SaltStack数据系统

SaltStack数据系统

SaltStack有两大数据系统，分别是：

• Grains
• Pillar

SaltStack数据系统组件

SaltStack组件之Grains

Grains是SaltStack的一个组件，其存放着minion启动时收集到的信息。

Grains是SaltStack组件中非常重要的组件之一，因为我们在做配置部署的过程中会经常使用它，Grains是SaltStack记录minion的一些静态信息的组件。可简单理解为Grains记录着每台minion的一些常用属性，比如CPU、内存、磁盘、网络信息等。我们可以通过grains.items查看某台minion的所有Grains信息。

Grains的功能：

• 收集资产信息

Grains应用场景：

• 信息查询
• 在命令行下进行目标匹配
• 在top file中进行目标匹配
• 在模板中进行目标匹配
  模板中进行目标匹配请看：https://docs.saltstack.com/en/latest/topics/pillar/

信息查询实例：

[root@master ~]# salt 'minion' grains.items
minion:
    ----------
    biosreleasedate:
        11/12/2020
    biosversion:
        6.00
    cpu_flags:
        - fpu
        - vme
        - de
        - pse
        - tsc
        - msr
        - pae
        - mce
        - cx8
        - apic
        - sep
        - mtrr
        - pge
        - mca
        - cmov
        - pat
        - pse36
        - clflush
        - mmx
        - fxsr
        - sse
        - sse2
        - ss
        - ht
        - syscall
        - nx
        - pdpe1gb
        - rdtscp
        - lm
        - constant_tsc
        - arch_perfmon
        - nopl
        - xtopology
        - tsc_reliable
        - nonstop_tsc
        - cpuid
        - pni
        - pclmulqdq
        - ssse3
        - fma
        - cx16
        - pcid
        - sse4_1
        - sse4_2
        - x2apic
        - movbe
        - popcnt
        - tsc_deadline_timer
        - aes
        - xsave
        - avx
        - f16c
        - rdrand
        - hypervisor
        - lahf_lm
        - abm
        - 3dnowprefetch
        - cpuid_fault
        - invpcid_single
        - pti
        - ssbd
        - ibrs
        - ibpb
        - stibp
        - fsgsbase
        - tsc_adjust
        - bmi1
        - avx2
        - smep
        - bmi2
        - invpcid
        - rdseed
        - adx
        - smap
        - clflushopt
        - xsaveopt
        - xsavec
        - xgetbv1
        - xsaves
        - arat
        - md_clear
        - flush_l1d
        - arch_capabilities
    cpu_model:
        Intel(R) Core(TM) i5-9300H CPU @ 2.40GHz
    cpuarch:
        x86_64
    cwd:
        /
    disks:
        - sr0
    dns:
        ----------
        domain:
        ip4_nameservers:
            - 114.114.114.114
        ip6_nameservers:
        nameservers:
            - 114.114.114.114
        options:
        search:
        sortlist:
    domain:
    efi:
        False
    efi-secure-boot:
        False
    fqdn:
        minion
    fqdn_ip4:
        - 192.168.47.120
    fqdn_ip6:
        - fe80::20c:29ff:feda:550e
    fqdns:
        - minion
    gid:
        0
    gpus:
        |_
          ----------
          model:
              SVGA II Adapter
          vendor:
              vmware
    groupname:
        root
    host:
        minion
    hwaddr_interfaces:
        ----------
        ens160:
            00:0c:29:da:55:0e
        lo:
            00:00:00:00:00:00
    id:
        minion
    init:
        systemd
    ip4_gw:
        192.168.47.2
    ip4_interfaces:
        ----------
        ens160:
            - 192.168.47.120
        lo:
            - 127.0.0.1
    ip6_gw:
        False
    ip6_interfaces:
        ----------
        ens160:
            - fe80::20c:29ff:feda:550e
        lo:
            - ::1
    ip_gw:
        True
    ip_interfaces:
        ----------
        ens160:
            - 192.168.47.120
            - fe80::20c:29ff:feda:550e
        lo:
            - 127.0.0.1
            - ::1
    ipv4:
        - 127.0.0.1
        - 192.168.47.120
    ipv6:
        - ::1
        - fe80::20c:29ff:feda:550e
    kernel:
        Linux
    kernelparams:
        |_
          - BOOT_IMAGE
          - (hd0,msdos1)/vmlinuz-4.18.0-193.el8.x86_64
        |_
          - root
          - /dev/mapper/rhel-root
        |_
          - ro
          - None
        |_
          - crashkernel
          - auto
        |_
          - resume
          - /dev/mapper/rhel-swap
        |_
          - rd.lvm.lv
          - rhel/root
        |_
          - rd.lvm.lv
          - rhel/swap
        |_
          - rhgb
          - None
        |_
          - quiet
          - None
    kernelrelease:
        4.18.0-193.el8.x86_64
    kernelversion:
        #1 SMP Fri Mar 27 14:35:58 UTC 2020
    locale_info:
        ----------
        defaultencoding:
            UTF-8
        defaultlanguage:
            zh_CN
        detectedencoding:
            UTF-8
        timezone:
            CST
    localhost:
        minion
    lsb_distrib_codename:
        Red Hat Enterprise Linux 8.2 (Ootpa)
    lsb_distrib_id:
        Red Hat Enterprise Linux
    lsb_distrib_release:
        8.2
    lvm:
        ----------
        rhel:
            - root
            - swap
    machine_id:
        b1c77fc62d3a44bfa60bfc8a24ad7c9f
    manufacturer:
        VMware, Inc.
    master:
        192.168.47.115
    mdadm:
    mem_total:
        1800
    nodename:
        minion
    num_cpus:
        2
    num_gpus:
        1
    os:
        RedHat
    os_family:
        RedHat
    osarch:
        x86_64
    oscodename:
        Ootpa
    osfinger:
        Red Hat Enterprise Linux-8
    osfullname:
        Red Hat Enterprise Linux
    osmajorrelease:
        8
    osrelease:
        8.2
    osrelease_info:
        - 8
        - 2
    path:
        /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
    pid:
        1614
    productname:
        VMware Virtual Platform
    ps:
        ps -efHww
    pythonexecutable:
        /usr/bin/python3.6
    pythonpath:
        - /usr/bin
        - /usr/lib64/python36.zip
        - /usr/lib64/python3.6
        - /usr/lib64/python3.6/lib-dynload
        - /usr/lib64/python3.6/site-packages
        - /usr/lib/python3.6/site-packages
    pythonversion:
        - 3
        - 6
        - 8
        - final
        - 0
    saltpath:
        /usr/lib/python3.6/site-packages/salt
    saltversion:
        3004
    saltversioninfo:
        - 3004
    selinux:
        ----------
        enabled:
            False
        enforced:
            Disabled
    serialnumber:
        VMware-56 4d 11 d6 c6 cb 3c b6-2f 90 80 85 58 da 55 0e
    server_id:
        279719642
    shell:
        /bin/sh
    ssds:
        - nvme0n1
    swap_total:
        2047
    systemd:
        ----------
        features:
            +PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy
        version:
            239
    systempath:
        - /usr/local/sbin
        - /usr/local/bin
        - /usr/sbin
        - /usr/bin
    transactional:
        False
    uid:
        0
    username:
        root
    uuid:
        d6114d56-cbc6-b63c-2f90-808558da550e
    virtual:
        VMware
    zfs_feature_flags:
        False
    zfs_support:
        False
    zmqversion:
        4.3.4

