06 saltstack生产实例

https://github.com/unixhot/saltbook-code

1.系统初始化

1.需求梳理

1.Cobbler
1.15 统一网卡名

2.Zabbix

系统已经安装好了！

base步骤
1.手动实现 2.需要使用salt的什么状态模块 3.编写sls

2.salt模块识别

系统初始化 

    1.1 关闭SELinux  - file.managed   -  /etc/selinux/config
    1.2 关闭默认iptables - service.disabled  firewalld
    1.3 时间同步（配置ntp）  -   pkg.installed  cron
    1.4 文件描述符（必备 /etc/security/limits.conf） file.managed
    1.5 内核优化(必备 tcp  内存)    sysctl
    1.6 SSH服务优化（关闭DNS解析，修改端口）  file.managed  service
    1.7 精简开机系统服务（只开启SSHD服务）   service.disabled  
    1.8 DNS解析（必备）  file.managed  /etc/resolv.conf
    1.9 历史记录优化histroy（记录时间，用户）file.managed  /etc/profile
    1.10 设置终端超时时间（安全考虑）  file.managed  /etc/profile
    1.11 配置yum源（必备）  file.managed 
    1.12 安装各种agent（必备）   pkg  file  service  jinja模板
    1.13 基础用户(应用用户 user group)，用户登录提醒，sudo权限设置（必备）
    1.14 常用基础命令，命令别名（必备 screen lrzsz  tree openssl telnet iftop iotop sysstat
 wget ntpdate dos2unix lsof net-tools mtr zip vim nsloopup ） pkg.installed   pkgs
    1.15 用户登录提示、PS1的修改    file.managed   file.append

自己用的话

暂停的
1.6 SSH服务优化（关闭DNS解析，修改端口）  file.managed  service
1.10 设置终端超时时间（安全考虑）  file.managed  /etc/profile

克隆镜像问题

    # 修改网卡配置，去掉UUID MAC等（克隆机器问题）
    [root@linux-node2 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
    删除或注释HWADDR和UUID两行内容，修改IP
    
    解决CentOS克隆虚拟机无法上网问题（UUID、MAC、IP）https://blog.csdn.net/qq_35428201/article/details/81435679

3.实现

0. 目录结构

[root@linux-node1 /srv/salt/base]# tree
.
├── init
│?? ├── dns.sls
│?? ├── files
│?? │?? ├── epel-7.repo
│?? │?? ├── limits.conf
│?? │?? ├── resolv.conf
│?? │?? ├── selinux-config
│?? │?? └── sshd_config
│?? ├── firewall.sls
│?? ├── history.sls
│?? ├── init-all.sls
│?? ├── limit.sls
│?? ├── ntp-client.sls
│?? ├── pkg-base.sls
│?? ├── selinux.sls
│?? ├── ssh.sls
│?? ├── sysctl.sls
│?? ├── thin.sls
│?? ├── tty-style.sls
│?? ├── tty-timeout.sls
│?? ├── user-redhat.sls
│?? └── yum-repo.sls
├── top.sls

1.1 关闭SELinux - file.managed - /etc/selinux/config

[root@linux-node1 /srv/salt/base/init]# vim selinux.sls 
close_selinux:
  file.managed:
    - name: /etc/selinux/config
    - source: salt://init/files/selinux-config
    - user: root
    - group: root
    - mode: 0644
  cmd.run:
    - name: setenforce 0 || echo ok

[root@linux-node1 /srv/salt/base/init]# cp /etc/selinux/config files/selinux-config 
[root@linux-node1 /srv/salt/base/init]# vim files/selinux-config

1.2 关闭默认iptables - service.disabled firewalld

[root@linux-node1 /srv/salt/base/init]# vim firewall.sls
firewalld-stop:
  service.dead:
    - name: firewalld.service
    - enable: False

1.3 时间同步（配置ntp） - pkg.installed cron

https://docs.saltstack.com/en/latest/ref/states/all/index.html#all-salt-states

https://docs.saltstack.com/en/latest/ref/states/all/salt.states.cron.html#module-salt.states.cron

[root@linux-node1 /srv/salt/base/init]# cat ntp-client.sls 
install-ntpdate:
  pkg.installed:
    - name: ntpdate

cron-ntpdate:
  cron.present:
    - name: ntpdate cn.pool.ntp.org
    - user: root
    - minute: '*/5'

1.4 文件描述符（必备 /etc/security/limits.conf） file.managed

[root@linux-node1 /srv/salt/base/init]# cat limit.sls 
limits-config:
  file.managed:
    - name: /etc/security/limits.conf
    - source: salt://init/files/limits.conf
    - user: root
    - group: root
    - mode: 644

[root@linux-node1 /srv/salt/base/init]# cp /etc/security/limits.conf files/limits.conf 
[root@linux-node1 /srv/salt/base/init]# 

