运维自动化工具 Saltstack

Saltstack 比 Puppet 出来晚几年，是基于Python 开发的，也是基于 C/S 架构，服务端 master 和客户端 minions ；Saltstack 和 Puppet 很像，可以说 Saltstatck 整合了 Puppet 和 Chef 的功能，更加强大，更适合大规模批量管理服务器，并且它比 Puppet 更容易配置。
三大功能： 远程命令执行，配置管理（服务，文件，cron，用户，组），云管理。

什么是saltstack

• Saltstack是基于python开发的一套C/S架构配置管理工具

• 使用SSL证书签方的方式进行认证管理

• 底层使用ZeroMQ消息队列pub/sub方式通信

    – 号称世界上最快的消息队列ZeroMQ能快速在成千上万台主机上进行各种操作

    – 采用RSA Key方式确认身份

主要功能

• Saltstack最主要的两个功能是:配置管理与远程执行

• Saltstack不只是一个配置管理工具,还是一个云计算与数据中心架构编排的利器

• Saltstack已经支持Docker相关模块

• 在友好地支持各大云平台之后,配合Saltstack的Mine实时发现功能可以实现各种云平台业务的自动扩展

Saltstack架构

• Saltstack基于C/S架构

    – 服务器端称作Master

    – 客户端称作Minion

• 可以实现传统处理方式,即:客户端发送请求给服务器,服务器收到请求后处理请求,再将结果返回

• 也可以使用消息队列中的发布与订阅(pub/sub)服务模式

• Master和Minion都以守护进程的方式运行

• Master监听配置文件里定义的ret_port(接收minion请求),和publish_port(发布消息)的端口

• 当Minion运行时,它会自动连接到配置文件里定义的Master地址ret_port端口进行连接认证

• 当Master和Minion可以正常通信后,就可以进行各种各样的配置管理工作了

Saltstack安装

依赖：

    1. python2.6 ~ python3.0

    2. ZeroMQ or RAET

    3. mako（可选）：一个可选的Salt States解析器

    4. gcc（可选）

实验环境

Redhat 6.5
Server1 master 172.25.53.1
Server2 minion 172.25.53.2

配置saltstack所需的yum源
[root@foundation53 html]# ls
mysqlamdin  rhel6  rhel6.5  rhel7.3
[root@foundation53 html]# cd rhel6
[root@foundation53 rhel6]# ls
libyaml-0.1.3-4.el6.x86_64.rpm
python-babel-0.9.4-5.1.el6.noarch.rpm
python-backports-1.0-5.el6.x86_64.rpm
python-backports-ssl_match_hostname-3.4.0.2-2.el6.noarch.rpm
python-chardet-2.2.1-1.el6.noarch.rpm
python-cherrypy-3.2.2-4.el6.noarch.rpm
python-crypto-2.6.1-3.el6.x86_64.rpm
python-crypto-debuginfo-2.6.1-3.el6.x86_64.rpm
python-enum34-1.0-4.el6.noarch.rpm
python-futures-3.0.3-1.el6.noarch.rpm
python-impacket-0.9.14-1.el6.noarch.rpm
python-jinja2-2.8.1-1.el6.noarch.rpm
python-msgpack-0.4.6-1.el6.x86_64.rpm
python-ordereddict-1.1-2.el6.noarch.rpm
python-requests-2.6.0-3.el6.noarch.rpm
python-setproctitle-1.1.7-2.el6.x86_64.rpm
python-six-1.9.0-2.el6.noarch.rpm
python-tornado-4.2.1-1.el6.x86_64.rpm
python-urllib3-1.10.2-1.el6.noarch.rpm
python-zmq-14.5.0-2.el6.x86_64.rpm
PyYAML-3.11-1.el6.x86_64.rpm
repodata
salt-2016.11.3-1.el6.noarch.rpm
salt-api-2016.11.3-1.el6.noarch.rpm
salt-cloud-2016.11.3-1.el6.noarch.rpm
salt-master-2016.11.3-1.el6.noarch.rpm
salt-minion-2016.11.3-1.el6.noarch.rpm
salt-ssh-2016.11.3-1.el6.noarch.rpm
salt-syndic-2016.11.3-1.el6.noarch.rpm
zeromq-4.0.5-4.el6.x86_64.rpm

配置master minion的yum源 两边操作相同

[root@server1 ~]# vim /etc/yum.repos.d/rhel-source.repo 
[rhel-source]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=http://172.25.53.250/rhel6.5
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[salt]
name=saltstack
baseurl=http://172.25.53.250/rhel6
enabled=1
gpgcheck=0