查询某个key的值，比如想获取ip地址

[root@master ~]# salt '*' grains.get fqdn_ip4
minion:
    - 192.168.47.120
master:
    - 192.168.47.115

目标匹配实例：
用Grains来匹配minion：

[root@master ~]# salt -G 'os:Redhat' cmd.run 'uptime'
minion:
     03:46:48 up  1:39,  2 users,  load average: 0.21, 0.08, 0.02
master:
     03:46:48 up  1:39,  2 users,  load average: 0.22, 0.07, 0.05

在top file里面使用Grains：

[root@master ~]# vim /srv/salt/base/top.sls
[root@master ~]# cat /srv/salt/base/top.sls
base:           
  'os:Redhat':
    - match: grain
    - web.apache.install     

//在minion上停止httpd
[root@minion ~]# systemctl stop httpd.service 
[root@minion ~]# systemctl status httpd

//在master执行命令
[root@master ~]# salt 'minion' state.highstate
minion:
----------
          ID: httpd-install
    Function: pkg.installed
        Name: httpd
      Result: True
     Comment: All specified packages are already installed
     Started: 03:51:48.975355
    Duration: 629.814 ms
     Changes:   
----------
          ID: httpd-service
    Function: service.running
        Name: httpd
      Result: True
     Comment: Service httpd is already enabled, and is running
     Started: 03:51:49.607267
    Duration: 10206.444 ms
     Changes:   
              ----------
              httpd:
                  True

Summary for minion
------------
Succeeded: 2 (changed=1)
Failed:    0
------------
Total states run:     2
Total run time:  10.836 s

//查看
[root@minion ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2021-11-03 03:51:59 CST; 42s ago
     Docs: man:httpd.service(8)
 Main PID: 129944 (httpd)
   Status: "Running, listening on: port 80"
    Tasks: 213 (limit: 11300)
   Memory: 29.2M
   CGroup: /system.slice/httpd.service
           ├─129944 /usr/sbin/httpd -DFOREGROUND
           ├─130560 /usr/sbin/httpd -DFOREGROUND
           ├─130561 /usr/sbin/httpd -DFOREGROUND
           ├─130562 /usr/sbin/httpd -DFOREGROUND
           └─130563 /usr/sbin/httpd -DFOREGROUND

11月 03 03:51:49 minion systemd[1]: Starting The Apache HTTP Server...
11月 03 03:51:59 minion httpd[129944]: AH00558: httpd: Could not reliably determine the server's>
11月 03 03:51:59 minion systemd[1]: Started The Apache HTTP Server.
11月 03 03:52:09 minion httpd[129944]: Server configured, listening on: port 80

