49252 ESTABLISHED 1049/sshd
tcp 0 0 172.25.38.1:4505 172.25.38.3:50419 ESTABLISHED 1110/python2.6
tcp 0 0 :::22 :::* LISTEN 907/sshd
tcp 0 0 ::1:25 :::* LISTEN 983/master 
在后端查看端口：
[root@server2 salt]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 879/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 955/master
tcp 0 0 172.25.38.2:22 172.25.38.250:42660 ESTABLISHED 1356/sshd
tcp 0 0 172.25.38.2:60648 172.25.38.1:4505 ESTABLISHED 1720/python2.6
tcp 0 0 :::22 :::* LISTEN 879/sshd
tcp 0 0 ::1:25 :::* LISTEN 955/master 
4505端口是长链接：
[root@server1 master]# yum install lsof -y
[root@server1 master]# lsof -i :4505
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
salt-mast 1624 root 16u IPv4 15321 0t0 TCP server1:4505 (LISTEN)
salt-mast 1624 root 18u IPv4 18286 0t0 TCP server1:4505->server3:34084 (ESTABLISHED)
salt-mast 1624 root 19u IPv4 18299 0t0 TCP server1:4505->server2:45935 (ESTABLISHED)
4506端口是请求与响应：
[root@server1 ~]# lsof -i :4506
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
salt-mast 1117 root 24u IPv4 13816 0t0 TCP *:4506 (LISTEN)
[root@server1 ~]# 
查看python端口情况：
[root@server1 master]# yum install python-setproctitle.x86_64 -y
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Setting up Install Process
Package python-setproctitle-1.1.7-2.el6.x86_64 already installed and latest version
Nothing to do
[root@server1 master]# /etc/init.d/salt-master restart
Stopping salt-master daemon: [ OK ]
Starting salt-master daemon: [ OK ]
[root@server1 master]# ps ax
了解YAML
默认的SLS文件的renderer是YAML renderer。YAML是一个有很多强大
特性的标记性语言。Salt使用了一个YAML的小型子集，映射非常常用的
数据结构，像列表和字典。YAML renderer的工作是将YAML数据格式的
结构编译成为Python数据结构给Salt使用。
尽管YAML语法可能第一眼看上去很简洁但令人畏惧，但是只要记住三个
非常简单的规则就可以使用YAML语法写SLS文件了。规则一: 缩进
YAML使用一个固定的缩进风格表示数据层结构关系。Salt需要每个缩进级别
由两个空格组成。不要使用tabs。规则二: 冒号
Python的字典当然理所当然是简单的键值对。其他语言的用户应该
知道这个数据类型叫哈希表或者关联数组。
字典的keys在YAML中的表现形式是一个以冒号结尾的字符串。Values的
表现形式冒号下面的每一行，用一个空格隔开:
my_key: my_value
在Python中，上面的将映射为:
{'my_key': 'my_value'}
另一种选择，一个value可以通过缩进与key联接。
my_key:
my_value
注解
上面的语法是有效的YAML，但是在SLS文件罕见，因为通常情况下，一个key
的value不是单一的，而是一个 列表 的values。
在Python中，上面的将映射为:
{'my_key': 'my_value'}
字典可以被嵌套:
first_level_dict_key:
second_level_dict_key: value_in_second_level_dict
在Python中:
{
'first_level_dict_key': {
'second_level_dict_key': 'value_in_second_level_dict'
}
}规则三: 短横杠
想要表示列表项，使用一个短横杠加一个空格。多个项使用同样的缩进
级别作为同一列表的一部分。
- list_value_one
- list_value_two
- list_value_three
列表可以可以作为一个键值对的value。这个在Salt很常见:
my_dictionary:
- list_value_one
- list_value_two
- list_value_three
在Python中，上面的将映射为:
{'my_dictionary': ['list_value_one', 'list_value_two', 'list_value_three']}部署远程安装php，httpd:
[root@server1 master]# vim /etc/salt/master
[root@server1 master]# vim /etc/salt/master
[root@server1 master]# ls /srv/
[root@server1 master]# mkdir /srv/salt
[root@server1 master]# /etc/init.d/salt-master restart
Stopping salt-master daemon: [ OK ]
Starting salt-master daemon: [ OK ]
[root@server1 master]# cd /srv/salt/
[root@server1 salt]# mkdir httpd
[root@server1 salt]# cd httpd/
[root@server1 httpd]# vim apache.sls
[root@server1 httpd]# cat apache.sls 部署脚本遵循YAML语法格式
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
[root@server1 httpd]# salt server2 state.sls httpd.apache test=true 测试连接
server2:
----------
ID: apache-install
Function: pkg.installed
Result: None
Comment: The following packages would be installed/updated: httpd, php
Started: 00:18:10.775807
Duration: 342.709 ms
Changes:
Summary for server2
------------
Succeeded: 1 (unchanged=1)
Failed: 0
------------
Total states run: 1
Total run time: 342.709 ms
[root@server1 httpd]# salt server2 state.sls httpd.apache 远程推送
server2:
----------
ID: apache-install
Function: pkg.installed
Result: True
Comment: The following packages were installed/updated: httpd, php
Started: 00:18:24.400334
Duration: 8450.836 ms
Changes:
----------
httpd:
----------
new:
2.2.15-29.el6_4
old:
php:
----------
new:
5.3.3-26.el6
old:
php-cli:
----------
new:
5.3.3-26.el6
old:
php-common:
----------
new:
5.3.3-26.el6
old:
Summary for server2
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 8.451 s
在server2查看已经安装成功：
[root@server2 minion]# rpm -q httpd php
httpd-2.2.15-29.el6_4.x86_64
php-5.3.3-26.el6.x86_64
在server1直接部署打开服务：
[root@server1 httpd]# vim apache.sls
[root@server1 httpd]# cat apache.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
service.running:
- name: httpd
[root@server1 httpd]# salt server2 state.sls httpd.apache
server2:
----------
ID: apache-install
Function: pkg.installed
Result: True
Comment: All specified packages are already installed
Started: 10:42:22.395708
Duration: 355.899 ms
Changes:
----------
ID: apache-install
Function: service.running
Name: httpd
Result: True
Comment: Started Service httpd
Started: 10:42:22.752221
Duration: 146.04 ms
Changes:
----------
httpd:
True
Summary for server2
------------
Succeeded: 2 (changed=1)
Failed: 0
------------
Total states run: 2
Total run time: 501.939 ms
在server2查看端口80端口开启：
[root@server2 minion]# netstat -antlp
[root@server2 minion]# chkconfig --list httpd 开机不自动启动
httpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off
在server1直接部署开机打开服务：
[root@server1 httpd]# vim apache.sls
[root@server1 httpd]# cat apache.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
service.running:
- name: httpd
- enable: True
[root@server1 httpd]# salt server2 state.sls httpd.apache
server2:
----------
ID: apache-install
Function: pkg.installed
Result: True
Comment: All specified packages are already installed
Started: 10:47:15.229330
Duration: 353.012 ms
Changes:
----------
ID: apache-install
Function: service.running
Name: httpd
Result: True
Comment: Service httpd has been enabled, and is in the desired state
Started: 10:47:15.582946
Duration: 64.416 ms
Changes:
----------
httpd:
True
Summary for server2
------------
Succeeded: 2 (changed=1)
Failed: 0
------------
Total states run: 2
Total run time: 417.428 ms
在server2查看开机自动启动：
[root@server2 minion]# chkconfig --list httpd
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
更改端口：
[root@server1 httpd]# pwd
/srv/salt/httpd
[root@server1 httpd]# ls
apache.sls
[root@server1 httpd]# mkdir file2
[root@server1 httpd]# ls
apache.sls file2
[root@server1 httpd]# rm -fr file2/
[root@server1 httpd]# mkdir files
[root@server1 httpd]# ls
apache.sls files
[root@server1 httpd]# cd files/
[root@server2 minion]# scp /etc/httpd/conf/httpd.conf server1:/srv/salt/httpd/files
[root@server1 files]# ls
httpd.conf
[root@server1 files]# vim httpd.conf 
更改脚本开始推送：
[root@server1 httpd]# pwd
/srv/salt/httpd
[root@server1 httpd]# ls
apache.sls files
[root@server1 httpd]# vim apache.sls
[root@server1 httpd]# cat apache.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
file.managed:
- name: /etc/httpd/conf/httpd.conf
- source: salt://httpd/files/httpd.conf
- mode: 644
- user: root
service.running:
- name: httpd
- enable: True
- reload: True
- watch:
- file: apache-install
[root@server1 httpd]# salt server2 state.sls httpd.apache
server2:
----------
ID: apache-install
Function: pkg.installed
Result: True
Comment: All specified packages are already installed
Started: 10:59:29.698106
Duration: 353.085 ms
Changes:
----------
ID: apache-install
Function: file.managed
Name: /etc/httpd/conf/httpd.conf
Result: True
Comment: File /etc/httpd/conf/httpd.conf updated
Started: 10:59:30.052931
Duration: 63.764 ms
Changes:
----------
diff:
---
+++
@@ -133,7 +133,7 @@
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#
#Listen 12.34.56.78:80
-Listen 80
+Listen 8080
#
# Dynamic Shared Object (DSO) Support
----------
ID: apache-install
Function: service.running
Name: httpd
Result: True
Comment: Service reloaded
Started: 10:59:30.142435
Duration: 67.95 ms
Changes:
----------
httpd:
True
Summary for server2
------------
Succeeded: 3 (changed=2)
Failed: 0
------------
Total states run: 3
Total run time: 484.799 ms