[root@server1 ~]# yum repolist
Loaded plugins: product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
rhel-source                                              | 3.9 kB     00:00     
salt                                                     | 2.9 kB     00:00     
salt/primary_db                                          |  16 kB     00:00     
repo id          repo name                                                status
rhel-source      Red Hat Enterprise Linux 6Server - x86_64 - Source       3,690
salt             saltstack                                                   29
repolist: 3,719

Master和minion分别安装相应软件
[root@server1 ~]# yum install -y salt-master
[root@server2 ~]# yum install -y salt-minion

Minion端更改配置文件指向master端
[root@server2 ~]# cd /etc/salt/
[root@server2 salt]# vim minion

 16 master: 172.25.53.1

两边开启服务

[root@server1 ~]# /etc/init.d/salt-master start
Starting salt-master daemon:                               [  OK  ]

[root@server2 salt]# /etc/init.d/salt-minion start
Starting salt-minion:root:server2 daemon: OK

sat-key的帮助文件中文信息：

[root@localhost ~]# salt-key --help
Usage: salt-key [options]

Salt key 用于管理认证key

Options:
  --version            显示版本号后退出
  --versions-report    显示程序的所有依赖包版本号，并退出
  -h, --help           帮助信息
  -c CONFIG_DIR, --config-dir=CONFIG_DIR
                       指定配置目录，默认 ：/etc/salt/

  -q, --quiet          安静模式，不输出信息到控制台
  -y, --yes            对所有询问是否继续，回答yes,默认：false

  Logging Options:
                   设置loggin选项会覆盖掉配置文件中对日志的配置.

    --log-file=LOG_FILE                 
                        指定日志文件路径，默认: /var/log/salt/key.
    --log-file-level=LOG_LEVEL_LOGFILE
                        日志文件等级，可设置下面中的一个值 'all', 'garbage',
                        'trace', 'debug', 'info', 'warning', 'error', 'quiet'.
                        默认: 'warning'.
    --key-logfile=KEY_LOGFILE
                        将所有的输出发送到指定的文件，默认： '/var/log/salt/key'


  Output Options:
    配置输出格式

    --out=OUTPUT, --output=OUTPUT
                        把salt-key命令的输出信息发送给指定的outputer. 
                可设置为下面参数值 'no_return', 'virt_query'.
                        'grains', 'yaml', 'overstatestage', 'json', 'pprint',
                        'nested', 'raw', 'highstate', 'quiet', 'key', 'txt',

    --out-indent=OUTPUT_INDENT, --output-indent=OUTPUT_INDENT
                        设置输出行缩进的空格数. 
                        负数取消输出缩进编排.仅对使用的outputer有效.
    --out-file=OUTPUT_FILE, --output-file=OUTPUT_FILE
                        把显示输出到指定的文件
    --no-color, --no-colour
                        关闭字体颜色
    --force-color, --force-colour
                        强制开启输出颜色渲染

  Actions:
    -l ARG, --list=ARG 
                    打印公钥key. 可设置下面三个值
                "pre", "un", and "unaccepted" 会显示 不许可/未签名 keys. 
                "acc" or "accepted"会显示 许可/已签名 keys. 
                "rej" or "rejected"会显示拒绝的 keys.  
                "all" 会显示所有 keys.
    -L, --list-all      会显示所有公钥，相当月: "--list all"
    -a ACCEPT, --accept=ACCEPT
                        许可指定的公钥(使用--include-all选项
                        可以指定除了挂起的key外的所有reject状态的公钥)

    -A, --accept-all    许可所有pending的公钥
    -r REJECT, --reject=REJECT
                        拒绝指定的公钥 (使用--include-all选项
                        可以指定除了挂起的key外的所有accept状态的公钥)

    -R, --reject-all    拒接所有pending的公钥

    --include-all       配合 accepting/rejecting 选项使用，指定所有非pending状态的公钥

    -p PRINT, --print=PRINT
                        打印指定的公钥
    -P, --print-all     Print all public keys
    -d DELETE, --delete=DELETE
                        根据公钥的名称删除公钥
    -D, --delete-all    删除所有 keys
    -f FINGER, --finger=FINGER
                        打印指定key的指纹信息
    -F, --finger-all    打印所有key的指纹信息

  Key 常用选项:
    --gen-keys=GEN_KEYS
                        对生成的key配置设置一个salt使用的名称。
    --gen-keys-dir=GEN_KEYS_DIR
                        设置生成key对的放置目录，默认当前目录。default=.

