Salt-satck一鍵部署keepalived；haproxy服務：

配置yum源：將server4新增到salt-stack叢集中

[rhel-source]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
 

baseurl=http://172.25.30.250/rhel6.5
enabled=1
gpgcheck=0

[salt]
name=salt-stack
baseurl=http://172.25.30.250/rhel6
enabled=1
gpgcheck=0

[LoadBalancer]
name=LoadBalancer
baseurl=http://172.25.30.250/rhel6.5/LoadBalancer
enabled=1
gpgcheck=0

1.keepalived原始碼安裝

cd /srv/salt/
mkdir keepalived
mkdir pkgs #安裝依賴包
mkdir files
cd keepalived/
vim install.sls
include:
  - pkgs.make
 

kp-installed:
  file.managed:
    - name: /mnt/keepalived-2.0.6.tar.gz
    - source: salt://keepalived/files/keepalived-2.0.6.tar.gz
  cmd.run:
    - name: cd /mnt && tar zxf keepalived-2.0.6.tar.gz && cd /mnt/keepalived-2.0.6 && ./configure --prefix=/usr/local/keepalived --with-init=SYSV &> /dev
 
/null  && make &> make install &> /dev/null
    - creates: /usr/local/keepalived/
/etc/keepalived:
  file.directory:
    - mode: 755

/etc/sysconfig/keepalived:
  file.symlink:
    - target: /usr/local/keepalived/etc/sysconfig/keepalived

/sbin/keepalived:
  file.symlink:
    - target: /usr/local/keepalived/sbin/keepalived


cd pkgs
vim make.sls
make:
  pkg.installed:
    - pkgs:
      - gcc
      - pcre-devel
      - openssl-devel

用pillar設定變數：

cd /srv/pillar/
make keepalived
cd /srv/pillar/keepalived
vim install.sls
~
{% if grains['fqdn']== 'server1' %}
state: MASTER #如果主機名稱是server1;state:MASTER;權重100
vrid: 131
priority: 100
{% elif grains['fqdn']== 'server4'%} #如果主機是server4；state：BACKUP；權重50
state: BACKUP
vrid: 131
priority: 50
{% endif %}

cd /srv/pillar
vim top.sls 
base:
  '*':
    - web.install
    - keepalived.install
在files裡設定vip
cd /srv/salt/keepalived/files/
vim keepalived.conf
! Configuration File for keepalived

global_defs {
   notification_email {
        [email protected]
   }
   notification_email_from [email protected]
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id LVS_DEVEL
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}

vrrp_instance VI_1 {
    state {{ STATE }} #狀態呼叫pillar中設定的變數
    interface eth0 
    virtual_router_id {{ VRID }} #虛擬id
    priority {{ PRIORITY }} #權重
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
    172.25.30.100 #VIP
    }
}

2.部署keepalived：

vim keepalived.servoce
include:
  - keepalived.install #呼叫安裝檔案

/etc/keepalived/keepalived.conf:
  file.managed:
    - source: salt://keepalived/files/keepalived.conf
    - template: jinja #jinja模組
    - context:
        STATE: {{ pillar['state'] }}
        VRID: {{ pillar['vrid'] }}
        PRIORITY: {{ pillar['priority'] }}

kp-service:
  file.managed:
    - name: /etc/init.d/keepalived
    - source: salt://keepalived/files/keepalived
    - mode: 755
  service.running:
    - name: keepalived
    - reload: True
    - watch:
      - file: /etc/keepalived/keepalived.conf

3.top 部署haproxy；keepalived高可用負載均衡平臺：

上一節中我們部署的haproxy實現的均衡負載；現在我們在原來的基礎上安裝keepalived實現高可用

vim /srv/salt/top.sls 
base:
  'server1':
    - haproxy.install
    - keepalived.service
  'server4':
    - haproxy.install
    - keepalived.service
  'roles:apache':
    - match: grain
    - httpd.install
  'roles:nginx':
    - match: grain
    - nginx.service

推送部署：



salt ‘*’ state.highstate
推送測試：



我們這個服務當haproxy關掉並不能實現高可用因此我們編輯了一個監控指令碼

4.實現haproxy高可用：

新增一個監控指令碼：
cd /opt/
vim check_haproxy.sh #如果haproxy狀態關閉就自動開啟；如果返回值不等於0關閉keepalived；vip就會調轉到另一個keepalived上

#!/bin/bash

/etc/init.d/haproxy status &> /dev/null || /etc/init.d/haproxy restart &> /dev/nnull

if [ $? -ne 0 ];then 
/etc/init.d/keepalived stop &> /dev/null
fi
~                                           

chmod +x check_haproxy.sh 
vim /srv/salt/keepalived/files/keepalived.conf # 配置檔案呼叫監控指令碼

