Saltstack

Posted 2020-11-21 jweiqing

1、Saltstack的httpapi

安装

①、在官网更新yum源信息

②、yum安装

yum install -y gcc make python-devel libffi-devel salt-api openssl

pip install cherrypy

生成证书：

#  cd /etc/salt

#  mkdir keycrt

#  cd keycrt

#  openssl genrsa –out key.pem 4096

#  openssl req –new –x 509 –key key.pem –out cert.pem –days 1826

③、配置用户以及权限：

a)、首先需要在master上检查配置文件：

default_include: master.d/*.conf
interface: 192.168.48.128
conf_file: /etc/salt/master
pki_dir: /etc/salt/pki/master
auto_accept: True
file_roots:
base:
- /srv/salt/
log_file:/var/log/salt/master
log_level_logfile: debug

b)、配置salt-api的配置文件：

[[email protected] master.d]# cd /etc/salt/master.d/

[[email protected] master.d]# ls

api.conf  eauth.conf

[[email protected] master.d]# cat api.conf

rest_cherrypy:
  port: 8000
  ssl_crt: /etc/salt/keycrt/cert.pem
  ssl_key: /etc/salt/keycrt/key.pem

[[email protected] master.d]# cat eauth.conf

external_auth:
  pam:
    saltapi:
      - .*
      - ‘@wheel‘
      - ‘@runner‘

c)、创建用户

useradd -M -s /sbin/nologin/ saltapi

echo “saltapi” |passwd saltapi --stdin

注意这个应用名和上面的saltapi要对应一致

启动salt-api

systemctl restart salt-api

netstat –anp | grep 8000

对于ubuntu系统，我们可能使用https也是没法使用，我们可以使用http协议，具体的配置如下：

[email protected]:/etc/salt/master.d# cat api.conf

rest_cherrypy:
  port: 8000
  disable_ssl: True
  #ssl_crt: /etc/salt/keycrt/cert.pem
  #ssl_key: /etc/salt/keycrt/key.pem

注意以上的： disable_ssl: True

然后把ssl秘钥和公钥注释掉，eauth.conf 不发生变化

获取token：http协议

[[email protected] master.d]# curl -X POST -k http://192.168.48.134:8000/login -d username=‘saltapi‘ -d password=‘saltapi‘ -d eauth=‘pam‘ |python -mjson.tool

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   240  100   197  100    43     45      9  0:00:04  0:00:04 --:--:--    45
{
    "return": [
        {
            "eauth": "pam",
            "expire": 1517235285.554001,
            "perms": [
                ".*",
                "@wheel",
                "@runner"
            ],
            "start": 1517192085.554001,
            "token": "105ee1f28109d67855ce7898e75e173a678f5174",
            "user": "saltapi"
        }
    ]
}

获取token：https协议（centos7）

[[email protected] master.d]# curl -X POST -k https://192.168.48.131:8000/login -d username=‘saltapi‘ -d password=‘saltapi‘ -d eauth=‘pam‘ |python -mjson.tool

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   240  100   197  100    43    908    198 --:--:-- --:--:-- --:--:--   912
{
    "return": [
        {
            "eauth": "pam",
            "expire": 1517235312.537542,
            "perms": [
                ".*",
                "@wheel",
                "@runner"
            ],
            "start": 1517192112.537541,
            "token": "bd5922438e9ae10db039816728c2b86f9462a0bb",
            "user": "saltapi"
        }
    ]
}

通过postman来获取token

Headers里面是用来存放headers的信息的

Body里面来存放数据的，常用的data数据就是x-www-form-urlencoded

form-data 是用来存放页面form表单数据的

只要salt-api不重启，token就不会过期，salt-api重启以后，token就会过期

通过postman来获取执行module：

通过curl来获取执行module：

[email protected]:/etc/salt/master.d# curl -k http://192.168.48.134:8000 -H "Accept: application/x-yaml" -H "X-Auth-Token: ec623ed62de7dd62cfdadb94ad0044b7f46c9549" -d

client=‘local‘ -d tgt=‘*‘ -d fun=‘test.ping‘
return:
192.168.48.129: true

运行runner

[email protected]:/etc/salt/master.d# curl -k http://192.168.48.134:8000 -H "Accept: application/x-yaml" -H "X-Auth-Token: ec623ed62de7dd62cfdadb94ad0044b7f46c9549" -d

client=‘runner‘ -d fun=‘manage.status‘            
return:
- down: []
  up:
  - 192.168.48.129

任务

1.自定义一些module
2. 线上使用runner的实例
3. 通过python脚本取访问salt的httpapi