--keysize=KEYSIZE                       
                为生成key设置位数, 仅跟--gen-keys选项配合时有效,
                数值大小必须大于2048，否则会被提升至2048位，默认2048
                        default=2048

Master与Minion互信

[root@server1 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
server2
Rejected Keys:



    -L: 列出密钥

    -a: 接受一个密钥

    -A: 接受全部密钥

    -D: 删除全部密钥

[root@server1 ~]# salt-key -A
The following keys are going to be accepted:
Unaccepted Keys:
server2
Proceed? [n/Y] y
Key for minion server2 accepted.
[root@server1 ~]# salt-key -L
Accepted Keys:
server2
Denied Keys:
Unaccepted Keys:
Rejected Keys:

[root@server1 ~]# salt server2 test.ping
server2:
True

    salt命令的帮助信息翻译：

###
[root@localhost salt]# salt --help
Usage: salt [options] '' <function> [arguments]

Options:
  --version             版本号
  --versions-report     依赖包版本号
  -h, --help            显示帮助信息
  -c CONFIG_DIR, --config-dir=CONFIG_DIR
                        指定配置文件目录.
                        默认: /etc/salt
  -t TIMEOUT, --timeout=TIMEOUT
                        指定命令超时时间
                        建议默认：5秒
  -s, --static          等到所有minions都执行完了再一起显示数据

  --async               运行所有的salt命令不等待返回结果
  --state-output=STATE_OUTPUT, --state_output=STATE_OUTPUT
                        覆盖掉配置文件中对minion输出内容所定义的 state_output 值
            默认: full
  --subset=SUBSET       对目标minions的随机子集执行程序. 
            minions在执行前会先验证是否存在该命名的函数，再去执行
  -v, --verbose         可以查看详细的命令执行情况
  --show-timeout        显示命令执行超时的 minions
  -b BATCH, --batch=BATCH, --batch-size=BATCH
                        开启salt命令批量执行模式, 既可以指定一批minions,
            也可以用指定百分比的方式确定多少minions批量执行
  -a EAUTH, --auth=EAUTH, --eauth=EAUTH, --extended-auth=EAUTH
                        指定一个扩展的认证系统.
  -T, --make-token      创建并保存一个认证token用于重用.
                        生成的token确保Salt Master在指定的周期内有效.
  --return=RETURNER     设置一个其它的返回方法. 
            默认情况下，salt查询后结果会返回给master, 
            指定return后，数据可以重定向其它的任意数量的系统，数据库或应用.
  -d, --doc, --documentation
            返回指定模块的文档说明，不指定特定的模块则返回全部                    
  --args-separator=ARGS_SEPARATOR
                        指定发送命令跟命令参数的分隔符. 
            当用户想把一个命令当作参数发送给另一个命令执行时，
            是个很好用的选项.

  Logging Options:
    指定下面的配置选项会覆盖掉配置文件中对应的配置信息.

    -l LOG_LEVEL, --log-level=LOG_LEVEL
                        日志等级. 
            其中一个： 'all', 'garbage', 'trace', 
            'debug', 'info', 'warning', 'error', 'quiet'.
                        默认: 'warning'.
    --log-file=LOG_FILE
                        日志文件路径. 默认: /var/log/salt/master.
    --log-file-level=LOG_LEVEL_LOGFILE
                        日志文件记录等级. 其中一个 'all', 'garbage',
                        'trace', 'debug', 'info', 'warning', 'error', 'quiet'.
                        默认: 'warning'.

  Target Options:
    Target Selection Options

    -E, --pcre          使用pcre(perl)的正则表达式规则匹配目标
    -L, --list          列出一组用逗号或空格隔开的minions id作为执行目标.
    -G, --grain         使用grain信息中指定的机器作为目标
                        例如: "os:Arch*"   'os:CentOS'
    --grain-pcre        使用基于pcre正则式规则的grain匹配目录
                        例如: "os:Arch.*"
    -N, --nodegroup     使用预先定义的节点组作为匹配目标.
    -R, --range         使用一个范围表达式去查找目标.
            例如： %cluster
    -C, --compound      多条件指定目标，根据多个条件筛选匹配目标
                        类似: salt 'G@os:RedHat and webser* or E@database.*'
    -X, --exsel         Instead of using shell globs use the return code of a
                        function.
    -I, --pillar        使用一个pillar 的值来筛选目标, 
                        例如: "role:production*"
    -S, --ipcidr        基于子网络匹配 (CIDR notation) or IPv4 address.

