linuxea:ansible使用synchronize普通用户权限问题 1,首先已经做好了密钥认证[gitlab-runner@Linuxea-VM-Node_10_10_240_145 root]$ ssh root@10.10.240.203 [root@Linuxea-VM-Node203 ~]# [root@Linuxea-VM-Node203 ~]# exit 登出 Connection to 10.10.240.203 closed.切换到普通用户推送出现问题[gitlab-runner@Linuxea-VM-Node_10_10_240_145 root]$ ansible 10.10.240.203 -m synchronize -a 'src=/home/gitlab-runner/123.txt dest=/data/wwwroot/' An exception occurred during task execution. To see the full traceback, use -vvv. The error was: OSError: [Errno 13] Permission denied: '.' 10.10.240.203 | FAILED! => { "msg": "Unexpected failure during module execution.", "stdout": "" }查看详情[gitlab-runner@Linuxea-VM-Node_10_10_240_145 root]$ ansible 10.10.240.203 -m synchronize -a 'src=/home/gitlab-runner/123.txt dest=/data/wwwroot/' -vvv ansible 2.5.3 config file = /etc/ansible/ansible.cfg configured module search path = [u'/home/gitlab-runner/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python2.7/site-packages/ansible executable location = /usr/bin/ansible python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)] Using /etc/ansible/ansible.cfg as config file Parsed /etc/ansible/hosts inventory source with ini plugin META: ran handlers Using module file /usr/lib/python2.7/site-packages/ansible/modules/files/synchronize.py The full traceback is: Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 138, in run res = self._execute() File "/usr/lib/python2.7/site-packages/ansible/executor/task_executor.py", line 561, in _execute result = self._handler.run(task_vars=variables) File "/usr/lib/python2.7/site-packages/ansible/plugins/action/synchronize.py", line 414, in run result.update(self._execute_module('synchronize', module_args=_tmp_args, task_vars=task_vars)) File "/usr/lib/python2.7/site-packages/ansible/plugins/action/__init__.py", line 720, in _execute_module self._make_tmp_path() File "/usr/lib/python2.7/site-packages/ansible/plugins/action/__init__.py", line 255, in _make_tmp_path tmpdir = self._remote_expand_user(remote_tmp, sudoable=False) File "/usr/lib/python2.7/site-packages/ansible/plugins/action/__init__.py", line 590, in _remote_expand_user data = self._low_level_execute_command(cmd, sudoable=False) File "/usr/lib/python2.7/site-packages/ansible/plugins/action/__init__.py", line 915, in _low_level_execute_command os.chdir(self._loader.get_basedir()) OSError: [Errno 13] Permission denied: '.' 10.10.240.203 | FAILED! => { "msg": "Unexpected failure during module execution.", "stdout": "" }删掉之前的目录，重新推送创建[gitlab-runner@Linuxea-VM-Node_10_10_240_145 ~]$ ansible linuxea -m synchronize -a 'src=/home/gitlab-runner/123.txt dest=/data/wwwroot/' -vvv ansible 2.5.3 config file = /etc/ansible/ansible.cfg configured module search path = [u'/home/gitlab-runner/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python2.7/site-packages/ansible executable location = /usr/bin/ansible python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)] Using /etc/ansible/ansible.cfg as config file Parsed /etc/ansible/hosts inventory source with ini plugin META: ran handlers Using module file /usr/lib/python2.7/site-packages/ansible/modules/files/synchronize.py Using module file /usr/lib/python2.7/site-packages/ansible/modules/files/synchronize.py <10.10.240.202> ESTABLISH LOCAL CONNECTION FOR USER: gitlab-runner <10.10.240.202> EXEC /bin/sh -c 'echo ~root && sleep 0' <10.10.240.203> ESTABLISH LOCAL CONNECTION FOR USER: gitlab-runner <10.10.240.203> EXEC /bin/sh -c 'echo ~root && sleep 0' <10.10.240.203> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-161212317664020 `" && echo ansible-tmp-1528855639.99-161212317664020="` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-161212317664020 `" ) && sleep 0' <10.10.240.202> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-180372546287702 `" && echo ansible-tmp-1528855639.99-180372546287702="` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-180372546287702 `" ) && sleep 0' 10.10.240.203 | UNREACHABLE! => { "changed": false, "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-161212317664020 `\" && echo ansible-tmp-1528855639.99-161212317664020=\"` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-161212317664020 `\" ), exited with result 1", "unreachable": true } 10.10.240.202 | UNREACHABLE! => { "changed": false, "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-180372546287702 `\" && echo ansible-tmp-1528855639.99-180372546287702=\"` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-180372546287702 `\" ), exited with result 1", "unreachable": true }可以看到这里报错 "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-180372546287702 `\" && echo ansible-tmp-1528855639.99-180372546287702=\"` echo /root/.ansible/tmp/ansible-tmp-1528855639.99-180372546287702 `\" ), exited with result 1", 将配置文件中remote_tmp = ~/.ansible/tmp 修改 remote_tmp = /tmp/.ansible/tmp，这里主要是权限问题切换root用户修改后在来推送验证一下已经ok