在server2查看端口已经被改变：
[root@server2 minion]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 879/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 955/master
tcp 0 0 172.25.38.2:60658 172.25.38.1:4505 ESTABLISHED 1720/python2.6
tcp 0 0 172.25.38.2:22 172.25.38.250:42660 ESTABLISHED 1356/sshd
tcp 0 0 :::8080 :::* LISTEN 2040/httpd
tcp 0 0 :::22 :::* LISTEN 879/sshd
tcp 0 0 ::1:25 :::* LISTEN 955/master 
换一种方法更改端口：
[root@server1 httpd]# ls
apache.sls files
[root@server1 httpd]# vim files/httpd.conf
更改脚本开始推送：
[root@server1 httpd]# vim apache.sls
[root@server1 httpd]# cat apache.sls
apache-install:
pkg.installed:
- pkgs:
- httpd
- php
service.running:
- name: httpd
- enable: True
- reload: True
- watch:
- file: /etc/httpd/conf/httpd.conf
/etc/httpd/conf/httpd.conf:
file.managed:
- source: salt://httpd/files/httpd.conf
- mode: 644
- user: root
[root@server1 httpd]# salt server2 state.sls httpd.apache
server2:
----------
ID: apache-install
Function: pkg.installed
Result: True
Comment: All specified packages are already installed
Started: 11:08:47.698420
Duration: 356.312 ms
Changes:
----------
ID: /etc/httpd/conf/httpd.conf
Function: file.managed
Result: True
Comment: File /etc/httpd/conf/httpd.conf is in the correct state
Started: 11:08:48.057235
Duration: 40.498 ms
Changes:
----------
ID: apache-install
Function: service.running
Name: httpd
Result: True
Comment: The service httpd is already running
Started: 11:08:48.097930
Duration: 24.877 ms
Changes:
Summary for server2
------------
Succeeded: 3
Failed: 0
------------
Total states run: 3
Total run time: 421.687 ms
在server2查看端口已经变成80：
[root@server2 minion]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 879/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 955/master
tcp 0 0 172.25.38.2:60658 172.25.38.1:4505 ESTABLISHED 1720/python2.6
tcp 0 0 172.25.38.2:22 172.25.38.250:42660 ESTABLISHED 1356/sshd
tcp 0 0 :::80 :::* LISTEN 2040/httpd
tcp 0 0 :::22 :::* LISTEN 879/sshd
tcp 0 0 ::1:25 :::* LISTEN 955/master 
第三种方法更改端口：
[root@server1 httpd]# vim apache.sls
[root@server1 httpd]# ls
apache.sls files
[root@server1 httpd]# vim files/httpd.conf 
[root@server1 httpd]# salt server2 state.sls httpd.apache
server2:
----------
ID: httpd
Function: pkg.installed
Result: True
Comment: Package httpd is already installed
Started: 11:12:11.874567
Duration: 353.414 ms
Changes:
----------
ID: php
Function: pkg.installed
Result: True
Comment: Package php is already installed
Started: 11:12:12.228129
Duration: 0.465 ms
Changes:
----------
ID: /etc/httpd/conf/httpd.conf
Function: file.managed
Result: True
Comment: File /etc/httpd/conf/httpd.conf updated
Started: 11:12:12.230863
Duration: 63.448 ms
Changes:
----------
diff:
---
+++
@@ -133,7 +133,7 @@
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#
#Listen 12.34.56.78:80
-Listen 80
+Listen 8080
#
# Dynamic Shared Object (DSO) Support
----------
ID: apache
Function: service.running
Name: httpd
Result: True
Comment: Service reloaded
Started: 11:12:12.319536
Duration: 68.847 ms
Changes:
----------
httpd:
True
Summary for server2
------------
Succeeded: 4 (changed=2)
Failed: 0
------------
Total states run: 4
Total run time: 486.174 ms
[root@server1 httpd]# cat apache.sls
httpd:
pkg.installed
php:
pkg.installed
apache:
service.running:
- name: httpd
- enable: True
- reload: True
- watch:
- file: /etc/httpd/conf/httpd.conf
/etc/httpd/conf/httpd.conf:
file.managed:
- source: salt://httpd/files/httpd.conf
- mode: 644
- user: root
在server2查看端口已经变成了8080：
[root@server2 minion]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 879/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 955/master
tcp 0 0 172.25.38.2:60658 172.25.38.1:4505 ESTABLISHED 1720/python2.6
tcp 0 0 172.25.38.2:22 172.25.38.250:42660 ESTABLISHED 1356/sshd
tcp 0 0 :::8080 :::* LISTEN 2040/httpd
tcp 0 0 :::22 :::* LISTEN 879/sshd
tcp 0 0 ::1:25 :::* LISTEN 955/master 