masterless

应用场景

master 与 minion 网络不通或通信有延迟，即网络不稳定
想在 minion 端直接执行状态
传统的 SaltStack 是需要通过 master 来执行状态控制 minion 从而实现状态的管理，但是当网络不稳定的时候，当想在minion本地执行状态的时候，当在只有一台主机的时候，想执行状态该怎么办呢？这就需要用到 masterless 了。

有了masterless，即使你只有一台主机，也能玩saltstack，而不需要你有N台主机架构。

masterless配置

修改配置文件minion

注释master行
取消注释file_client并设其值为local
设置file_roots
设置pillar_roots

[root@node1 ~]# vim /etc/salt/minion
# minion in masterless mode.
file_client: local	//将remove设置为local并取消此行注释
----------
# Example:
file_roots:		//将file_roots打开并设置路径和环境
  base:
    - /srv/salt/base

关闭salt-minion服务

使用 masterless 模式时是不需要启动任何服务的，包括salt-master和salt-minion。

[root@node1 ~]# systemctl stop salt-minion
[root@node1 ~]# systemctl disable salt-minion
Removed /etc/systemd/system/multi-user.target.wants/salt-minion.service.
[root@node1 ~]# systemctl status salt-minion.service 
● salt-minion.service - The Salt Minion
   Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:salt-minion(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html

salt-call

masterless模式执行模块或状态时需要使用salt-call命令，而不再是salt或者salt-ssh。需要注意的是要使用salt-call的--local选项。

[root@node1 ~]# salt-call --local cmd.run 'uptime'
local:
     23:52:04 up 24 min,  1 user,  load average: 0.24, 0.52, 0.30

[root@node1 ~]# salt-call --local cmd.run 'ls -l /root'
local:
    total 8
    -rw-------. 1 root root 1574 Nov 22 14:52 anaconda-ks.cfg
    drwxr-xr-x  4 root root   32 Nov 23 11:15 srv
    -rw-r--r--. 1 root root  421 Nov 22 23:18 ！

[root@node1 ~]# salt-call --local cmd.run 'echo "runtime" > /root/linux2'
local:

[root@node1 ~]# salt-call --local cmd.run 'ls -l /root'
local:
    total 12
    -rw-------. 1 root root 1574 Nov 22 14:52 anaconda-ks.cfg
    -rw-r--r--  1 root root    8 Nov 29 23:53 linux2
    drwxr-xr-x  4 root root   32 Nov 23 11:15 srv
    -rw-r--r--. 1 root root  421 Nov 22 23:18 ！

salt-master高可用

salt-master高可用配置

我们需要用salt来管理公司的所有机器，那么salt的master就不能宕机，否则就会整个瘫痪，所以我们必须要对salt进行高可用。salt的高可用配置非常简单，只需要改一下minion配置文件，将master用列表的形式列出即可。

NAME	IP	安装应用
master1	192.168.160.100	salt-master(已安装)
master2	192.168.160.101	salt-master
node1	192.168.160.102	salt-minion

//先安装salt-minion
查看yum源
[root@node1 ~]# ls /etc/yum.repos.d/
dzc.repo  redhat.repo  salt.repo
[root@node1 ~]# yum -y install salt-minion

//修改配置文件,添加master1IP
[root@node1 ~]# vim /etc/salt/minion
#master: salt
master: 192.168.160.100

//启动
[root@node1 ~]# systemctl enable --now salt-minion.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-minion.service → /usr/lib/systemd/system/salt-minion.service.
[root@node1 ~]# systemctl statussalt-minion.service 
Unknown operation statussalt-minion.service.
[root@node1 ~]# systemctl status salt-minion.service 
● salt-minion.service - The Salt Minion
   Loaded: loaded (/usr/lib/systemd/system/salt-minion.service; enabled; vendor>
   Active: active (running) since Tue 2021-11-30 09:17:57 CST; 9s ago
     Docs: man:salt-minion(1)
           file:///usr/share/doc/salt/html/contents.html
           https://docs.saltproject.io/en/latest/contents.html
 Main PID: 36138 (salt-minion)
    Tasks: 4 (limit: 23788)
   Memory: 92.0M
   CGroup: /system.slice/salt-minion.service
           ├─36138 /usr/bin/python3.6 /usr/bin/salt-minion
           ├─36143 /usr/bin/python3.6 /usr/bin/salt-minion
           └─36147 /usr/bin/python3.6 /usr/bin/salt-minion

//用master1连接，看是否能够通信，能够通信再做master2
[root@master1 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
Rejected Keys:
[root@master1 ~]# salt-key -ya node1
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@master1 ~]# salt-key -L
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
Rejected Keys:

[root@master1 ~]# salt node1 test.ping
node1:
    True

//查看master2是否有salt源
[root@master2 ~]# ls /etc/yum.repos.d/
dzc.repo  redhat.repo  salt.repo
[root@master2 ~]# yum -y install salt-master

//复制master1 KEY 到 master2上
[root@master1 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── minions
│   │   └── node1
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   └── minions_rejected
└── minion

7 directories, 3 files

[root@master1 ~]# scp /etc/salt/pki/master/master.p* 192.168.160.101:/etc/salt/pki/master/

[root@master2 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   └── master.pub
└── minion

 [root@master2 ~]# systemctl enable --now salt-master.service 
Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.
[root@master2 ~]# tree /etc/salt/pki/
/etc/salt/pki/
├── master
│   ├── master.pem
│   ├── master.pub
│   ├── minions
│   ├── minions_autosign
│   ├── minions_denied
│   ├── minions_pre
│   └── minions_rejected
└── minion

7 directories, 2 files

//修改node1上master IP为master2
[root@node1 ~]# vim /etc/salt/minion
#master: salt
master: 192.168.160.101
[root@node1 ~]# systemctl restart salt-minion.service 