Saltstack帮助说明 SaltStack@Master: salt-key -hActions:-l ARG, --list=ARG 显示指定状态的key(支持正则表-L, --list-all 显示所有public keys-a ACCEPT, --accept=ACCEPT 接受指定等待认证的key(-A, --accept-all 接受所有等待认证的key-r REJECT, --reject=REJECT 拒绝指定等待认证的key(-R, --reject-all 拒绝所有等待认证的key--include-all 显示所有状态的key(包含-p PRINT, --print=PRINT 打印指定的public key(-P, --print-all 打印所有的public key-d DELETE, --delete=DELETE 删除指定key-D, --delete-all 删除所有的key-f FINGER, --finger=FINGER 显示指定key的指纹信息-F, --finger-all 显示所有key的指纹信息Options:--version 查看SaltStack程序的版本号--versions-report 查看SaltStack程序以及依赖包的版本号-h, --help 查看帮助信息-c CONFIG_DIR, --config-dir=CONFIG_DIR 指定配置文件目录-t TIMEOUT, --timeout=TIMEOUT 指定Timeout时间(默认是5s)--hard-crash 捕捉到original异常不退出(默认关闭-s, --static 以组的形式返回所有Minion的数据--async 异步执行-v, --verbose verbose模式--show-timeout 显示minion timeout状态--show-jid 显示任务jid-b BATCH, --batch=BATCH 按照百分比执行任务-a EAUTH, --auth=EAUTH, --eauth=EAUTH, --external-auth=指定外部认证方式-T, --make-token 生成Master token--return=RETURNER 指定SaltStack return-d, --doc 查看指定模块或者所有模块文档--args-separator=ARGS_SEPARATOR 设置多个传参直接分隔符--summary 显示汇总信息--username=USERNAME 指定外部认证用户名--password=PASSWORD 指定外部认证密码所有日志相关参数：Logging Options:-l LOG_LEVEL, --log-level=LOG_LEVEL 指定日志级别--log-file=LOG_FILE 指定日志记录文件所有操作目标参数：Target Options:-E, --pcre 正则匹配-L, --list 列表匹配-G, --grain grains匹配--grain-pcre grains加正则匹配-N, --nodegroup 组匹配-R, --range 范围匹配-C, --compound 综合匹配(指定多个匹配)-I, --pillar pillar值匹配-S, --ipcidr minions网段地址匹配所有输出参数：Output Options:--out=OUTPUT, --output=OUTPUT 指定输出格式--out-file=OUTPUT_FILE 指定输出文件--no-color, --no-colour 关闭所有颜色显示--force-color, --force-colour 强制输出颜色显示--state-output=STATE_OUTPUT 指定states输出格式SaltStack@Minion: rpm -ql salt-minion/etc/rc.d/init.d/salt-minion #salt minion服务启动脚本/etc/salt/minion #salt minion配置文件/usr/bin/salt-call #salt call拉取命令/usr/bin/salt-minion #salt minion 服务命令salt命令的output与log的相关参数。SaltStack@Minion: salt-call -hOptions:--version 查看SaltStack程序的版本号--versions-report 查看SaltStack程序以及依赖包的版本号-h, --help 查看帮助信息-c CONFIG_DIR, --config-dir=CONFIG_DIR 指定配置文件目录--hard-crash 扑捉到original异常不退出(默认关闭-g, --grains 返回的信息生成grains-m MODULE_DIRS, --module-dirs=MODULE_DIRS 指定自定义模块目-d, --doc, --documentation 查看指定模块或者所有模块文档--master=MASTER 指定SaltStack Master--return=RETURNER 指定SaltStack return--local 运行masterless模式--file-root=FILE_ROOT 指定file-root目录--pillar-root=PILLAR_ROOT 指定pillar-root目录--retcode-passthrough 显示salt-call命令返回状态--metadata 打印metadata信息--id=ID 指定一个minion ID--skip-grains 不加载grains信息--refresh-grains-cache 强制刷新grains信息·max_open_files——可以根据Master将Minion数量进行适当的调整。·timeout——可以根据Master和Minion的网络状况适当调整。·auto_accept和autosign_file——在大规模部署Minion的时候可以设置自动签证。.max_open_files——可以根据Master将Minion数量进行适当的调整。·timeout——可以根据Master和Minion的网络状况适当调整。·auto_accept和autosign_file——在大规模部署Minion的时候可以设置自动签证。

Ansible简单安装和批量配置 Ansibleansible不需要任何agent，除了sshd，在ansible不执行时不占用管控端任何资源（默认支持ssh，也支持其他）ansible也没有服务端，只有在需要时执行命令即可ansible基于模块工作，执行命令，脚本，计划任务等都需要一个模块来实现，ansible有近百个模块，模块可以由任意编程语言开发ansible支持yaml语言任务列表，来做多主机多任务ansible由python研发YAML语法和其他语法类似，可以简单表达清单，散列，标量等数据结构。其结构（structure）通过空格来展示，序列（sequence）里的项用“-”来代表，map里的键值对用“:"分割。如下实例：- hosts: 主机名或组名，可以是多个 vars： http_prot:80 max_clients:256 remote_user:root tashs： 任务 - name:任务名称 yum: name=httpd state=latest 安装httpd - name: service: name=httpd state=started 确保安装后能够启动下载ansible:https://pypi.python.org/pypi/ansible http://pkgs.org/download/ansible https://pypi.python.org/packages/source/a/ansible/ansible-2.0.1.0.tar.gz 一，编译安装ansible1，安装依赖包：yum install python-jinja2 PyYAML python-paramiko python-babel python-crypto pip* gcc python-devel wget -P /usr/local/ https://pypi.python.org/packages/source/a/ansible/ansible-2.0.1.0.tar.gz && cd /usr/local tar xf ansible-2.0.1.0.tar.gz ln -sv ansible-2.0.1.0 ansible cd ansible python setup.py build python setup.py install mkdir /etc/ansible cp -r examples/* /etc/ansible [root@yum-down bin]# ls /etc/ansible/ ansible.cfg 配置文件 hosts 主机文件 yum remove python-jinja2 PyYAML python-paramiko python-babel python-crypto gcc python-devel 在hosts文件中，定义主机可以单独写主机名或者ip，也可以使用[主机组]，或者通配符www.