saltstack学习2grains＆pillar

saltstack之grains介绍

GRAINS组件是 是在minion启动收集到的一些信息，比如操作系统的类型，网卡IP,内存版本，CPU信息等。

grains信息是minion启动后自动上报给master的，当这些静态信息发生改变需重启minion或者重新同步grains。

[[email protected] base]#  salt  'node1'  grains.ls  #列出所有的grains 项目名称,
node1:
    - biosreleasedate
    - biosversion
    - cpu_flags
    - cpu_model
    - cpuarch
    - cwd
    - disks
    - dns
    - domain
...
[[email protected] base]# salt  'node1' grains.items    #查询所有的详细信息
[[email protected] base]# salt  'node1'  grains.get fqdn   #查询某个信息
node1:
    node1

grains命令行匹配

[[email protected] base]# salt  'node1'  grains.get os
node1:
    CentOS
[[email protected] base]# salt  -G os:CentOS cmd.run 'df -h'   #grains匹配

grains在top file里匹配

[[email protected] base]# vim top.sls     #在top file里匹配
base:
  'os:CentOS':
    - match: grain
    - web.apache
[[email protected] base]# salt  'node1'  state.highstate  test=True
node1:
----------
...黄色，未安装

grains在top file里正则匹配

[[email protected] base]# cat top.sls
base:
  'fqdn:node*':      #top file 里也支持正则
    - match: grain
    - web.apache
[[email protected] base]# salt  'node1'  state.highstate  test=True
node1:    #node*匹配出node1

grains的自定义（minion上定义）

[[email protected] ~]# cd /etc/salt/
[[email protected] ~]# vim grains   #默认读取的文件
role: tests
env: test
name: first-test
[[email protected] base]# salt  'node1'  grains.get role
node1:   #此时还获取不到role信息
[[email protected] base]# salt  'node1'  saltutil.sync_grains  #刷新grains，或者restart minion
node1:
[[email protected] base]# salt  'node1'  grains.get role
node1:
    tests
[[email protected] salt]#  salt  '*'  grains.items | grep role
role: tests
[[email protected] base]# salt  -G role:tests cmd.run 'df -h'  #grains匹配role: tests的机器都将执行

saltstack 之pillar介绍

pillar 一般用来存储动态的、敏感的数据；grains信息minion端和master端都可以配置设置或获取。
pillar 是在master上定义的，并且是针对minion定义的一些信息，可以自定义变量等

[[email protected] ~]# salt '*' pillar.items
node1:
    ----------
master:
    ----------
[[email protected] ~]# vim /etc/salt/master    
pillar_opts: True   #打开默认的pillar项，这里就不打开了

pillar的管理使用

1）定义pillar配置文件位置

[[email protected] ~]# vim /etc/salt/master   #/pillar_roots
pillar_roots:  
  base:
    - /srv/pillar/base
  prod:
    - /srv/pillar/prod
[[email protected] ~]# mkdir -p /srv/pillar/{base,prod}
[[email protected] ~]# systemctl restart salt-master

2）pillar入口文件定义拥有piller的节点

[[email protected] ~]# cat /srv/pillar/base/top.sls      
base:
  '*':   #支持正则，node*
    - apache
[[email protected] ~]# salt '*' pillar.items     #查看定义好piller的节点结果
master:
    ----------
    apache:
        httpd
node1:
    ----------
    apache:
        httpd
[[email protected] ~]# cat /var/log/salt/master     #错误日志
[[email protected] ~]# salt '*' saltutil.refresh_piller   #刷新piller

3）定义pillar的任务文件

[[email protected] ~]# vim /srv/pillar/base/apache.sls
{% if grains['os'] == 'CentOS' %}
apache: httpd
{% elif grains['os'] == 'Debina' %}
apache: apache2
{% endif %}

4）pillar的引用（任务文件）

[[email protected] ~]# cat /srv/salt/base/top.sls
base:
  'fqdn:node*':
    - match: grain
    - web.apache
[[email protected] ~]# cat  /srv/salt/base/web/apache.sls
apache-install:
  pkg.installed:
    - name: {
   { pillar['apache'] }}
apache-service:
  service.running:
    - name: {
   { pillar['apache'] }}
    - enable: True

5）测试

[[email protected] ~]# salt  '*'  state.highstate  test=True
master:
----------
          ID: states
    Function: no.None
      Result: False    #/srv/salt/base/top.sls里是node*，不匹配
     Comment: No Top file or master_tops data matches found. Please see master log for details.
     Changes:

Summary for master
------------
Succeeded: 0
Failed:    1
------------
Total states run:     1
Total run time:   0.000 ms
node1:
----------
          ID: apache-install
    Function: pkg.installed
        Name: httpd
      Result: None   #已经匹配了，测试执行
     Comment: The following packages would be installed/updated: httpd
     Started: 20:32:27.695663
    Duration: 1048.275 ms

小模板

[[email protected] ~]# cd /srv/salt/prod/apache/
[[email protected] apache]# cat apache.sls
apche-install:
  pkg.installed:
    - name: httpd
apache-config:
  file.managed:
    - name: letc/httpd/conf/httpd.conf
    - source: salt://apache/files/httpd.conf   #目录为apache.sls所在目录下
    - user: root
    - group: root
    - mode: 644
apache-service:
  service.running:
    - name: httpd
    - enable: True
    - require：
      - pkg: apache
      - file: apache-config
[[email protected] apache]# salt node1 state.sls  apache.apache saltenv=prod test=True

根据被控主机的信息进行匹配过滤

[[email protected] ~]# #salt   -G 'os:centos' test.ping
Target options:
-G, --grain 				grains匹配
-I,--pillar 				pilar值匹配
-E, --pcre					正则匹配
-L,--list					列表匹配
--grain-pcre grains			加正则匹配
-N,--nodegroup 				组匹配
-R,--range 					范围匹配
-C, --compound				综合匹配(指定多个匹配)
-s, --ipcidr minions		网段地址匹配

grains的相关命令用法

[[email protected] ~]# salt '*' sys.list_functions grains
node1:
    - grains.append
    - grains.delkey
    - grains.delval
    - grains.equals
    - grains.fetch
    - grains.filter_by
    - grains.get
    - grains.get_or_set_hash
    - grains.has_value
    - grains.item
    - grains.items
    - grains.ls
    - grains.remove
    - grains.set
    - grains.setval
    - grains.setvals
[[email protected] ~]# salt '*' sys.doc grains   #查所有
[[email protected] ~]# salt '*' sys.doc grains.append  #查单个
grains.append:
...
    CLI Example:
    
        salt '*' grains.append key val

[[email protected] ~]#  salt '*' grains.append   key values  #添加
node1:
    ----------
    key:
        - values
[[email protected] ~]#  salt -G 'key:values'  test.ping
node1:
    True

[[email protected] ~]#  salt '*' grains.remove   key values  #移除
node1:
    ----------
    key:
[[email protected] ~]#  salt '*' grains.item
node1:
    ----------

pillar的相关命令用法

[[email protected] ~]# salt '*' sys.list_functions pillar
node1:
    - pillar.data
    - pillar.ext
    - pillar.fetch
    - pillar.file_exists
    - pillar.filter_by
    - pillar.get
    - pillar.item
    - pillar.items
    - pillar.keys
    - pillar.ls
    - pillar.obfuscate
    - pillar.raw
[[email protected] ~]# salt '*' sys.doc pillar.ls
pillar.ls:
...
        salt '*' pillar.ls

[[email protected] ~]# salt '*' pillar.ls
node1:
    - apache