  Output Options:
    配置你的完美输出格式

    --out=OUTPUT, --output=OUTPUT
                        指定输出的格式,开发一般用json，默认是yaml
            可选如下： 'no_return',
                        'grains', 'yaml', 'overstatestage', 'json', 'pprint',
                        'nested', 'raw', 'highstate', 'quiet', 'key', 'txt',
                        'virt_query'.
    --out-indent=OUTPUT_INDENT, --output-indent=OUTPUT_INDENT
                        指定行缩进的空格数.
            负数为取消行缩进. 
            只有在输出格式适合行缩进，该参数才有效.
    --out-file=OUTPUT_FILE, --output-file=OUTPUT_FILE
                        内容输出到指定的文件
    --no-color, --no-colour
                        关闭颜色显示
    --force-color, --force-colour
                        强制颜色显示

[root@server1 ~]# salt server2 cmd.run hostname
server2:
    server2
[root@server1 ~]# salt server2 cmd.run 'df -h'
server2:
    Filesystem                    Size  Used Avail Use% Mounted on
    /dev/mapper/VolGroup-lv_root   19G  972M   17G   6% /
    tmpfs                         246M   16K  246M   1% /dev/shm
    /dev/vda1                     485M   33M  427M   8% /boot

[root@server1 ~]# cd /etc/salt/pki/
[root@server1 pki]# cd master/
[root@server1 master]# md5sum master.pub 
977c918b46d2ea9dec3826a2dd9021ab  master.pub

[root@server1 master]# yum install -y tree
查看saltstack结构
[root@server1 master]# tree .
.
├── master.pem
├── master.pub
├── minions
│   └── server2
├── minions_autosign
├── minions_denied
├── minions_pre
└── minions_rejected

[root@server1 master]# cd minions
[root@server1 minions]# ls
server2
[root@server1 minions]# md5sum server2 
9dd67ca1673e0442b14fd19aabb03e35  server2

[root@server2 salt]# cd /etc/salt/pki/
[root@server2 pki]# cd minion/
[root@server2 minion]# md5sum minion.pub 
9dd67ca1673e0442b14fd19aabb03e35  minion.pub
[root@server2 minion]# md5sum minion_master.pub 
977c918b46d2ea9dec3826a2dd9021ab  minion_master.pub

[root@server1 minions]# yum install -y lsof
[root@server1 minions]# lsof -i :4505
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
salt-mast 1417 root   16u  IPv4  14100      0t0  TCP *:4505 (LISTEN)
salt-mast 1417 root   18u  IPv4  17037      0t0  TCP server1:4505->server2:55420 (ESTABLISHED)

[root@server1 minions]# lsof -i :4506
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
salt-mast 1424 root   24u  IPv4  14111      0t0  TCP *:4506 (LISTEN)
[root@server1 minions]# yum install -y python-setproctitle
[root@server1 minions]# /etc/init.d/salt-master restart
Stopping salt-master daemon:                               [  OK  ]
Starting salt-master daemon:                               [  OK  ]

[root@server1 minions]# cd /etc/salt/
[root@server1 salt]# vim master

• YAML:YAML Ain't Markup Language

• YAML的结构通过空格来展示

• 项目使用"-"来表示

• 键值对使用":"来表示

• Master和Minion的配置文件均采用YAML语法

• YAML使用一个固定的缩进风格表示数据层级结构关

• 一般每个缩进级别由两个空格组成

• 注意不要使用tab

• 缩进是初学者容易出错的地方之一

• YAML的键值对采用冒号分隔

• YAML键值对对应python的字典

• YAML表示形式

    name: test

    或

    name:

      test

• Python字典

    {'name': 'test'}

• 字典可以嵌套

    hosts:

        name: test

• 字典表示形式为

    {

        'hosts': {

       'name': 'test'

       }

    }


• 列表项使用一个短横杠加一个空格

    -  test1

    -  test2

• 列表可以作为一个键值对的value

    pkg-http:

      - httpd

      - php

• Python语法

    {'pkg-http': ['httpd', 'php']}

[root@server1 salt]# /etc/init.d/salt-master restart
Stopping salt-master daemon:                               [  OK  ]
Starting salt-master daemon:                               [  OK  ]



编写一个可以执行的安装模块
[root@server1 salt]# mkdir /srv/salt
[root@server1 salt]# cd /srv/salt/
[root@server1 salt]# mkdir httpd
[root@server1 salt]# cd httpd/
[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls 
apache-install:
  pkg.installed:
    - pkgs:
      - httpd
      - php

[root@server1 httpd]# salt server2 state.sls httpd.install

[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls 
apache-install:
  pkg.installed:
    - pkgs:
      - httpd
      - php
  service.running:
- name: httpd

