saltStack运维工具的部署及master迁移实现的过程详解

服务器端：192.168.3.87

客户端：192.168.3.86、192.168.3.108





1.salt服务器端安装 192.168.3.87



rpm -Uvh http://mirrors.yun-idc.com/epel/6Server/x86_64/epel-release-6-8.noarch.rpm

yum install -y salt-master



2.安装minion客户端

rpm -Uvh http://mirrors.yun-idc.com/epel/6Server/x86_64/epel-release-6-8.noarch.rpm

yum install -y salt-minion





报错：

--> Finished Dependency Resolution

Error: Package: salt-2015.5.10-2.el6.noarch (epel)

           Requires: PyYAML

Error: Package: salt-2015.5.10-2.el6.noarch (epel)

           Requires: m2crypto

Error: Package: salt-2015.5.10-2.el6.noarch (epel)

           Requires: python-requests

Error: Package: salt-2015.5.10-2.el6.noarch (epel)

           Requires: python-jinja2

 You could try using --skip-broken to work around the problem

 You could try running: rpm -Va --nofiles --nodigest





解决办法：

将所有的本地源删除，只保留系统和epel源，重新安装即可



3.客户端配置salt master dns解析

echo "192.168.3.87 salt" >>/etc/hosts



启动服务端

service salt-master start





可以将服务端debug功能打开

vim /etc/salt/master

log_level: debug





netstat -lnt

可以看到4506和4505两个端口已经开始监听

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address               Foreign Address             State      

tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      

tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      

tcp        0      0 0.0.0.0:57718               0.0.0.0:*                   LISTEN      

tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      

tcp        0      0 0.0.0.0:4505                0.0.0.0:*                   LISTEN      

tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      

tcp        0      0 0.0.0.0:4506                0.0.0.0:*                   LISTEN      

tcp        0      0 0.0.0.0:10050               0.0.0.0:*                   LISTEN      

tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN 





客户端的salt文件列表

tree /etc/salt

/etc/salt

├── minion

├── minion.d

│   └── _schedule.conf

├── minion_id

└── pki

    └── minion

        ├── minion_master.pub

        ├── minion.pem

        └── minion.pub









列出所有的客户端

salt-key -L

Accepted Keys:

Denied Keys:

Unaccepted Keys:

centossz008

Rejected Keys:

添加指定客户端

[root@node2 test]# salt-key -a centossz008 

The following keys are going to be accepted:

Unaccepted Keys:

centossz008

Proceed? [n/Y] y

Key for minion centossz008 accepted.





添加指定客户端无需确认

salt-key -A 192.168.3.108 -y

The following keys are going to be accepted:

Unaccepted Keys:

192.168.3.108

Key for minion 192.168.3.108 accepted.





测试连通性

salt '*' test.ping

192.168.3.108:

    True

centossz008:

    True





批量执行命令：

查看时间

salt '*' cmd.run date

时间同步

salt '*' cmd.run 'ntpdate -u ntp.org'





举例

1.修改客户端的主机名由centossz008更名为minion_client01

hostname minion_client01





vim /etc/sysconfig/network

HOSTNAME=minion_client01





删除客户端之前保存的相关认证信息

rm -rf minion_id pki





服务端删除原有认证

salt-key -d centossz008 -y

Deleting the following keys:

Accepted Keys:

centossz008

Key for minion centossz008 deleted.





重启客户端后在服务端重新认证

salt-key -A -y

The following keys are going to be accepted:

Unaccepted Keys:

minion_client01.DHCP

Key for minion minion_client01.DHCP accepted.





salt '*' cmd.run 'grep salt /etc/hosts'

minion_client01.DHCP:

    192.168.3.87 salt

192.168.3.108:

    192.168.3.87 salt





2.更换salt-master主机

当master主机性能承载不了大批量机器的的时候，需要更换主机

原有主机：192.168.3.87

目标主机：192.168.3.54





①在目标master主机3.54上安装salt-master





rpm -Uvh http://mirrors.yun-idc.com/epel/6Server/x86_64/epel-release-6-8.noarch.rpm

yum install -y salt-master

Loaded plugins: fastestmirror, security

Determining fastest mirrors





报错：

Error: Cannot retrieve metalink for repository: epel. Please verify its path and try again





执行：

yum-config-manager --disable epel-testing

把epel-testing这个库从yum库里面禁用掉

发现是启用了/etc/yum.conf中的代理，取消即可





②将原主机中/etc/salt下的pki目录打包拷贝到目标机3.54的/etc/salt目录下

tar zcvf pki.tar.gz pki

scp pki.tar.gz root@192.168.3.54:/etc/salt





③目标master中解压pki目录

tar -zxvf pki.tar.gz





tree pki

pki

└── master

    ├── master.pem

    ├── master.pub

    ├── minions

    │   ├── 192.168.3.108

    │   └── minion_client01.DHCP

    ├── minions_autosign

    ├── minions_denied

    ├── minions_pre

    └── minions_rejected





启动服务

service salt-master star





④在原master主机中执行命令将minion客户端中的hosts文件改为新的master主机

# salt '*' cmd.run "grep salt /etc/hosts"

minion_client01.DHCP:

    192.168.3.87 salt

192.168.3.108:

    192.168.3.87 salt





salt '*' cmd.run "sed -i 's#192.168.3.87#192.168.3.54#' /etc/hosts"

minion_client01.DHCP:

192.168.3.108:





重启minion服务

salt '*' service.restart salt-minion

此时发现原主机已经无法执行命令了

[root@node2 salt]# salt '*' cmd.run "grep salt /etc/hosts"

192.168.3.108:

    Minion did not return. [No response]

minion_client01.DHCP:

    Minion did not return. [No response]





在新的master上执行命令测试，发现ok，说明主机成功迁移





salt '*' cmd.run date

192.168.3.108:

    Sun Aug  7 10:43:04 CST 2016

minion_client01.DHCP:

    Sun Aug  7 10:43:04 CST 2016





服务器端修改端口





syndic_master_port: 8506

publish_port: 9036