Salt 与Salt API配置
1、安装
[root@localhost yum.repos.d]# cat /etc/yum.repos.d/salt.repo
[saltstack-repo]
name=SaltStack repo for Red Hat Enterprise Linux $releasever
baseurl=https://repo.saltstack.com/yum/redhat/$releasever/$basearch/latest
enabled=1
gpgcheck=1
gpgkey=https://repo.saltstack.com/yum/redhat/$releasever/$basearch/latest/SALTSTACK-GPG-KEY.pub
https://repo.saltstack.com/yum/redhat/$releasever/$basearch/latest/base/RPM-GPG-KEY-CentOS-7
yum makecache
yum -y install salt-master salt-minion salt-api openssl openssl-devel
2、配置
Salt master:
[root@localhost ~]# egrep -v '^#|^$' /etc/salt/master
default_include: master.d/*.conf
interface: 0.0.0.0
file_roots:
base:
- /srv/salt
Salt minion:
[root@localhost ~]# egrep -v '^#|^$' /etc/salt/minion
master: 192.168.32.135
id: 192.168.32.135
启动服务：
systemctl start salt-master
systemctl start salt-minion
提示：安装遇到如下问题的解决办法：
2017-05-03 14:31:57,705 [salt.utils.network][WARNING ][15848] Cannot resolve address None info via socket: <class 'socket.gaierror'>
这个错误，更改主机名即可；
2017-05-03 14:59:14,999 [salt.utils.parsers][WARNING ][35108] Master received a SIGINT. Exiting.
2017-05-03 15:01:02,633 [salt.utils.verify][WARNING ][36608] Insecure logging configuration detected! Sensitive data may be logged.
貌似是默认的启动脚本问题，我这里直接用命令启动的，如下：
nohup salt-master -l all &
nohup salt-minion -l all &
3、测试
###查看salt-key
salt-key list
###验证通过
salt-key -a 192.168.28.135
###相关测试
salt '*' test.ping
4、配置salt-master 与 salt-api
###生成SSL自签发证书
[root@localhost ~]# cd /etc/pki/tls/certs/
[root@localhost certs]# make testcert
umask 77 ; \
/usr/bin/openssl genrsa -aes128 2048 > /etc/pki/tls/private/localhost.key
Generating RSA private key, 2048 bit long modulus
...+++
..................................................................+++
e is 65537 (0x10001)
Enter pass phrase: #键入加密短语，4到8191个字符
Verifying - Enter pass phrase: #确认加密短语
umask 77 ; \
/usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt -set_serial 0
Enter pass phrase for /etc/pki/tls/private/localhost.key: #再次输入相同的加密短语
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN #都可以选填
State or Province Name (full name) []:Shanghai
Locality Name (eg, city) [Default City]:Shanghai
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:972711021@qq.com
提示：如果遇到相关错误，删掉文件/etc/pki/tls/private/localhost.key文件，然后再make testcert。
[root@localhost certs]# cd ../private
[root@localhost private]# openssl rsa -in localhost.key -out localhost_nopass.key
Enter pass phrase for localhost.key: #输入之前的加密短语
writing RSA key
###创建salt-api用户
[root@localhost private]# useradd -M -s /sbin/nologin saltapi
[root@localhost private]# passwd saltapi
更改用户 saltapi 的密码 。
新的 密码：
无效的密码： 密码包含用户名在某些地方
重新输入新的 密码：
passwd：所有的身份验证令牌已经成功更新。
###创建相关配置文件
新增加配置文件/etc/salt/master.d/api.conf和/etc/salt/master.d/eauth.conf
#该配置文件给予saltapi用户所有模块使用权限，出于安全考虑一般只给予特定模块使用权限
[root@saltstack master.d]# cat eauth.conf
external_auth:
pam:
saltapi:
- .*
[root@saltstack master.d]#
[root@saltstack master.d]# cat api.conf
rest_cherrypy:
port: 8888
ssl_crt: /etc/pki/tls/certs/localhost.crt
ssl_key: /etc/pki/tls/private/localhost_nopass.key
[root@saltstack master.d]#
systemctl restart salt-master
systemctl start salt-api
5、测试salt-api
###获取token
curl -k https://192.168.32.147:8888/login -H "Accept: application/x-yaml" -d username='saltapi' -d password='saltapi@123' -d eauth='pam'
###获取token后，执行相关操作
curl -k https://192.168.32.147:8888/ -H "Accept: application/x-yaml" -H "X-Auth-Token: 281bb65bdeca73a4dcee13cdcbfe5b47553ce82e" -d client='local' -d tgt='*' -d fun='test.ping'
curl -k https://192.168.32.135:8888/ -H "Accept: application/x-yaml" -H "X-Auth-Token: 281bb65bdeca73a4dcee13cdcbfe5b47553ce82e" -d client='local' -d tgt='*' -d fun='test.echo' -d arg='hello world'