远程对已互信的minion进行命令执行
[root@server1 httpd]# salt server2 state.sls httpd.install

[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls 
apache-install:
  pkg.installed:
    - pkgs:
      - httpd
      - php
  service.running:
    - name: httpd
- enable: True

[root@server1 httpd]# salt server2 state.sls httpd.install

[root@server1 httpd]# vim install.sls
[root@server1 httpd]# cat install.sls 
apache-install:
  pkg.installed:
    - pkgs:
      - httpd
      - php

  file.managed:
    - name: /etc/httpd/conf/httpd.conf
    - source: salt://httpd/files/httpd.conf
    - mode: 644
    - user: root

  service.running:
    - name: httpd
    - enable: True
    - reload: True
    - watch:
      - file: apache-install
[root@server1 httpd]# mkdir files
[root@server1 httpd]# cd files/
[root@server1 files]# pwd
/srv/salt/httpd/files

[root@server2 minion]# scp /etc/httpd/conf/httpd.conf server1:/srv/salt/httpd/files
The authenticity of host 'server1 (172.25.53.1)' can't be established.
RSA key fingerprint is 6d:fd:b7:7f:ae:10:eb:24:2f:67:97:93:84:6f:36:7e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'server1,172.25.53.1' (RSA) to the list of known hosts.
root@server1's password: 
httpd.conf                                                                100%   34KB  33.6KB/s   00:00    
[root@server2 minion]# md5sum /etc/httpd/conf/httpd.conf 
27a5c8d9e75351b08b8ca1171e8a0bbd  /etc/httpd/conf/httpd.conf

[root@server1 files]# vim httpd.conf 

[root@server1 files]# md5sum httpd.conf 
b7ca7a0e786418ba7b5ad84efac70265  httpd.conf
[root@server1 files]# salt server2 state.sls httpd.install

远程使用源码编译nginx

[root@server1 httpd]# cd ..
[root@server1 salt]# ls
httpd
[root@server1 salt]# mkdir nginx
[root@server1 salt]# cd nginx/
[root@server1 nginx]# mkdir files
[root@server1 nginx]# ls
files
[root@server1 nginx]# cd files/
[root@server1 files]# ls
[root@server1 files]# pwd
/srv/salt/nginx/files
[root@server1 files]# ls
nginx-1.14.0.tar.gz
[root@server1 files]# cd ..
[root@server1 nginx]# vim install.sls

ngisx-install:
  pkg.installed:
    - pkgs:
      - pcre-devel
      - openssl-devel
      - gcc

  file.managed:
    - name: /mnt/nginx-1.14.0.tar.gz
    - source: salt://nginx/files/nginx-1.14.0.tar.gz

#  cmd.run:
#    - name: cd /mnt && tar zxf nginx-1.14.0.tar.gz &&cd nginx-1.14.0

先进行简单测试看前面写的是否正确
[root@server1 nginx]# salt server3 start.sls nginx.install


通过刷新server3的正在运行，可以看到
Ps ax

代表前面写的没有问题

然后我们写执行操作的时候可以先在server3上将命令运行一遍看是否正确

更改src/core/nginx.h的版本号

[root@server3 nginx-1.14.0]# sed -i.bak 's/#define NGINX_VER          "nginx\/" NGINX_VERSION/#define NGINX_VER          "nginx"/g' src/core/nginx.h
注释auto/cc/gcc的debug选项 
[root@server3 nginx-1.14.0]# sed -i.bak 's/CFLAGS="$CFLAGS -g"/#CFLAGS="$CFLAGS -g"/g' auto/cc/gcc
通过运行可以证明这两个命令是正确的
[root@server3 nginx-1.14.0]# ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-threads --with-file-aio
编译所需模块，至此，我们可以将他们写入执行脚本里了
[root@server1 nginx]# vim install.sls
ngisx-install:
  pkg.installed:
    - pkgs:
      - pcre-devel
      - openssl-devel
      - gcc

  file.managed:
    - name: /mnt/nginx-1.14.0.tar.gz
    - source: salt://nginx/files/nginx-1.14.0.tar.gz

  cmd.run:
    - name: cd /mnt && tar zxf nginx-1.14.0.tar.gz && cd nginx-1.14.0 && sed -i.bak 's/#define NGINX_VER          "nginx\/" NGINX_VERSION/#define NGINX_VER          "nginx"/g' src/core/nginx.h && sed -i.bak 's/CFLAGS="$CFLAGS -g"/#CFLAGS="$CFLAGS -g"/g' auto/cc/gcc && ./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-threads --with-file-aio &> /dev/null && make &>/dev/null &&make install &>/dev/null
运行
[root@server1 nginx]# salt server3 state.sls nginx.install