自定义Grains的两种方法：

• minion配置文件，在配置文件中搜索grains
• 在/etc/salt下生成一个grains文件，在此文件中定义(推荐方式)

[root@master ~]# vim /etc/salt/grains
[root@master ~]# cat /etc/salt/grains
app: test
[root@master ~]# systemctl restart salt-minion
[root@master ~]# salt '*' grains.get app
minion:
master:
    test

• 不重启的情况下自定义grains

[root@master ~]# vim /etc/salt/grains
[root@master ~]# cat /etc/salt/grains
app: test
中文:
  - 中文也可以
  
//同步  
[root@master ~]# salt '*' saltutil.sync_grains
minion:
master:
[root@master ~]# salt '*' grains.get 中文
minion:
master:
    - 中文也可以

SaltStack组件之Pillar

• Pillar也是SaltStack组件中非常重要的组件之一，是数据管理中心，经常配置states在大规模的配置管理工作中使用它。
• Pillar在SaltStack中主要的作用就是存储和定义配置管理中需要的一些数据，比如软件版本号、用户名密码等信息，它的定义存储格式与Grains类似，都是YAML格式。
• 在Master配置文件中有一段Pillar settings选项专门定义Pillar相关的一些参数：

//要用的话取消注释
#pillar_roots:
#  base:
#    - /srv/pillar

默认Base环境下Pillar的工作目录在/srv/pillar目录下。若你想定义多个环境不同的Pillar工作目录，只需要修改此处配置文件即可。
Pillar的特点：

• 可以给指定的minion定义它需要的数据
• 只有指定的人才能看到定义的数据
• 在master配置文件里设置

[root@master ~]# salt '*' pillar.items
minion:
    ----------
master:
    ----------

默认pillar是没有任何信息的，如果想查看信息，需要在 master 配置文件上把 pillar_opts的注释取消，并将其值设为 True。

[root@master ~]# vim /etc/salt/master
......
# master config file that can then be used on minions.
pillar_opts: True   #这里改为True
......

//重启master并查看pillar的信息
[root@master ~]# systemctl restart salt-master
[root@master ~]# salt '*' pillar.items
minion:
    ----------
    master:
        ----------
        __cli:
            salt-master
        __role:
            master
        allow_minion_key_revoke:
            True
        archive_jobs:
            False
        auth_events:
            True
        auth_mode:
            1
        auto_accept:
            False
        azurefs_update_interval:
            60
        cache:
            localfs
        cache_sreqs:
            True
        cachedir:
            /var/cache/salt/master
        clean_dynamic_modules:
            True
        cli_summary:
            False
        client_acl_verify:
            True
        cluster_mode:
            False
        con_cache:
            False
        conf_file:
            /etc/salt/master
        config_dir:
            /etc/salt
        cython_enable:
            False

• pillar自定义数据：
• 在master的配置文件里找pillar_roots可以看到其存放pillar的位置

[root@master ~]# vim /etc/salt/master
# Pillar is laid out in the same fashion as the file server, with environments,
# a top file and sls files. However, pillar data does not need to be in the
# highstate format, and is generally just key/value pairs.
pillar_roots:				#取消以下几行注释
  base:
    - /srv/pillar/base
  prod:
    - /srv/pillar/prod
#ext_pillar:
#  - hiera: /etc/hiera.yaml
#  - cmd_yaml: cat /etc/salt/yaml
.......

[root@master ~]# vim /etc/salt/master
[root@master ~]# mkdir -p /srv/pillar/{base,prod}
[root@master ~]# tree /srv/pillar/
/srv/pillar/
├── base
└── prod

2 directories, 0 files
[root@master ~]# systemctl restart salt-master
[root@master ~]# vim /srv/pillar/base/apache.sls
[root@master ~]# cat /srv/pillar/base/apache.sls
{% if grains['os'] == 'CentOS' %}
apache: httpd
{% elif grains['os'] == 'Redhat' %}
apache: httpd
{% endif %}


//定义top file入口文件
[root@master ~]# vim /srv/pillar/base/top.sls
[root@master ~]# cat /srv/pillar/base/top.sls
base:                           
  'minion':                     
    - apache    

#这个top.sls文件的意思表示的是p2这台主机的base环境能够访问到apache这个pillar


[root@master ~]# salt '*' pillar.items
minion:
    ----------
master:
    ----------


//在salt下修改apache的状态文件，引用pillar的数据
[root@master ~]# vim /srv/salt/base/web/apache/install.sls
[root@master ~]# cat /srv/salt/base/web/apache/install.sls
apache-install:
  pkg.installed:
    - name: {{ pillar['apache'] }}

apache-service:
  service.running:
    - name: {{ pillar['apache'] }}
    - enable:Ttrue

[root@master ~]# salt 'minion' state.highstate

Grains与Pillar的区别

	存储位置	类型	采集方式	应用场景
Grains	minion	静态	minion启动时采集 可通过刷新避免重启minion服务	1.信息查询 2.在命令行下进行目标匹配 3.在top file中进行目标匹配 4.在模板中进行目标匹配
Pillar	master	动态	指定，实时生效	1.目标匹配 2.敏感数据配置