[1*].com1，添加主机：[db-server] 192.168.1.7 192.168.1.8 [web-server] 192.168.1.4 2，添加ssh-key[root@yum-down ansible]# ssh-keygen -t rsa -P '' [root@yum-down ansible]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.1.4 [root@yum-down ansible]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.1.7 [root@yum-down ansible]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.1.8 3，查看时间[root@yum-down bin]# ./ansible all -a 'date' 192.168.1.7 | SUCCESS | rc=0 >> Sat Apr 9 05:58:16 PDT 2016 192.168.1.8 | SUCCESS | rc=0 >> Sat Apr 9 05:58:16 PDT 2016 192.168.1.4 | SUCCESS | rc=0 >> Sat Apr 9 05:58:16 PDT 2016 [root@yum-down bin]# ./ansible all -m command -a 'date' 192.168.1.4 | SUCCESS | rc=0 >> Sat Apr 9 05:58:36 PDT 2016 192.168.1.7 | SUCCESS | rc=0 >> Sat Apr 9 05:58:36 PDT 2016 192.168.1.8 | SUCCESS | rc=0 >> Sat Apr 9 05:58:36 PDT 2016 [root@yum-down bin]# ./ansible all -m command -a 'service httpd status' 192.168.1.7 | FAILED | rc=3 >> httpd is stopped 192.168.1.8 | FAILED | rc=3 >> httpd is stopped 192.168.1.4 | FAILED | rc=3 >> httpd is stopped 4,列出所有模块的支持[root@yum-down bin]# ./ansible-doc -l查看模块的参数帮助[root@yum-down bin]# ./ansible-doc -s copy二，yum安装 yum -y install ansible即可1，文件推送copy将root下epel-release-6-8.noarch.rpm推送到db-server组中机器的opt目录下[root@node ansible]# ansible db-server -m copy -a "src=/root/epel-release-6-8.noarch.rpm dest=/opt/" 192.168.1.8 | success >> { "changed": true, "checksum": "2b2767a5ae0de30b9c7b840f2e34f5dd9deaf19a", "dest": "/opt/epel-release-6-8.noarch.rpm", "gid": 0, "group": "root", "md5sum": "2cd0ae668a585a14e07c2ea4f264d79b", "mode": "0644", "owner": "root", "size": 14540, "src": "/root/.ansible/tmp/ansible-tmp-1460221879.64-117005813385704/source", "state": "file", "uid": 0 } 192.168.1.7 | success >> { "changed": true, "checksum": "2b2767a5ae0de30b9c7b840f2e34f5dd9deaf19a", "dest": "/opt/epel-release-6-8.noarch.rpm", "gid": 0, "group": "root", "md5sum": "2cd0ae668a585a14e07c2ea4f264d79b", "mode": "0644", "owner": "root", "size": 14540, "src": "/root/.ansible/tmp/ansible-tmp-1460221879.64-59861356394345/source", "state": "file", "uid": 0 } [root@node ansible]# 2，验证[root@node ansible]# ansible db-server -a "ls /opt" 192.168.1.8 | success | rc=0 >> epel-release-6-8.noarch.rpm logstash rh 192.168.1.7 | success | rc=0 >> epel-release-6-8.noarch.rpm rh [root@node ansible]# 定义cron任务[root@node ansible]# ansible all -m cron -a'name="custom job" minute=*/3 hour=* day=* month=* weekday=* job="/usr/sbin/ntpdate 192.168.1.6"' 192.168.1.7 | success >> { "changed": true, "jobs": [ "custom job", "linuxea job" ] } 192.168.1.4 | success >> { "changed": true, "jobs": [ "custom job", "linuxea job" ] } 192.168.1.8 | success >> { "changed": true, "jobs": [ "custom job", "linuxea job" ] } 查看：[root@node ansible]# ansible all -a "crontab -l" 192.168.1.7 | success | rc=0 >> #Ansible: custom job */3 * * * * /usr/sbin/ntpdate 192.168.1.6 192.168.1.8 | success | rc=0 >> #Ansible: custom job */3 * * * * /usr/sbin/ntpdate 192.168.1.6 192.168.1.4 | success | rc=0 >> #Ansible: custom job */3 * * * * /usr/sbin/ntpdate 192.168.1.6 [root@node ansible]# 创建组：[root@node ansible]# ansible-doc -s group action: group gid # Optional `GID' to set for the group. name= # Name of the group to manage. state # Whether the group should be present or not on the remote host. system # If `yes', indicates that the group created is a system group. [root@node ansible]# ansible all -m group -a "gid=300 system=yes name=mysql" 192.168.1.8 | success >> { "changed": true, "gid": 300, "name": "mysql", "state": "present", "system": true } 192.168.1.7 | success >> { "changed": true, "gid": 300, "name": "mysql", "state": "present", "system": true } 192.168.1.4 | success >> { "changed": true, "gid": 300, "name": "mysql", "state": "present", "system": true } [root@node ansible]# ansible all -a "tail -1 /etc/group" 192.168.1.4 | success | rc=0 >> mysql:x:300: 192.168.1.7 | success | rc=0 >> mysql:x:300: 192.168.1.8 | success | rc=0 >> mysql:x:300: [root@node ansible]# yum安装[root@yum-down ~]# ansible-doc -s yum action: yum conf_file 指定配置文件 disable_gpg_check disablerepo enablerepo list . name= state update_cache 安装corosync [root@yum-down ~]# ansible all -m yum -a "state=present name=corosync" [root@yum-down ~]# ansible all -a "rpm -qa corosync" 192.168.1.4 | success | rc=0 >> corosync-1.4.7-2.el6.x86_64 192.168.1.8 | success | rc=0 >> corosync-1.4.7-2.el6.x86_64 192.168.1.7 | success | rc=0 >> corosync-1.4.7-2.el6.x86_64 [root@yum-down ~]# 启动服务：[root@yum-down ~]# ansible all -m service -a "state=started name=httpd enabled=yes" 192.168.1.7 | success >> { "changed": false, "enabled": true, "name": "httpd", "state": "started" } 192.168.1.8 | success >> { "changed": false, "enabled": true, "name": "httpd", "state": "started" } 192.168.1.4 | success >> { "changed": true, "enabled": true, "name": "httpd", "state": "started" } 查看[root@yum-down ~]# ansible all -a "service httpd status" 192.168.1.4 | success | rc=0 >> httpd (pid 3702) is running... 192.168.1.7 | success | rc=0 >> httpd (pid 4046) is running... 192.168.1.8 | success | rc=0 >> httpd (pid 4097) is running... [root@yum-down ~]# 执行多个命令[root@yum-down ~]# cat linuxea.yaml - hosts: all 所有主机 remote_user: root 执行用户 tasks: - name: add group 添加用户 group: gid=1000 name=linuxea system=no - name: excute a command 执行时间 command: /bin/date [root@yum-down ~]# 执行[root@yum-down ~]# ansible-playbook linuxea.yaml PLAY [all] ******************************************************************** GATHERING FACTS *************************************************************** ok: [192.168.1.7] ok: [192.168.1.8] ok: [192.168.1.4] TASK: [add group] ************************************************************* changed: [192.168.1.4] changed: [192.168.1.8] changed: [192.168.1.7] TASK: [excute a command] ****************************************************** changed: [192.168.1.4] changed: [192.168.1.7] changed: [192.168.1.8] PLAY RECAP ******************************************************************** 192.168.1.4 : ok=3 changed=2 unreachable=0 failed=0 192.168.1.7 : ok=3 changed=2 unreachable=0 failed=0 192.168.1.8 : ok=3 changed=2 unreachable=0 failed=0 [root@yum-down ~]# 批量替换文件修改httpd端口为801，而后将文件推送并且重启服务[root@yum-down ~]# cat web.yaml - hosts: all remote_user: root tasks: - name: ensure apache latest version 确保apache是最新版本 yum: state=latest name=httpd 确保httpd安装 - name: copy configure file 复制文件 copy: src=/root/httpd.conf dest=/etc/httpd/conf/httpd.conf force=yes 复制文件 notify: 复制完成执行的任务 - restart httpd handlers: 重启，这里如果文件被修改则被激活，并且重启 - name: restart httpd service: name=httpd state=restarted [root@yum-down ~]# 执行[root@yum-down ~]# ansible-playbook web.yaml PLAY [all] ******************************************************************** GATHERING FACTS *************************************************************** ok: [192.168.1.4] ok: [192.168.1.7] ok: [192.168.1.8] TASK: [ensure apache latest version] ****************************************** ok: [192.168.1.4] ok: [192.168.1.7] ok: [192.168.1.8] TASK: [copy configure file] *************************************************** changed: [192.168.1.4] changed: [192.168.1.7] changed: [192.168.1.8] NOTIFIED: [restart httpd] ***************************************************** changed: [192.168.1.4] changed: [192.168.1.7] changed: [192.168.1.8] PLAY RECAP ******************************************************************** 192.168.1.4 : ok=4 changed=2 unreachable=0 failed=0 192.168.1.7 : ok=4 changed=2 unreachable=0 failed=0 192.168.1.8 : ok=4 changed=2 unreachable=0 failed=0 查看[root@yum-down ~]# ansible all -a "ss -tlnp" 192.168.1.4 | success | rc=0 >> State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 :::801 :::* users:(("httpd",4973,6),("httpd",4976,6),("httpd",4977,6),("httpd",4978,6),("httpd",4979,6),("httpd",4980,6),("httpd",4981,6),("httpd",4982,6),("httpd",4983,6)) 192.168.1.7 | success | rc=0 >> State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 :::801 :::* users:(("httpd",5302,6),("httpd",5305,6),("httpd",5306,6),("httpd",5307,6),("httpd",5308,6),("httpd",5309,6),("httpd",5310,6),("httpd",5311,6),("httpd",5312,6)) 192.168.1.8 | success | rc=0 >> State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 :::801 :::* users:(("httpd",5382,6),("httpd",5385,6),("httpd",5386,6),("httpd",5387,6),("httpd",5388,6),("httpd",5389,6),("httpd",5390,6),("httpd",5391,6),("httpd",5392,6)) [root@yum-down ~]#