[root@master2 ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
Rejected Keys:
[root@master2 ~]# salt-key -ya node1
The following keys are going to be accepted:
Unaccepted Keys:
node1
Key for minion node1 accepted.
[root@master2 ~]# salt-key -L
Accepted Keys:
node1
Denied Keys:
Unaccepted Keys:
Rejected Keys:

//用master2去pingnode1
[root@master2 ~]# salt node1 test.ping
node1:
    True

//修改配置文件
[root@node1 ~]# vim /etc/salt/minion
#master: salt
master: 
  - 192.168.160.100
  - 192.168.160.101

# beacons) without a master connection
master_type: failover		//高可用

# of TCP connections, such as load balancers.)
master_alive_interval: 10	//接管时间
[root@node1 ~]# systemctl restart salt-minion.service 

//master1ping通，而master2ping不通
[root@master1 ~]# salt node1 test.ping
node1:
    True
[root@master2 ~]# salt node1 test.ping
node1:
    Minion did not return. [No response]
    The minions may not have all finished running and any remaining minions will return upon completion. To look up the return data for this job later, run the following command:
    
    salt-run jobs.lookup_jid 20211129181505098277
ERROR: Minions returned with non-zero exit code

//将master1停掉等10s用master2ping
[root@master1 ~]# systemctl stop salt-master.service 
[root@master2 ~]# salt node1 test.ping
node1:
    True
此时master2 ping通了，再启动master1，停掉master2测试
[root@master1 ~]# systemctl start salt-master.service
[root@master2 ~]# systemctl stop salt-master.service 
[root@master1 ~]# salt node1 test.ping
node1:
    True

//查看

本例列出的主机上必须都安装了salt-master且保证服务都是正常状态。

salt-master高可用之数据同步

涉及到高可用时，数据的同步是个永恒的话题，我们必须保证高可用的2个master间使用的数据是一致的，包括：

/etc/salt/master配置文件
/etc/salt/pki目录下的所有key
/srv/下的salt和pillar目录下的所有文件

保障这些数据同步的方案有：

nfs挂载
rsync同步
使用gitlab进行版本控制

安全相关：
为保证数据的同步与防止丢失，可将状态文件通过gitlab进行版本控制管理。

salt-syndic分布式架构

salt-syndic架构图

salt-syndic的优劣势

优势：

可以通过syndic实现更复杂的salt架构
减轻master的负担

劣势：

syndic的/srv目录下的salt和pillar目录内容要与最顶层的master下的一致，所以要进行数据同步，同步方案同salt-master高可用
最顶层的master不知道自己有几个syndic，它只知道自己有多少个minion，并不知道这些minion是由哪些syndic来管理的

salt-syndic部署

环境说明

主机名	主机IP	角色	安装的应用
master	192.168.160.100	Master	salt-master
syndic	192.168.160.101	Syndic	salt-master salt-syndic
node1	192.168.160.102	Minion	salt-minion
node2	192.168.160.103	Minion	salt-minion

安装salt-master与salt-syndic

在Master与syndic上安装salt-master，在syndic上安装salt-syndic

[root@syndic ~]# yum -y install salt-syndic

配置master

修改master的master配置文件

取消注释order_master
将order_master的值设为True

[root@master ~]# vim /etc/salt/master
# masters' syndic interfaces.
order_masters: True		//取消注释 并设置为True

//重启
[root@master ~]# systemctl restart salt-master
```、

### 配置syndic
修改syndic所在主机的master配置文件

- 取消注释syndic_master
- 将syndic_master的值设为master的IP

[root@syndic ~]# vim /etc/salt/master

this master where to receive commands from.

syndic_master: 192.168.160.100 ?/取消注释并设置为master的IP

//启动
[root@syndic ~]# systemctl enable --now salt-master.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-master.service → /usr/lib/systemd/system/salt-master.service.

[root@syndic ~]# systemctl enable --now salt-syndic.service
Created symlink /etc/systemd/system/multi-user.target.wants/salt-syndic.service → /usr/lib/systemd/system/salt-syndic.service.


### 配置minion
配置minion，将master指向syndic所在主机

[root@node1 ~]# vim /etc/salt/minion
#master: salt
master: 192.168.160.100
[root@node1 ~]# systemctl restart salt-minion.service

[root@node2 ~]# vim /etc/salt/minion
#master: salt
master: 192.168.160.101
[root@node2 ~]# systemctl restart salt-minion.service

在所有minion上做同样的操作，注意，要设置minion配置文件中的id参数，指向minion自身的ip地址或主机名，必须能够唯一标识minion本机。

### 在syndic上接受minion主机的key

[root@syndic ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
node1
node2
Rejected Keys:

[root@syndic ~]# salt-key -A
The following keys are going to be accepted:
Unaccepted Keys:
node1
node2
Proceed? [n/Y] Y
Key for minion node1 accepted.
Key for minion node2 accepted.

[root@syndic ~]# salt-key -L
Accepted Keys:
node1
node2
Denied Keys:
Unaccepted Keys:
Rejected Keys:

//测试
[root@syndic ~]# salt '*' test.ping
node2:
True
node1:
True


### 在master上接受syndic主机的key

[root@master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
syndic
Rejected Keys:

[root@master ~]# salt-key -yA
The following keys are going to be accepted:
Unaccepted Keys:
syndic
Key for minion syndic accepted.

[root@master ~]# salt-key -L
Accepted Keys:
syndic
Denied Keys:
Unaccepted Keys:
Rejected Keys:


### 在Master上测试有几个minion应答

[root@master ~]# salt '*' test.ping
node1:
True
node2:
True

目录CONTENT

SaltStack进阶