! Configuration File for keepalived

vrrp_script check_haproxy {
        script "/opt/check_haproxy.sh"
        interval 2 
        weight   2 #每當發現haproxy宕掉就減少master的權重直到比backup的權重低就會自動切換
}

global_defs {
   notification_email {
        [email protected]
   }
   notification_email_from [email protected]
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id LVS_DEVEL
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}


vrrp_instance VI_1 {
    state {{ STATE }}
    interface eth0
    virtual_router_id {{ VRID }}
    priority {{ PRIORITY }}
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
    172.25.30.100
    }
    track_script {
        check_haproxy
    }
}

salt server4 state.sls keepalived.service #將keepalived.service推給server4
chmod +x check_haproxy.sh 

測試：
server1:關閉/etc/init.d/haproxy stop
為了防止指令碼將haproxy再開啟我們可以取消haproxy指令碼許可權來測試效果測試完畢要將他的許可權又賦予

/etc/init.d/salt-minion restart

Salt命令部署：

salt-cp '*' /etc/passwd /tmp/ #cp /etc/passwd到minion的/tmp下面
salt '*' cmd.run 'rm -f /tmp/passwd ' #cmd命令刪除minion/tmp/passwd
salt server3 state.single pkg.installed httpd #模組安裝單獨給server3安裝httpd
salt '*' cmd.run 'yum install httpd -y ' #命令安裝

5.安裝資料庫快取資料

5.1 > minioin上安裝資料庫記錄

External Job Cache - Minion-Side Returner

Salt-minion:
yum install -y MySQL-python.x86_64
vim /etc/salt/minion
/etc/init.d/salt-minion restart

yum insatll mysql-server
 /etc/init.d/mysqld start
Mysql
mysql> grant all on salt.* to [email protected]'172.25.30.%' identified by 'westos';
mysql> drop database salt;
mysql < test.sql
salt 'server2' test.ping --return mysql
server2:
    True

5.2.在master安裝

Master Job Cache - Master-Side Returner

yum install MySQL-python -y
vim /etc/salt/master

/etc/init.d/mysqld start
Server3:
/etc/init.d/salt-minion restart

6.封裝模組：

有時候我們可以把很多函式封裝在一個模組中這樣在我們呼叫的過程中就可用呼叫模組中的函式；這樣即方便還便於整理

mkdir /srv/salt/_modules
cd /srv/salt/_modules
vim my_disk.py

#!/usr/bin/env python

def df():
    return __salt__['cmd.run']('df -h')

salt '*' saltutil.sync_modules #同步模組

當模組同步到minion中時會將封裝檔案推送到minion的快取中和grains相似

執行封裝模組命令

7.Syndic：

部署： server4——>top master—->master of master
Server4:
在master刪除minion中的server4(salt-key -d server4)；server4把他之前的服務都關掉

/etc/init.d/salt-minion stop
chkconfig salt-minion off
/etc/init.d/haproxy stop
/etc/init.d/keepalived stop
yum install salt-master -y
vim /etc/salt/master #開啟syndic埠

etc/init.d/salt-master start
Sever1:master----->syndic
yum install salt-syndic
vim /etc/salt/master

/etc/init.d/salt-master start
/etc/init.d/salt-master stop
/etc/init.d/salt-syndic  start

Server4:top-master:


當環境不允許我們安裝salt我們可以通過salt-ssh來部署：

8.salt-ssh

Master端：

yum install -y salt-ssh
vim /etc/salt/roster #新增server3 因為是root所以不用賦予許可權

vim /etc/salt/master #ssh和mysql有衝突所以我們需要註釋mysql
/etc/init.d/salt-master stop
/etc/init.d/salt-master start
salt-ssh 'server3' test.ping

關閉server3的minion測試：

 cd /etc/pki/tls/private/
 openssl genrsa 1024 > localhost.key #生成key在ocalhost.key檔案中
 cd ../certs/
 make testcert #製作證書

vim /etc/salt/master.d/api.conf #api配置檔案定義api埠加密檔案和證書檔案
rest_cherrypy:
  port: 8000
  ssl_crt: /etc/pki/tls/certs/localhost.crt

  ssl_key: /etc/pki/tls/private/localhost.key
vim auth.conf #編輯認證配置檔案
external_auth:
  pam:
    saltapi:
      - '.*'
      - '@wheel'
      - '@runner'
      - '@jobs'
useradd saltapi #建立認證使用者和密碼
passwd saltapi