运行过程中我们通过刷新server3的运行程序，依然可以看到他的执行效果

执行完成后

执行成功

如果nginx已经安装，我们难道要让重新安装吗，不是的，我们需要添加一个判断

我们再写一个nginx启动脚本

[root@server1 nginx]# vim service.sls
include:
  - nginx.install

nginx-service:
  cmd.run:
    - name: /usr/local/nginx/sbin/nginx

[root@server1 nginx]# salt server3 state.sls nginx.service

执行效果 nginx启动了

但这个脚本有个问题，就是nginx在启动状态时，你运行的话会报错

需要改进

我们根据日志判断他是否启动
- creates: /usr/local/nginx/logs/nginx.pid

这样就算重复启动也不会报错了

另外一种启动脚本

首先将nginx脚本
[root@server1 files]# pwd
/srv/salt/nginx/files
[root@server1 files]# ls
nginx  nginx-1.14.0.tar.gz  nginx.conf




[root@server1 nginx]# cat service.sls
include:
  - nginx.install

/usr/local/nginx/conf/nginx.conf:
  file.managed:
    - source: salt://nginx/files/nginx.conf

nginx-service:
  file.managed:
    - name: /etc/init.d/nginx
    - source: salt://nginx/files/nginx
    - mode: 755
  service.running:
    - name: nginx
    - reload: True
    - watch:
      - file: /usr/local/nginx/conf/nginx.conf
[root@server1 nginx]# ls
files  install.sls  service.sls
[root@server1 nginx]# cd ..
[root@server1 salt]# cd /srv/salt/nginx/files
[root@server1 files]# cat nginx
#!/bin/sh
#
# nginx        Startup script for nginx
#
# chkconfig: - 85 15
# processname: nginx
# config: /usr/local/nginx/conf/nginx/nginx.conf
# pidfile: /usr/local/nginx/logs/nginx.pid
# description: nginx is an HTTP and reverse proxy server
#
### BEGIN INIT INFO
# Provides: nginx
# Required-Start: $local_fs $remote_fs $network
# Required-Stop: $local_fs $remote_fs $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop nginx
### END INIT INFO

# Source function library.
. /etc/rc.d/init.d/functions

if [ -L $0 ]; then
    initscript=`/bin/readlink -f $0`
else
    initscript=$0
fi

#sysconfig=`/bin/basename $initscript`

#if [ -f /etc/sysconfig/$sysconfig ]; then
#    . /etc/sysconfig/$sysconfig
#fi

nginx=${NGINX-/usr/local/nginx/sbin/nginx}
prog=`/bin/basename $nginx`
conffile=${CONFFILE-/usr/local/nginx/conf/nginx.conf}
lockfile=${LOCKFILE-/var/lock/subsys/nginx}
pidfile=${PIDFILE-/usr/local/nginx/logs/nginx.pid}
SLEEPMSEC=${SLEEPMSEC-200000}
UPGRADEWAITLOOPS=${UPGRADEWAITLOOPS-5}
RETVAL=0

start() {
    echo -n $"Starting $prog: "

    daemon --pidfile=${pidfile} ${nginx} -c ${conffile}
    RETVAL=$?
    echo
    [ $RETVAL = 0 ] && touch ${lockfile}
    return $RETVAL
}

stop() {
    echo -n $"Stopping $prog: "
    killproc -p ${pidfile} ${prog}
    RETVAL=$?
    echo
    [ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile}
}

reload() {
    echo -n $"Reloading $prog: "
    killproc -p ${pidfile} ${prog} -HUP
    RETVAL=$?
    echo
}

upgrade() {
    oldbinpidfile=${pidfile}.oldbin

    configtest -q || return
    echo -n $"Starting new master $prog: "
    killproc -p ${pidfile} ${prog} -USR2
    echo

    for i in `/usr/bin/seq $UPGRADEWAITLOOPS`; do
        /bin/usleep $SLEEPMSEC
        if [ -f ${oldbinpidfile} -a -f ${pidfile} ]; then
            echo -n $"Graceful shutdown of old $prog: "
            killproc -p ${oldbinpidfile} ${prog} -QUIT
            RETVAL=$?
            echo
            return
        fi
    done