saltstack配置文件的模块简单写法 配置文件的模块写法[root@master init]# cat zabbix_agent.sls zabbix_agent: pkg.installed: - names: - zabbix22-agent file.managed: - name: /etc/zabbix_agentd.conf - source: salt://init/files/zabbix_agentd.conf - user: root - group: root - mode: 644 service.running: - name: zabbix-agentd - enable: True - reload: True - watch: - file: zabbix_agent 如上！比如我们修改的是zabbix_agentd.conf中的Server=10.0.0.22则，只需要将zabbix_agentd.conf的server端定义变量即可Server={{Zabbix_Server}} 如下：template: zabbixjinjiadefaults:Zabbix_Server: {{ pillar'zabbix-agent' }}如下：[root@master init]# pwd /etc/salt/status/init [root@master init]# [root@master init]# vim zabbix_agent.sls zabbix_agent: pkg.installed: - names: - zabbix22-agent file.managed: - name: /etc/zabbix_agentd.conf - source: salt://init/files/zabbix_agentd.conf - user: root - group: root - mode: 644 - template: jinja - defaults: Zabbix_Server: {{ pillar['zabbix-agent']['Zabbix_Server'] }} service.running: - name: zabbix-agentd - enable: True - reload: True - watch: - file: zabbix_agent 而后创建在pillar下zabbix_agent.sls[root@master init]# pwd /etc/salt/pillar/init [root@master init]# [root@master init]# cat zabbix_agent.sls zabbix-agent: Zabbix_Server: 10.0.0.222 注意：Zabbix_Server: 10.0.0.222 ------>对应status/init下的zabbix_agent中的Zabbix_Server: {{ pillar['zabbix-agent']['Zabbix_Server'] }}的'Zabbix_Server'而后在pillar下的top.sls中添加- init.zabbix_agent[root@master pillar]# vim top.sls [root@master pillar]# pwd /etc/salt/pillar [root@master pillar]# cat top.sls base: '*': - init.rsyslog - init.zabbix_agent [root@master pillar]# 执行结果如下：[root@master init]# salt '*' state.highstate minion.23.com: ---------- ID: pkg.init Function: pkg.installed Name: mtr Result: True Comment: Package mtr is already installed. Started: 08:19:01.343078 Duration: 677.19 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: nginx Result: True Comment: Package nginx is already installed. Started: 08:19:02.020432 Duration: 0.443 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: lrzsz Result: True Comment: Package lrzsz is already installed. Started: 08:19:02.020936 Duration: 0.248 ms Changes: ---------- ID: zabbix_agent Function: pkg.installed Name: zabbix22-agent Result: True Comment: Package zabbix22-agent is already installed. Started: 08:19:02.021242 Duration: 0.248 ms Changes: ---------- ID: zabbix_agent Function: file.managed Name: /etc/zabbix_agentd.conf Result: True Comment: File /etc/zabbix_agentd.conf updated Started: 08:19:02.023524 Duration: 12.842 ms Changes: ---------- diff: --- +++ @@ -84,7 +84,7 @@ # Server= #Server=127.0.0.1 -Server=10.0.0.22 +Server=10.0.0.222 ### Option: ListenPort # Agent will listen on this port for connections from the server. ---------- ID: zabbix_agent Function: service.running Name: zabbix-agentd Result: True Comment: Service reloaded Started: 08:19:02.065563 Duration: 178.509 ms Changes: ---------- zabbix-agentd: True Summary ------------ Succeeded: 6 (changed=2) Failed: 0 ------------ Total states run: 6 第二种修改方式： - template: jinja - defaults: Zabbix_Server: {{ pillar['Zabbix_Server'] }} 如下：[root@master init]# pwd /etc/salt/status/init [root@master init]# [root@master init]# vim zabbix_agent.sls zabbix_agent: pkg.installed: - names: - zabbix22-agent file.managed: - name: /etc/zabbix_agentd.conf - source: salt://init/files/zabbix_agentd.conf - user: root - group: root - mode: 644 - template: jinja - defaults: Zabbix_Server: {{ pillar['Zabbix_Server'] }} service.running: - name: zabbix-agentd - enable: True - reload: True - watch: - file: zabbix_agent [root@master init]# pwd /etc/salt/status/init [root@master init]# 注释掉#zabbix-agent:，修改下ip以示区别[root@master init]# vim ../../pillar/init/zabbix_agent.sls #zabbix-agent: Zabbix_Server: 10.0.0.111------------------>key是和zabbix_agentd中的一样 跑一边查看！已经OK[root@master init]# salt '*' state.highstate minion.23.com: ---------- ID: pkg.init Function: pkg.installed Name: mtr Result: True Comment: Package mtr is already installed. Started: 08:23:42.171235 Duration: 686.816 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: nginx Result: True Comment: Package nginx is already installed. Started: 08:23:42.858330 Duration: 0.674 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: lrzsz Result: True Comment: Package lrzsz is already installed. Started: 08:23:42.859121 Duration: 0.274 ms Changes: ---------- ID: zabbix_agent Function: pkg.installed Name: zabbix22-agent Result: True Comment: Package zabbix22-agent is already installed. Started: 08:23:42.859455 Duration: 0.267 ms Changes: ---------- ID: zabbix_agent Function: file.managed Name: /etc/zabbix_agentd.conf Result: True Comment: File /etc/zabbix_agentd.conf updated Started: 08:23:42.862150 Duration: 9.588 ms Changes: ---------- diff: --- +++ @@ -84,7 +84,7 @@ # Server= #Server=127.0.0.1 -Server=10.0.0.222 +Server=10.0.0.111 ### Option: ListenPort # Agent will listen on this port for connections from the server. ---------- ID: zabbix_agent Function: service.running Name: zabbix-agentd Result: True Comment: Service reloaded Started: 08:23:42.898476 Duration: 170.457 ms Changes: ---------- zabbix-agentd: True Summary ------------ Succeeded: 6 (changed=2) Failed: 0 ------------ Total states run: 6 第三种方法！