导读 | 通常服务器安装完操作系统之后,都会进行一些基础的设置,生产环境使用SaltStack时,建议将所有的服务器都会进行的基础配置或者软件部署归类放在Base环境下面,本教程中在Base环境下创建一个Init的目录,将系统初始化配置的SLS均放置到Init目录下,可以叫作“初始化模块”。 |
编写测试文件one.sls
[root@saltstack-master ~]# vi /srv/salt/base/init/one.sls first-sls: file.managed: - name: /tmp/foo.conf - source: salt://init/config/foo.conf - user: root - group: root - mode: 644 #test [root@saltstack-master init]# salt '*' state.sls init.one test=True
根据使用习惯设置统一的vim配置文件,使用SaltStack的File状态模块的Managed方法管理vimrc文件。
查看指定states的function及指定state用法:
[root@saltstack-master ~]# salt '*' sys.list_state_functions file salt '*' sys.state_doc file.managed [root@saltstack-master ~]# mkdir -p /srv/salt/base/init [root@saltstack-master ~]# mkdir -p /srv/salt/base/config [root@saltstack-master ~]# cp /etc/vimrc /srv/salt/base/config/ [root@saltstack-master ~]# vim /srv/salt/base/init/vim.sls /etc/vimrc: file.managed: - source: salt://init/config/vimrc - user: root - group: root - mode: 644 - backup: '*'
SLS文件编写完成之后,需要把/etc/vimrc文件放到/srv/salt/base/init/config目录下面。
注:SaltStack环境下面的目录不存在的都需要新建。
[root@saltstack-master ~]# salt '*' state.sls init.vim test=True #test参数测试是否能够同步成功, [root@saltstack-master ~]# salt '*' sys.doc state | less #查看stata模块用法 saltstack-master.example.com: ---------- ID: sync_vimrc Function: file.managed Name: /etc/vimrc Result: True Comment: The file /etc/vimrc is in the correct state Started: 10:53:08.302890 Duration: 7.408 ms Changes: Summary ------------ Succeeded: 1 Failed: 0 ------------ Total states run: 1 saltstack-minion.example.com: ---------- ID: sync_vimrc Function: file.managed Name: /etc/vimrc Result: None Comment: The file /etc/vimrc is set to be changed Started: 10:53:08.967117 Duration: 6.296 ms Changes: ---------- newfile: /etc/vimrc Summary ------------ Succeeded: 1 (unchanged=1, changed=1) Failed: 0 ------------ Total states run:
生产环境中,DNS解析是比较重要的设置,建议在内网建立自己的内网DNS服务器,同样使用SlatStack的File状态模块中的Managed方法管理resolv.conf文件:
[root@saltstack-master ~]# cp /etc/resolv.conf /srv/salt/base/init/config/ [root@saltstack-master ~]# vim /srv/salt/base/init/dns.sls /etc/resolv.conf: file.managed: - source: salt://init/config/resolv.conf - user: root - group: root - mode: 644 - backup: '*'
dns.sls文件编写完成之后,需要把设置好的resolv.conf放到/srv/salt/base/init/config目录下面。
使用history记录时间,可以清楚的知道什么用户什么时间执行了什么,对分析系统错误,及安全性有很大帮助,使用SlatStack的File状态模块的Append方法,在/etc/profile里面追加设置:(相当于echo “” >> file)
[root@saltstack-master ~]# salt '*’ sys.state_doc file.append | grep -C 5 append [root@saltstack-master ~]# vim /srv/salt/base/init/history.sls /etc/profile: file.append: - text: - export HISTTIMEFORMAT="%F %T `whoami` " #注:编写SLS文件时,使用英文输入法,不然会导致相关报错(Illegal tab character)
使用logger将输入的命令写入到memssages的一个简单功能,使用SaltStack的File模块的Append方法。建议将memssages日志文件进行统一收集管理,建议使用ELK Stack(Elasticsearch、LogStach、Kibana)。
append_log: file.append: - name: /etc/bashrc - text: - export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; });logger "[euid=$(whoami)]":$(who am i):[`pwd`]"$msg"; }' cmd.run: - name: source /etc/bashrc
初始化时,需要对默认的内核参数进项调优,SaltStack提供了Sysctl状态模块用来检测内核参数的配置,默认调整的内核参数较多,参考:
//blog.sina.com.cn/s/blog_87113ac20102w4za.html [root@saltstack-master ~]# cp /etc/sysctl.conf /srv/salt/base/init/config/ [root@saltstack-master ~]# vim /srv/salt/base/init/sysctl.sls /etc/sysctl.conf: file.managed: - source: salt://init/config/sysctl.conf - user: root - group: root - mode: 644
#需要先在本地设置好优化过的内核参数文件,放到/srv/salt/base/init/config目录下面。
参数优化详情可参考上面所示博客,或自行度娘。
[root@saltstack-master ~]# salt '*' state.sls init.sysctl test=True
建议设置epel仓库,放到系统初始化配置当中,由于本教程在安装salt-minion时已经安装过epel源,所以此处只贴出例子,是否需要使用建议在env_init.sls文件中设置即可。
[root@saltstack-master ~]# vim /srv/salt/base/init/epel.sls yum_repo_release: pkg.installed: - sources: - epel-release: //mirrors.aliyun.com/epel/6/x86_64/epel-release-6-8.noarch.rpm - unless: rpm -qa | grep epel-release-6-8
建议在生产服务器对ssh配件文件进行统一管理,修改默认的连接端口