    echo $"Upgrade failed!"
    RETVAL=1
}

configtest() {
    if [ "$#" -ne 0 ] ; then
        case "$1" in
            -q)
                FLAG=$1
                ;;
            *)
                ;;
        esac
        shift
    fi
    ${nginx} -t -c ${conffile} $FLAG
    RETVAL=$?
    return $RETVAL
}

rh_status() {
    status -p ${pidfile} ${nginx}
}

# See how we were called.
case "$1" in
    start)
        rh_status >/dev/null 2>&1 && exit 0
        start
        ;;
    stop)
        stop
        ;;
    status)
        rh_status
        RETVAL=$?
        ;;
    restart)
        configtest -q || exit $RETVAL
        stop
        start
        ;;
    upgrade)
        rh_status >/dev/null 2>&1 || exit 0
        upgrade
        ;;
    condrestart|try-restart)
        if rh_status >/dev/null 2>&1; then
            stop
            start
        fi
        ;;
    force-reload|reload)
        reload
        ;;
    configtest)
        configtest
        ;;
    *)
        echo $"Usage: $prog {start|stop|restart|condrestart|try-restart|force-reload|upgrade|reload|status|help|configtest}"
        RETVAL=2
esac

exit $RETVAL











[root@server1 nginx]# cat service.sls
include:
  - nginx.install

/usr/local/nginx/conf/nginx.conf:
  file.managed:
    - source: salt://nginx/files/nginx.conf

nginx-service:
  file.managed:
    - name: /etc/init.d/nginx
    - source: salt://nginx/files/nginx
    - mode: 755
  service.running:
    - name: nginx
    - reload: True
    - watch:
      - file: /usr/local/nginx/conf/nginx.conf

这样也可以


编辑可生成用户

[root@server1 nginx]# cat users.sls 
nginx-group:
  group.present:
    - name: nginx
    - gid: 800

nginx-user:
  user.present:
    - name: nginx
    - uid: 800
    - gid: 800
    - shell: /sbin/nologin
    - createhome: False
    - home: /usr/local/nginx

添加到service.sls

运行之后

将模块添加到service
[root@server1 salt]# ls /srv/salt/nginx/
files  install.sls  service.sls  users  users.sls
[root@server1 salt]# cat /srv/salt/nginx/service.sls 
include:
  - nginx.users
  - nginx.install

/usr/local/nginx/conf/nginx.conf:
  file.managed:
    - source: salt://nginx/files/nginx.conf

nginx-service:
  file.managed:
    - name: /etc/init.d/nginx
    - source: salt://nginx/files/nginx
    - mode: 755
  service.running:
    - name: nginx
    - reload: True
    - watch:
      - file: /usr/local/nginx/conf/nginx.conf

[root@server1 ~]# yum install -y salt-minion
[root@server1 ~]# cd /etc/salt/
[root@server1 salt]# vim minion




[root@server1 salt]# salt-key -L
Accepted Keys:
server2
server3
Denied Keys:
Unaccepted Keys:
server1
Rejected Keys:
[root@server1 salt]# salt-key -a server1
The following keys are going to be accepted:
Unaccepted Keys:
server1
Proceed? [n/Y] y
Key for minion server1 accepted.
[root@server1 salt]# salt-key -L
Accepted Keys:
server1
server2
server3
Denied Keys:
Unaccepted Keys:
Rejected Keys:

[root@server1 haproxy]# vim /etc/yum.repos.d/rhel-source.repo 
[root@server1 haproxy]# cat /etc/yum.repos.d/rhel-source.repo
[rhel-source]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=http://172.25.53.250/rhel6.5
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release


[salt]
name=saltstack
baseurl=http://172.25.53.250/rhel6
enabled=1
gpgcheck=0


[LoadBalancer]
name=LoadBalancer
baseurl=http://172.25.53.250/rhel6.5/LoadBalancer












#!/usr/bin/env python
def yourfunction():
     # initialize a grains dictionary
     grains = {}
     # Some code for logic that sets grains like
     grains['yourcustomgrain'] = True
     grains['anothergrain'] = 'somevalue'
     return grains



[root@server1 files]# vim haproxy.cfg 
[root@server1 files]# tail -n 10 haproxy.cfg 
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend  main *:80
    default_backend             app

backend app
    balance     roundrobin
    server  app1 172.25.53.2:80 check
    server  app2 172.25.53.3:80 check




[root@server1 haproxy]# pwd
/srv/salt/haproxy
[root@server1 haproxy]# vim install.sls
[root@server1 haproxy]# cat install.sls 
haproxy-install:
  pkg.installed:
    - pkgs:
      - haproxy

  file.managed:
    - name: /etc/haproxy/haproxy.cfg
    - source: salt://haproxy/files/haproxy.cfg

  service.running:
    - name: haproxy
    - reload: True
    - watch:
      - file: haproxy-install