1.5 内核优化(必备 tcp 内存) sysctl

[root@linux-node1 /srv/salt/base/init]# cat sysctl.sls 
net.ipv4.tcp_fin_timeout:
  sysctl.present:
    - value: 2

net.ipv4.tcp_tw_reuse:
  sysctl.present:
    - value: 1

net.ipv4.tcp_tw_recycle:
  sysctl.present:
    - value: 1

net.ipv4.tcp_syncookies:
  sysctl.present:
    - value: 1

net.ipv4.tcp_keepalive_time:
  sysctl.present:
    - value: 600

net.ipv4.ip_local_port_range:
  sysctl.present:
    - value: 4000 65000

net.ipv4.tcp_max_syn_backlog:
  sysctl.present:
    - value: 16384

net.ipv4.tcp_max_tw_buckets:
  sysctl.present:
    - value: 36000

net.ipv4.route.gc_timeout:
  sysctl.present:
    - value: 100

net.ipv4.tcp_syn_retries:
  sysctl.present:
    - value: 1

net.ipv4.tcp_synack_retries:
  sysctl.present:
    - value: 1

net.core.somaxconn:
  sysctl.present:
    - value: 16384

net.core.netdev_max_backlog:
  sysctl.present:
    - value: 16384

net.ipv4.tcp_max_orphans:
  sysctl.present:
    - value: 16384

fs.file-max:
  sysctl.present:
    - value: 2000000

net.ipv4.ip_forward:
  sysctl.present:
    - value: 1

1.6 SSH服务优化（关闭DNS解析，修改端口） file.managed service

[root@linux-node1 /srv/salt/base/init]# cat ssh.sls 
sshd-config:
  file.managed:
    - name: /etc/ssh/sshd_config
    - source: salt://init/files/sshd_config
    - user: root
    - group: root
    - mode: 600
  service.running:
    - name: sshd
    - enable: True
    - reload: True
    - watch:
      - file: sshd-config

[root@linux-node1 /srv/salt/base/init]# cp /etc/ssh/sshd_config files/sshd_config 
[root@linux-node1 /srv/salt/base/init]# vim files/sshd_config 

1.7 精简开机系统服务（只开启SSHD服务） service.disabled

[root@linux-node1 /srv/salt/base/init]# cat thin.sls
postfix:
  service.dead:
    - enable: False

1.8 DNS解析（必备） file.managed /etc/resolv.conf

[root@linux-node1 /srv/salt/base/init]# cat dns.sls
/etc/resolv.conf:
  file.managed:
    - source: salt://init/files/resolv.conf
    - user: root
    - group: root
    - mode: 644

[root@linux-node1 /srv/salt/base/init]# cp /etc/resolv.conf files/resolv.conf 
[root@linux-node1 /srv/salt/base/init]# vim files/resolv.conf 

1.9 历史记录优化histroy（记录时间，用户）file.managed /etc/profile

[root@linux-node1 /srv/salt/base/init]# cat history.sls 
history-init:
  file.append:
    - name: /etc/profile
    - text:
      - export HISTTIMEFORMAT="%F %T `whoami` "

1.10 设置终端超时时间（安全考虑） file.managed /etc/profile

[root@linux-node1 /srv/salt/base/init]# cat tty-timeout.sls
tty-timeout:
  file.append:
    - name: /etc/profile
    - text:
      - export TMOUT=30000000

 
1.11 配置yum源（必备） file.managed

[root@linux-node1 /srv/salt/base/init]# cat yum-repo.sls 
/etc/yum.repos.d/epel-7.repo:
  file.managed:
    - source: salt://init/files/epel-7.repo
    - user: root
    - group: root
    - mode: 644

[root@linux-node1 /srv/salt/base/init]# cp /etc/yum.repos.d/epel-7.repo files/epel-7.repo 

1.12 安装各种agent（必备） pkg file service jinja模板  zabbix

 zabbix 待定

1.13 基础用户(应用用户 user group)，用户登录提醒，sudo权限设置（必备）

[root@linux-node1 /srv/salt/base/init]# cat user-redhat.sls 
redhat-user-group:
  group.present:
    - name: redhat
    - gid: 1000

  user.present:
    - name: redhat
    - fullname: redhat
    - shell: /sbin/bash
    - uid: 1000
    - gid: 1000

1.14 常用基础命令，命令别名（必备 screen lrzsz tree openssl telnet iftop iotop sysstat wget ntpdate dos2unix lsof net-tools mtr zip vim nsloopup ） pkg.installed pkgs

[root@linux-node1 /srv/salt/base/init]# cat pkg-base.sls 
include:
  - init.yum-repo

base-install:
  pkg.installed:
    - pkgs:
      - screen
      - lrzsz
      - tree
      - openssl
      - telnet
      - iftop
      - iotop
      - sysstat
      - wget
      - dos2unix
      - lsof
      - net-tools
      - mtr
      - unzip
      - zip
      - vim-enhanced
      - bind-utils
    - require:
      - file: /etc/yum.repos.d/epel-7.repo

1.15 用户登录提示、PS1的修改 file.managed file.append

[root@linux-node1 /srv/salt/base/init]# vim /etc/bashrc

 

[root@linux-node1 /srv/salt/base/init]# cat tty-style.sls 
/etc/bashrc:
  file.append:
    - text:
      - export PS1="[\u@\h \w]\\$ "

 4 执行

test  一个个执行

[root@linux-node1 /srv/salt/base/init]# salt 'linux-node1*' state.sls init.dns

 top 执行

[root@linux-node1 /srv/salt/base/init]# cat init-all.sls 
include:
  - init.dns
  - init.yum-repo
  - init.firewall
  - init.history
  - init.limit
  - init.ntp-client
  - init.pkg-base
  - init.selinux
  - init.ssh
  - init.sysctl
  - init.thin
  - init.tty-timeout
  - init.tty-style
  - init.user-redhat

[root@linux-node1 /srv/salt/base]# ls
init  top.sls  web
[root@linux-node1 /srv/salt/base]# cat top.sls 
base:
  '*':
    - init.init-all

[root@linux-node1 /srv/salt/base]# salt '*' state.highstate