[root@saltstack-master ~]# sed -i 's/\#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config [root@saltstack-master ~]# sed -i 's/\#PermitEmptyPasswords no/PermitEmptyPasswords no/' /etc/ssh/sshd_config # [root@saltstack-master ~]# cp /etc/ssh/sshd_config /srv/salt/base/init/config/ [root@saltstack-master ~]# vim /srv/salt/base/init/ssh.sls sync-ssh: file.managed: - name: /etc/ssh/sshd_config - source: salt://init/config/sshd_config - user: root - group: root - mode: 644 cmd.run: - name: /etc/init.d/sshd restart - require: - file: sync-ssh service.running: - name: sshd - enable: True - reload: True - require: - file: sync-ssh
设置定时任务同步系统时间
[root@saltstack-master ~]# vim /srv/salt/base/init/cron.sls ntpdate-init: pkg.installed: - name: ntpdate set-crontab: cron.present: - name: /usr/bin/ntpdate times.aliyun.com >> /dev/null 2>&1 - user: root - minute: '*5' [root@saltstack-master ~]# salt '*' state.sls init.cron test=True
[root@saltstack-master ~]# vim /srv/salt/base/init/yum.sls yum-list-init: pkg.installed: - names: - gcc - gcc-c++ - man - vim-enhanced - wget - telnet - lsof - sysstat - openssh-clients - lrzsz - tree - hdparm
本教程编写的初始化功能SLS文件,统一放到init目录下,方便理解和管理,可以通过在编写一个特别的SLS文件,把init目录下面的初始化功能SLS文件包含进去,然后在top.sls直接引用这个sls文件即可:
[root@saltstack-master ~]# vim /srv/salt/base/init/env_init.sls include: - init.one - init.vim - init.dns - init.history - init.log - init.sysctl - init.epel - init.ssh - init.cron - init.yum
其中one.sls文件是最开始为了测试时创建的sls文件,此处建议在开始编写sls进行同步时,先编写one.sls,然后进行单个sls文件同步测试,下面是从saltstack-master同步到*的演示。每新增一个功能模块的sls文件,都需要测试同步,同时saltstack-master,salt-minion中日志的级别建议设置成debug,方便排错。
[root@saltstack-master ~]# salt '*' state.sls init.one *: ---------- ID: /tmp/foo.conf Function: file.managed Result: True Comment: File /tmp/foo.conf is in the correct state Started: 19:05:42.311064 Duration: 13.934 ms Changes: Summary ------------ Succeeded: 1 Failed: 0 ------------ Total states run: 1
查看到此我们已经编写的sls文件,通过tree命令,最小化安装的CentOS 6.7默认没安装tree,需自行yum安装即可:
[root@saltstack-master ~]# tree /srv/salt/base/ /srv/salt/base/ ├── init │ ├── config │ │ ├── foo.conf │ │ ├── resolv.conf │ │ ├── sshd_config │ │ ├── sysctl.conf │ │ └── vimrc │ ├── cron.sls │ ├── del_cron.sls │ ├── dns.sls │ ├── env_init.sls │ ├── epel.sls │ ├── history.sls │ ├── log.sls │ ├── one.sls │ ├── ssh.sls │ ├── sysctl.sls │ ├── vim.sls │ └── yum.sls └── top.sls 2 directories, 18 files
编写top.sls文件,给Minion指定状态并执行:
[root@saltstack-master ~]# vim /srv/salt/base/top.sls base: '*': - init.env_init
注意:生产环境中,每次执行状态,强烈建议先进性测试,确定SaltStack会执行那些操作然后在应用状态到服务器上:
测试:
[root@saltstack-master ~]# salt '*' state.highstate test=True 注:建议这里不要用salt ‘*’ state.highstate test=True,需要指定到那台服务器,用正则匹配到指定服务器,避免导致不必要的错误。 ……. Summary ------------- Succeeded: 24 (unchanged=15, changed=4) Failed: 0 ------------- Total states run: 24
如果出现上图所示,表示编写的sls文件可以正常执行,然后同步到指定的服务器上面。
[root@saltstack-master ~]# salt '*' state.highstate
下面是把初始化设置应用*显示结果:(已成功)
[root@saltstack-master ~]# salt '*' state.highstate *: ---------- ID: /tmp/foo.conf Function: file.managed Result: True Comment: File /tmp/foo.conf is in the correct state Started: 19:29:09.696053 Duration: 6.285 ms Changes: ---------- ID: /etc/resolv.conf Function: file.managed Result: True Comment: File /etc/resolv.conf is in the correct state Started: 19:29:09.702465 Duration: 2.294 ms Changes: ---------- ID: /etc/salt/minion Function: file.managed Result: True Comment: File /etc/salt/minion is in the correct state Started: 19:29:09.704881 Duration: 2.543 ms Changes: ---------- ID: /etc/profile Function: file.append Result: True Comment: File /etc/profile is in correct state Started: 19:29:09.707537 Duration: 1.06 ms Changes: ---------- ID: /etc/sysctl.conf Function: file.managed Result: True Comment: File /etc/sysctl.conf is in the correct state Started: 19:29:09.708709 Duration: 2.32 ms Changes: Summary ------------ Succeeded: 5 Failed: 0 ------------ Total states run: 5
本文原创地址: //gulass.cn/saltstack-initial-system.html作者:王辉,审核员:岳永
本文原创地址://gulass.cn/saltstack-initial-system.html编辑:public,审核员:暂无