Centos7.2 deploy saltstack and centos7.2saltstack

Centos7.2 deploy saltstack and centos7.2saltstack

Originally published in cu:

Reference:

Installation, simple configuration, and application of saltstack.

I. Environment

Server: CentOS Linux release 7.2.1511 (Core)

Salt-master: 172.18.12.201

Salt-minion: 172.18.12.204

Ii. install and configure Saltstack 1. Install yum

# Install Salt-master: [root @ localhost ~] # Yum install strongswan ~] # Yum clean expire-cache [root @ localhost ~] # Yum install salt-master # Salt-minion installation. The last step is to install components in different ways: [root @ localhost ~] # Yum install salt-minion

2. firewall configuration (salt-master)

# CentOS7.2 built-in firewall by default, without iptable; # Remove the built-in firewall startup, install iptable, and set iptable to start when it is started. [root @ localhost ~] # Systemctl stop firewalld. service [root @ localhost ~] # Systemctl disable firewalld. service [root @ localhost ~] # Yum install iptables-services-y [root @ localhost ~] # Systemctl enable iptables. service [root @ localhost ~] # Systemctl restart iptables. service # tcp4506 is the port on which the salt-master sends command information, and tcp4506 is the port on which the salt-minion returns information; # Salt-minion does not support firewall processing, the default iptable rule can be [root @ localhost ~]. # Vim/etc/sysconfig/iptables
-A input-p tcp-m state -- state NEW-m tcp -- dport 4505-j ACCEPT-A INPUT-p tcp-m state -- state NEW-m tcp -- dport 4506-j ACCEPT

3. Configure salt-master

# The interface parameter is bound to the communication ip address of the master. It does not change by default, indicating all Host ip addresses. [root @ localhost ~] # Sed-I's/# interface: 0.0.0.0/interface: 172.18.12.201/G'/etc/salt/master # hash_type parameter can be changed by default, and salt-master can also be started, however, an alarm is triggered after the instance is started: # [WARNING] IMPORTANT: Do not use md5 hashing algorithm! Please set "hash_type" to sha256 in Salt Master config! [Root @ localhost ~] # Sed-I's/# hash_type: md5/hash_type: sha256/G'/etc/salt/master # auto_accept is an automatic authentication switch, which is disabled by default, use salt-key to confirm certificate trust [root @ localhost ~] # Sed-I's/# auto_accept: False/auto_accept: True/G'/etc/salt/master

4. Configure salt-minion

# The master parameter specifies the master ip address (or host name). This parameter is required. If minion cannot be resolved to the master host during startup, the startup will fail. [root @ localhost ~] # Sed-I's/# master: salt/master: 172.18.12.201/G'/etc/salt/minion # hash_type parameter is the same as master; [root @ localhost ~] # Sed-I's/# hash_type: sha256/hash_type: sha256/G'/etc/salt/master # Set the salt-minion name for the id parameter, which is not set by default, minio name: the host name set in host hostname [root @ localhost ~] # Sed-I's/# id:/id: 172.18.12.204/G'/etc/salt/minion

5. Start the service to start salt-master

# Set boot start, check the status after startup; # startup problems can be found through the "systemctl status salt-master.service" and "salt-mater-l debug" and other commands to locate the fault, the salt-minion below is the same [root @ localhost ~] # Systemctl enable salt-master.service [root @ localhost ~] # Systemctl start salt-master.service [root @ localhost ~] # Systemctl status salt-master.service

Start salt-minion

# Set boot start. Check the status after startup [root @ localhost ~] # Systemctl enable salt-minion.service [root @ localhost ~] # Systemctl start salt-minion.service [root @ localhost ~] # Systemctl status salt-mionion.service

 

6. view the minion table in salt-master.

[root@localhost ~]# salt-key -L

Salt-master has set the "auto_accept" parameter to "True". The minion host "172.18.12.204" is already in "Acceptd Keys" (the host name is the id or hostname set by salt-minion ).

Manual key authentication (when the "auto_accept" parameter is "False)

#-A indicates to confirm all the minion in "Unacceptd Keys" (the minion list in unacceptd is red and green after confirmation to the accepted list) [root @ localhost ~] # Salt-key-A #-a indicates A specific minion in "Unacceptd Keys" # Or [root @ localhost ~] # Salt-key-a 172.18.12.204

Simple command Test

# "*" Indicates all the minion in "Acceptd Keys". You can also execute commands on a specific minion. # The returned value is "True", indicating that the master and minion are successfully connected. [root @ localhost ~] # Salt "*" test. ping

# Run the command [root @ localhost ~] # Salt "*" cmd. run "iptables-nL"