SaltStack使用salt-ssh模式-第十一篇

salt-ssh介紹

1.salt-ssh 是 0.17.0 新引入的一個功能，不須要minion對客戶端進行管理，也不須要master。

2.salt-ssh 支持salt大部分的功能：如 grains、modules、state 等

3.salt-ssh 沒有使用ZeroMQ的通訊架構，執行是串行模式

相似 paramiko、pssh、ansible 這類的工具

Roster使用

salt-ssh須要一個名單系統來肯定哪些執行目標，Salt的0.17.0版本中salt-ssh引入roster系統

roster系統編譯成了一個數據結構，包含了targets，這些targets是一個目標系統主機列表和或如鏈接到這些targets

配置文件以下

# target的信息
    host:        # 遠端主機的ip地址或者dns域名
    user:        # 登陸的用戶
    passwd:      # 用戶密碼,若是不使用此選項，則默認使用祕鑰方式
# 可選的部分
    port:        #ssh端口
    sudo:        #能夠經過sudo
    tty:         # 若是設置了sudo，設置這個參數爲true
    priv:        # ssh祕鑰的文件路徑
    timeout:     # 當創建連接時等待響應時間的秒數
    minion_opts: # minion的位置路徑
    thin_dir:    # target系統的存儲目錄，默認是/tmp/salt-<hash>
    cmd_umask:   # 使用salt-call命令的umask值

安裝配置

一，安裝salt-ssh

[root@linux-node1 ~]# yum install salt-ssh

二，修改roster文件，配置要管理的機器

[root@linux-node1 ~]# tail -11  /etc/salt/roster 
linux-node1.example.com:
  host: 192.168.56.11
  user: root
  passwd: 123456
  port: 22

linux-node2.example.com:
  host: 192.168.56.12
  user: root
  passwd: 123456
  port: 22

三，進行管理測試

[root@linux-node1 ~]# salt-ssh '*' test.ping -i
linux-node1.example.com:
    True
linux-node2.example.com:
    True

四，salt-ssh命令用法

-r, –raw, –raw-shell # 直接使用shell命令
–priv #指定SSH私有密鑰文件
–roster #定義使用哪一個roster系統，若是定義了一個後端數據庫，掃描方式，或者用戶自定義的的roster系統，默認的就是/etc/salt/roster文件
–roster-file #指定roster文件
–refresh, –refresh-cache #刷新cache，若是target的grains改變會自動刷新
–max-procs #指定進程數，默認爲25
-i, –ignore-host-keys #當ssh鏈接時，忽略keys
–passwd #指定默認密碼
–key-deploy #配置keys 設置這個參數對於全部minions用來部署ssh-key認證，
 這個參和–passwd結合起來使用會使初始化部署很快很方便。當調用master模塊時，並加上參數 –key-deploy 便可在minions生成keys，下次開始就不使用密碼

五，salt-ssh執行狀態模塊

[root@linux-node1 ~]# salt-ssh '*' state.sls web.lamp
linux-node2.example.com:
----------
          ID: lamp-install
    Function: pkg.installed
      Result: True
     Comment: All specified packages are already installed.
     Started: 00:31:01.867400
    Duration: 802.47 ms
     Changes:   
----------
          ID: apache-config
    Function: file.managed
        Name: /etc/httpd/conf/httpd.conf
      Result: True
     Comment: File /etc/httpd/conf/httpd.conf is in the correct state
     Started: 00:31:02.694092
    Duration: 52.696 ms
     Changes:   
----------
          ID: php-config
    Function: file.managed
        Name: /etc/php.ini
      Result: True
     Comment: File /etc/php.ini is in the correct state
     Started: 00:31:02.746901
    Duration: 1.453 ms
     Changes:   
----------
          ID: lamp-service
    Function: service.running
        Name: httpd
      Result: True
     Comment: Service httpd is already enabled, and is in the desired state
     Started: 00:31:02.752421
    Duration: 249.895 ms
     Changes:   
----------
          ID: apache-conf
    Function: file.recurse
        Name: /etc/httpd/conf.d
      Result: True
     Comment: The directory /etc/httpd/conf.d is in the correct state
     Started: 00:31:03.002535
    Duration: 7.066 ms
     Changes:   
----------
          ID: apache-auth
    Function: pkg.installed
        Name: httpd-tools
      Result: True
     Comment: Package httpd-tools is already installed.
     Started: 00:31:03.009760
    Duration: 0.512 ms
     Changes:   
----------
          ID: apache-auth
    Function: cmd.run
        Name: htpasswd -bc /etc/httpd/conf/htpasswd_file admin admin
      Result: True
     Comment: unless execution succeeded
     Started: 00:31:03.016294
    Duration: 7.043 ms
     Changes:   

Summary
------------
Succeeded: 7
Failed:    0
------------
Total states run:     7
linux-node1.example.com:
----------
          ID: lamp-install
    Function: pkg.installed
      Result: True
     Comment: All specified packages are already installed.
     Started: 00:31:01.479393
    Duration: 1072.439 ms
     Changes:   
----------
          ID: apache-config
    Function: file.managed
        Name: /etc/httpd/conf/httpd.conf
      Result: True
     Comment: File /etc/httpd/conf/httpd.conf is in the correct state
     Started: 00:31:02.575303
    Duration: 54.346 ms
     Changes:   
----------
          ID: php-config
    Function: file.managed
        Name: /etc/php.ini
      Result: True
     Comment: File /etc/php.ini is in the correct state
     Started: 00:31:02.629757
    Duration: 1.963 ms
     Changes:   
----------
          ID: lamp-service
    Function: service.running
        Name: httpd
      Result: True
     Comment: Service httpd is already enabled, and is in the desired state
     Started: 00:31:02.635879
    Duration: 233.048 ms
     Changes:   
----------
          ID: apache-conf
    Function: file.recurse
        Name: /etc/httpd/conf.d
      Result: True
     Comment: The directory /etc/httpd/conf.d is in the correct state
     Started: 00:31:02.869236
    Duration: 5.416 ms
     Changes:   
----------
          ID: apache-auth
    Function: pkg.installed
        Name: httpd-tools
      Result: True
     Comment: Package httpd-tools is already installed.
     Started: 00:31:02.874737
    Duration: 0.5 ms
     Changes:   
----------
          ID: apache-auth
    Function: cmd.run
        Name: htpasswd -bc /etc/httpd/conf/htpasswd_file admin admin
      Result: True
     Comment: unless execution succeeded
     Started: 00:31:02.880676
    Duration: 5.381 ms
     Changes:   

Summary
------------
Succeeded: 7
Failed:    0
------------
Total states run:     7

salt-ssh '*' state.sls web.lamp

總結

1.salt-ssh 是在salt基礎上打了一個python包上傳到客戶端的默認tmp目錄下

    在客戶端上面解壓並執行返回結果,最後刪除tmp上傳的臨時文件

2.salt-minion方法是salt-mater先執行語法驗證，驗證經過後發送到minion

    minion收到Msater的狀態文件默認保存在/var/cache/salt/minion

    注意：也有時候salt-master語法驗證經過，在minion上可能由於環境問題會執行失敗

3.salt-ssh和salt-minion能夠共存，salt-minion不依賴於ssh服務