重啟服務

[root@server1 master.d]# curl -sSk https://localhost:8000/login -H 'Accept: application/x-yaml' -d username=saltapi -d password=westos -d eauth=pam
return:
- eauth: pam
  expire: 1534598878.4669149
  perms:
  - .*
  - '@wheel'
  - '@runner'
  - '@jobs'
  start: 1534555678.4669139
  token: **4f0f24b3cea429878d66af4c1ca2d9cd630aef41**
  user: saltapi
[root@server1 master.d]# curl -sSk https://localhost:8000 \
> -H 'Accept: application/x-yaml' \
> -H 'X-Auth-Token: **4f0f24b3cea429878d66af4c1ca2d9cd630aef41**' \
> -d client=local \
> -d tgt='*' \
> -d fun=test.ping
return:
- server1: true
  server2: true
  server3: true

vim saltapi.py #編輯api模組用html編寫py檔案呼叫方法：

# -*- coding: utf-8 -*-

import urllib2,urllib
import time

try:
    import json
except ImportError:
    import simplejson as json

class SaltAPI(object):
    __token_id = ''
    def __init__(self,url,username,password):
        self.__url = url.rstrip('/')
        self.__user = username
        self.__password = password


    def token_id(self):
        ''' user login and get token id '''
        params = {'eauth': 'pam', 'username': self.__user, 'password': self.__password}
        encode = urllib.urlencode(params)
        obj = urllib.unquote(encode)
        content = self.postRequest(obj,prefix='/login')
        try:
            self.__token_id = content['return'][0]['token']
        except KeyError:
            raise KeyError

    def postRequest(self,obj,prefix='/'):
        url = self.__url + prefix
        headers = {'X-Auth-Token'   : self.__token_id}
        req = urllib2.Request(url, obj, headers)
        opener = urllib2.urlopen(req)
        content = json.loads(opener.read())
        return content

    def list_all_key(self):
        params = {'client': 'wheel', 'fun': 'key.list_all'}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        minions = content['return'][0]['data']['return']['minions']
        minions_pre = content['return'][0]['data']['return']['minions_pre']
        return minions,minions_pre

    def delete_key(self,node_name):
        params = {'client': 'wheel', 'fun': 'key.delete', 'match': node_name}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        ret = content['return'][0]['data']['success']
        return ret

    def accept_key(self,node_name):
        params = {'client': 'wheel', 'fun': 'key.accept', 'match': node_name}


        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        ret = content['return'][0]['data']['success']
        return ret

    def remote_noarg_execution(self,tgt,fun):
        ''' Execute commands without parameters '''
        params = {'client': 'local', 'tgt': tgt, 'fun': fun}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        return content

    def async_deploy(self,tgt,arg):
        ''' Asynchronously send a command to connected minions '''
        params = {'client': 'local_async', 'tgt': tgt, 'fun': 'state.sls', 'arg': arg}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        jid = content['return'][0]['jid']
        return jid

    def target_deploy(self,tgt,arg):
        ''' Based on the node group forms deployment '''
        params = {'client': 'local_async', 'tgt': tgt, 'fun': 'state.sls', 'arg': arg, 'expr_form': 'nodegroup'}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)

        content = self.postRequest(obj)
        ret = content['return'][0][tgt]
        return ret

    def remote_execution(self,tgt,fun,arg):
        ''' Command execution with parameters '''
        params = {'client': 'local', 'tgt': tgt, 'fun': fun, 'arg': arg}

        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        jid = content['return'][0]['jid']
        return jid

    def deploy(self,tgt,arg):
        ''' Module deployment '''
        params = {'client': 'local', 'tgt': tgt, 'fun': 'state.sls', 'arg': arg}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        return content

    def async_deploy(self,tgt,arg):
        ''' Asynchronously send a command to connected minions '''
        params = {'client': 'local_async', 'tgt': tgt, 'fun': 'state.sls', 'arg': arg}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        jid = content['return'][0]['jid']
        return jid

    def target_deploy(self,tgt,arg):
        ''' Based on the node group forms deployment '''
        params = {'client': 'local_async', 'tgt': tgt, 'fun': 'state.sls', 'arg': arg, 'expr_form': 'nodegroup'}
        obj = urllib.urlencode(params)
        self.token_id()
        content = self.postRequest(obj)
        jid = content['return'][0]['jid']
        return jid

def main():
    sapi = SaltAPI(url='https://**172.25.30.1:8000**',username='saltapi',password='westos')
    #sapi.token_id()
    print sapi.list_all_key()
    #sapi.delete_key('test-01')
    #sapi.accept_key('test-01')
    sapi.deploy('**server3','nginx.service**')
    #print sapi.remote_noarg_execution('test-01','grains.items')

if __name__ == '__main__':
    main()