[root@server1 files]# cd /srv/salt/
[root@server1 salt]# vim top.sls
[root@server1 salt]# cat top.sls 
base:
  'server1':
    - haproxy.install
  'server2':
    - httpd.install
  'server3':
    - nginx.service
[root@server1 salt]# salt server? test.ping
server2:
    True
server3:
    True
server1:
True


[root@server1 files]# salt '*' state.highstate


记得看httpd的端口是否为80
[root@server1 files]# ls
httpd.conf
[root@server1 files]# pwd
/srv/salt/httpd/files


Server2 发布目录添加
[root@server2 minion]# cd /var/www/html/
[root@server2 html]# ls
[root@server2 html]# vim index.html

[root@server2 ~]# vim /etc/salt/minion

[root@server2 ~]# /etc/init.d/salt-minion restart
Stopping salt-minion:root:server2 daemon: OK
Starting salt-minion:root:server2 daemon: OK

[root@server1 ~]# cd /srv/salt/
[root@server1 salt]# mkdir _grains
[root@server1 salt]# cd _grains/
[root@server1 _grains]# ls
[root@server1 _grains]# vim my_grains.py

#!/usr/bin/env python
def my_grains():
     grains = {}
     grains['hello'] = 'world'
     grains['salt'] = 'stack'
     return grains

[root@server1 ~]# vim /etc/salt/master

[root@server1 ~]# mkdir /srv/pillar
[root@server1 ~]# cd /srv/pillar
[root@server1 pillar]# mkdir web/
[root@server1 pillar]# cd web/
[root@server1 web]# vim install.sls


{% if grains['fqdn'] == 'server2' %}
webserver: httpd
{% elif grains['fqdn'] == 'server3' %}
webserver: nginx
{% endif %}

[root@server1 web]# cd ..
[root@server1 pillar]# vim top.sls
[root@server1 pillar]# cat top.sls 
base:
  '*':
    - web.install

新建虚拟机server4 配置yum源，安装minion，master作允许

[root@server1 pillar]# cd /srv/salt/httpd/
[root@server1 httpd]# ls
files  install.sls
[root@server1 httpd]# vim install.sls 
[root@server1 httpd]# pwd
/srv/salt/httpd
[root@server1 httpd]# cat install.sls 
apache-install:
  pkg.installed:
    - pkgs:
      - httpd
      - php

  file.managed:
    - name: /etc/httpd/conf/httpd.conf
    - source: salt://httpd/files/httpd.conf
    - mode: 644
    - user: root

  service.running:
    - name: httpd
    - enable: True
    - reload: True
    - watch:
      - file: apache-install
[root@server1 httpd]# vim install.sls 
[root@server1 httpd]# cat install.sls 
httpd:
  pkg.installed

php:
  pkg.installed

apache:
  service.running:
    - name: httpd
    - enable: True
    - reload: True
    - watch:
      - file: /etc/httpd/conf/httpd.conf

/etc/httpd/conf/httpd.conf:
  file.managed:
    - source: salt://httpd/files/httpd.conf
    - mode: 644
    - user: root
    - template: jinja
    - context:
      bind: 172.25.53.2
      port: 8080
[root@server1 httpd]# ls
files  install.sls
[root@server1 httpd]# cd files/
[root@server1 files]# ls
httpd.conf
[root@server1 files]# vim httpd.conf 

[root@server1 files]# salt server2 state.sls httpd.install
[root@server2 salt]# vim /etc/httpd/conf/httpd.conf 

另一种方法

[root@server1 files]# vim httpd.conf

[root@server1 files]# salt server2 state.sls httpd.install

[root@server1 files]# cd ..
[root@server1 httpd]# ls
files  install.sls
[root@server1 httpd]# vim lib.sls
[root@server1 httpd]# cat lib.sls 
{% set port = 80 %}
[root@server1 httpd]# vim files/httpd.conf 
在行首

[root@server1 httpd]# salt server2 state.sls httpd.install


[root@server1 httpd]# vim install.sls

salt server2 state.sls httpd.install

强烈推荐用这种方法

[root@server1 web]# vim install.sls 
[root@server1 web]# pwd /srv/pillar/web

[root@server1 httpd]# vim files/httpd.conf 

[root@server1 httpd]# vim install.sls

[root@server1 web]# salt server2 state.sls httpd.install





[root@server2 salt]# vim /etc/httpd/conf/httpd.conf