Zabbix_Server:直接填写IP即可！zabbix_agent: pkg.installed: - names: - zabbix22-agent file.managed: - name: /etc/zabbix_agentd.conf - source: salt://init/files/zabbix_agentd.conf - user: root - group: root - mode: 644 - template: jinja - defaults: Zabbix_Server: 10.0.0.33 service.running: - name: zabbix-agentd - enable: True - reload: True - watch: - file: zabbix_agent 目录结构如下：[root@master salt]# tree . ├── master ├── minion ├── minion.d │   └── _schedule.conf ├── pillar │   ├── init │   │   ├── rsyslog.sls │   │   └── zabbix_agent.sls │   └── top.sls ├── pki │   ├── master │   │   ├── master.pem │   │   ├── master.pub │   │   ├── minions │   │   │   ├── master.22.com │   │   │   ├── minion.21.com │   │   │   └── minion.23.com │   │   ├── minions_autosign │   │   ├── minions_denied │   │   ├── minions_pre │   │   └── minions_rejected │   └── minion │   ├── minion_master.pub │   ├── minion.pem │   └── minion.pub ├── services │   └── dev └── status ├── init │   ├── files │   │   └── zabbix_agentd.conf │   ├── pkg.sls │   └── zabbix_agent.sls └── top.sls

saltstack配置管理（1） 配置管理！安装zabbix-agent如：zabbix-agent: pkg.installed: - name: zabbix-agent 上面安装的zabbix-agent也可以这样来写zabbix-agent: pkg.installed 例：安装zabbix-agenthttp://docs.saltstack.cn/zh_CN/latest/ref/states/all/salt.states.file.html#module-salt.states.file安装包zabbix_agent: pkg.installed: - name: zabbix22-agent 配置文件file.managed: - name: /etc/zabbix_agent.conf--------------------------->minion端文件 - source: salt://init/files/zabbix_agentd.conf----------->master端文件位置 - user: root - group: root - mode: 644 启动服务 service.running: - name: zabbix_agentd - enable: True------------------------------------------>开机启动 - reload: True------------------------------------------>配置更新后reload， 注意：”不添加reload有可能自己进行restart 如下：[root@master init]# cat zabbix_agent.sls zabbix_agent: pkg.installed: - name: zabbix22-agent file.managed: - name: /etc/zabbix_agent.conf - source: salt://init/files/zabbix_agentd.conf - user: root - group: root - mode: 644 service.running: - name: zabbix_agentd - enable: True - reload: True [root@master init]# [root@master init]# mkdir -p /etc/salt/status/init/files [root@master files]# pwd /etc/salt/status/init/files 复制一个zabbix_agent配置文件[root@master files]# scp 10.0.0.23:/etc/zabbix_agent.conf ./ [root@master files]# pwd /etc/salt/status/init/files [root@master files]# [root@master files]# vim zabbix_agent.conf Server=192.168.233.130 将zabbix_agent.sls定义到top.sls中，top执行完不需要重启[root@master files]# vim /etc/salt/status/top.sls base: 'm*.*.com': - match: pcre - init.pkg - init.zabbix_agent 添加完毕后，测试'minion.23.com'上[root@master init]# salt 'minion.23.com' state.highstate test=True minion.23.com: ---------- ID: pkg.init Function: pkg.installed Name: mtr Result: True Comment: Package mtr is already installed. Started: 06:41:07.461557 Duration: 659.368 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: nginx Result: True Comment: Package nginx is already installed. Started: 06:41:08.121087 Duration: 0.394 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: lrzsz Result: True Comment: Package lrzsz is already installed. Started: 06:41:08.121537 Duration: 0.236 ms Changes: ---------- ID: zabbix_agent Function: pkg.installed Name: zabbix22-agent Result: True Comment: Package zabbix22-agent is already installed. Started: 06:41:08.121869 Duration: 0.249 ms Changes: ---------- ID: zabbix_agent Function: file.managed Name: /etc/zabbix_agentd.conf Result: None Comment: The file /etc/zabbix_agentd.conf is set to be changed Started: 06:41:08.124101 Duration: 7.601 ms Changes: ---------- diff: --- +++ @@ -78,7 +78,8 @@ # Default: # Server= -Server=127.0.0.1 +#Server=127.0.0.1 +Server=10.0.0.22 ### Option: ListenPort # Agent will listen on this port for connections from the server. ---------- ID: zabbix_agent Function: service.running Name: zabbix_agentd Result: False Comment: The named service zabbix_agentd is not available Started: 06:41:08.132359 Duration: 6.232 ms Changes: Summary ------------ Succeeded: 5 (unchanged=1, changed=1) Failed: 1 ------------ Total states run: 6 [root@master init]# 正式的执行：[root@master init]# salt '*' state.highstate minion.23.com: ---------- ID: pkg.init Function: pkg.installed Name: mtr Result: True Comment: Package mtr is already installed. Started: 07:04:32.096445 Duration: 674.256 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: nginx Result: True Comment: Package nginx is already installed. Started: 07:04:32.770899 Duration: 0.407 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: lrzsz Result: True Comment: Package lrzsz is already installed. Started: 07:04:32.771405 Duration: 0.236 ms Changes: ---------- ID: zabbix_agent Function: pkg.installed Name: zabbix22-agent Result: True Comment: Package zabbix22-agent is already installed. Started: 07:04:32.771696 Duration: 0.303 ms Changes: ---------- ID: zabbix_agent Function: file.managed Name: /etc/zabbix_agentd.conf Result: True Comment: File /etc/zabbix_agentd.conf updated Started: 07:04:32.774071 Duration: 6.959 ms Changes: ---------- diff: New file mode: 0644 ---------- ID: zabbix_agent Function: service.running Name: zabbix-agentd Result: True Comment: Service zabbix-agentd has been enabled, and is running Started: 07:04:32.781431 Duration: 114.562 ms Changes: ---------- zabbix-agentd: True Summary ------------ Succeeded: 6 (changed=2) Failed: 0 [root@master init]# 使用service查看[root@master init]# salt '*' service.status zabbix-agent minion.21.com: True minion.23.com: True master.22.com: True [root@master init]# 3台机器已经全部安装并且允许当文件有变动则进行reload需要添加watch- watch: - file: zabbix_agent 如下：[root@master init]# cat zabbix_agent.sls zabbix_agent: pkg.installed: - names: - zabbix22-agent file.managed: - name: /etc/zabbix_agentd.conf - source: salt://init/files/zabbix_agentd.conf - user: root - group: root - mode: 644 service.running: - name: zabbix-agentd - enable: True - reload: True - watch: - file: zabbix_agent 而后修改/init/files/zabbix_agentd.conf中任意的文件，以示区分注意：这里的reload是手动修改reload成restart才可以reload的！[root@master init]# salt '*' state.highstate minion.23.com: ---------- ID: pkg.init Function: pkg.installed Name: mtr Result: True Comment: Package mtr is already installed. Started: 07:23:39.333600 Duration: 829.029 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: nginx Result: True Comment: Package nginx is already installed. Started: 07:23:40.162791 Duration: 0.433 ms Changes: ---------- ID: pkg.init Function: pkg.installed Name: lrzsz Result: True Comment: Package lrzsz is already installed. Started: 07:23:40.163276 Duration: 0.252 ms Changes: ---------- ID: zabbix_agent Function: pkg.installed Name: zabbix22-agent Result: True Comment: Package zabbix22-agent is already installed. Started: 07:23:40.163586 Duration: 0.217 ms Changes: ---------- ID: zabbix_agent Function: file.managed Name: /etc/zabbix_agentd.conf Result: True Comment: File /etc/zabbix_agentd.conf updated Started: 07:23:40.165805 Duration: 12.912 ms Changes: ---------- diff: --- +++ @@ -77,12 +77,12 @@ # Mandatory: no # Default: # Server= - -#Server=127.0.0.1 -#Server=127.0.0.1 -#Server=127.0.0.1 -#Server=127.0.0.1 -#Server=127.0.0.1 +# Server= +# Server= +# Server= +# Server= +# Server= + #Server=127.0.0.1 Server=10.0.0.22 ---------- ID: zabbix_agent Function: service.running Name: zabbix-agentd Result: True Comment: Service reloaded Started: 07:23:40.206135 Duration: 191.221 ms Changes: ---------- zabbix-agentd: True Summary ------------ Succeeded: 6 (changed=2) Failed: 0 ------------ Total states run: 6

saltstack自定义Grains 自定义Grains:定义到配置文件！[root@minion1 ~]# vim /etc/salt/minion grains: roles: nginx env: prod [root@minion1 ~]# /etc/init.d/salt-minion restart Stopping salt-minion daemon: [FAILED] Starting salt-minion daemon: master[root@master ~]# salt -G 'env:prod' test.ping minion.23.com: True [root@master ~]# salt -G 'roles:nginx' test.ping minion.23.com: True [root@master ~]# 定义到/etc/salt/grains,在/etc/salt/grains键入cloud: saltstackminion [root@minion1 ~]# cat /etc/salt/grains cloud: saltstack [root@minion1 ~]# /etc/init.d/salt-minion restart Stopping salt-minion daemon: [ OK ] Starting salt-minion daemon: [ OK ] [root@minion1 ~]# master端在可以找到有值的服务器执行相关的操作[root@master ~]# salt -G 'cloud:saltstack' test.ping minion.23.com: True [root@master ~]# 如：远程启动所有安装了nginx的机器，这里的环境只在minion.23.com安装[root@minion1 ~]# vim /etc/salt/grains cloud: saltstack cloud: nginx [root@minion1 ~]# /etc/init.d/salt-minion restart Stopping salt-minion daemon: [ OK ] Starting salt-minion daemon: [ OK ] master端[root@master ~]# salt -G 'roles:nginx' service.start nginx minion.23.com: True [root@master ~]# minion端：[root@minion1 ~]# service nginx status nginx (pid 2459) is running... [root@minion1 ~]# 同步：saltutil.sync_grains例如：在minion上添加一条cloud: httpd（事实上这里没有安装）。不重启服务，使用saltutil.sync_grains刷新即可，如下：[root@minion1 ~]# vim /etc/salt/grains cloud: nginx cloud: httpd master端第一次执行[root@master ~]# salt -G 'cloud:httpd' test.ping No minions matched the target. No command was sent, no jid was assigned. ERROR: No return received 同步后执行正常[root@master ~]# salt '*' saltutil.sync_grains master.22.com: minion.23.com: minion.21.com: [root@master ~]# salt -G 'cloud:httpd' test.ping minion.23.com: True [root@master ~]# -G：目标里面使用grains在top中的使用！在master的top.sls中添加： 'roles:nginx': - match: grain - init.pkg 在所有的定义过grains ，并且grains中有nginx的机器上，执行init.pkg的动作！添加如下：[root@master ~]# vim /etc/salt/status/top.sls base: 'm*.*.com': - match: pcre - init.pkg 'roles:nginx': - match: grain - init.pkg

Saltstack数据系统初探 Saltstack数据系统Grains:静态数据当minion启动，收集服务器所有信息保存，在后面进行调用，如果需要设备变动则需要重启进行收集信息Pillargrains.items可查看服务器的详细信息，也可以分别刷选[root@master ~]# salt 'minion.23.com' grains.items minion.23.com: ---------- SSDs: biosreleasedate: 05/20/2014 biosversion: 6.00 cpu_flags: - fpu - vme - de - pse - tsc - msr - pae - mce cpu_model: Intel(R) Xeon(R) CPU E3-1230 v3 @ 3.30GHz cpuarch: x86_64 domain: fqdn: minion1 fqdn_ip4: - 180.168.41.175 fqdn_ip6: gpus: |_ ---------- model: SVGA II Adapter vendor: unknown host: minion1 hwaddr_interfaces: ---------- eth1: 00:0c:29:77:21:16 lo: 00:00:00:00:00:00 id: minion.23.com init: upstart ip4_interfaces: ---------- eth1: - 10.0.0.23 lo: - 127.0.0.1 ip6_interfaces: ---------- eth1: - fe80::20c:29ff:fe77:2116 lo: - ::1 ip_interfaces: ---------- eth1: - 10.0.0.23 - fe80::20c:29ff:fe77:2116 lo: - 127.0.0.1 - ::1 ipv4: - 10.0.0.23 - 127.0.0.1 ipv6: - ::1 - fe80::20c:29ff:fe77:2116 kernel: Linux kernelrelease: 2.6.32-504.el6.x86_64 locale_info: ---------- defaultencoding: UTF8 defaultlanguage: en_US detectedencoding: UTF-8 localhost: minion1 lsb_distrib_codename: Final lsb_distrib_id: CentOS lsb_distrib_release: 6.6 machine_id: 2ed4a92704e1ebf06cf1c9f80000000b manufacturer: VMware, Inc. master: 10.0.0.22 mdadm: mem_total: 980 nodename: minion1 num_cpus: 1 num_gpus: 1 os: CentOS os_family: RedHat osarch: x86_64 oscodename: Final osfinger: CentOS-6 osfullname: CentOS osmajorrelease: 6 osrelease: 6.6 osrelease_info: - 6 - 6 path: /sbin:/usr/sbin:/bin:/usr/bin productname: VMware Virtual Platform ps: ps -efH pythonexecutable: /usr/bin/python2.6 pythonpath: - /usr/bin - /usr/lib64/python26.zip - /usr/lib64/python2.6 - /usr/lib64/python2.6/plat-linux2 - /usr/lib64/python2.6/lib-tk - /usr/lib64/python2.6/lib-old - /usr/lib64/python2.6/lib-dynload - /usr/lib64/python2.6/site-packages - /usr/lib64/python2.6/site-packages/gst-0.10 - /usr/lib64/python2.6/site-packages/gtk-2.0 - /usr/lib64/python2.6/site-packages/webkit-1.0 - /usr/lib/python2.6/site-packages pythonversion: - 2 - 6 - 6 - final - 0 saltpath: /usr/lib/python2.6/site-packages/salt saltversion: 2015.5.5 saltversioninfo: - 2015 - 5 - 5 - 0 selinux: ---------- enabled: False enforced: Disabled serialnumber: VMware-56 4d 67 7b b3 c5 57 53-89 4d 88 a7 38 77 21 16 server_id: 1982461425 shell: /bin/sh virtual: VMware zmqversion: 3.2.5 [root@master ~]# 分别刷选[root@master ~]# salt 'minion.23.com' grains.item os minion.23.com: ---------- os: CentOS [root@master ~]# 键值显示[root@master ~]# salt 'minion.23.com' grains.ls minion.23.com: - SSDs - biosreleasedate - biosversion - cpu_flags - cpu_model - cpuarch - domain - fqdn [root@master ~]# get取值[root@master ~]# salt 'minion.23.com' grains.get os minion.23.com: CentOS [root@master ~]# salt 'minion.23.com' grains.item os minion.23.com: ---------- os: CentOS [root@master ~]# -G过滤os为centos的机器[root@master ~]# salt -G 'os:CentOS' test.ping master.22.com: True minion.21.com: True minion.23.com: True [root@master ~]# minion1是minion.23.com的主机名，一般情况下主机名和id一致[root@master ~]# salt 'minion.23.com' grains.get fqdn minion.23.com: minion1 [root@master ~]# salt -G 'fqdn:minion1' test.ping minion.23.com: True [root@master ~]#