Saltstack Series II -- targeting

I originally intended to write webui-halite of salt yesterday. But I thought about it, but I 'd like to write something that is "visible and tangible" first, which is the most basic use. (After tasting some sweetness, I will continue to study it... Haha ~)

So what is targeting?

The official explanation is:

Specifying which minions shocould run a command or execute a state by matching against hostnames, or system information, or defined groups, or even combinations thereof.

For example, we can use this command to restart the minion client, Apache on the web1 server.

salt web1 apache.signal restart

At the same time, we can also write to the top file, for example, only let the web1 at the minion end, to execute webserver. SLS

  base:      ’web1’:         - webserver

Of course, regular expressions can also be used, for example:

Salt 'web ?. Example.net 'test. ping # web1.example.net, web2.example.net .. .webn.example.net salt 'web [1-5] 'test. ping # web1 to web5 salt 'web [1, 3] 'test. ping # web1 and web3 salt 'web-[X-Z] 'test. ping # web-X, web-y, and web-z

In short, there are many ways to restrict specific minions or groups in salt.

The following is a compound matcher table for targeted filtering of Operation targets:

Letter	Match type	Example
G	Grans glob	[Email protected]: Ubuntu
E	PCRE minion ID	[Email protected] \ D + \. (Dev | QA | prod) \. Loc
P	Grains PCRE	[Email protected] :( RedHat | fedora | centos)
L	List of minions	[Email protected], minion3.domain.com or BL * .Domain.com
I	Pillar glob	[Email protected]: foobar
S	Subnet/IP Address	[Email protected]/24 or [email protected]
R	Range Cluster	[Email protected] % Foo. Bar

The official concepts and introductions are as follows:

First, describe my experiment environment:

IP	OS	ID	Character
192.168.139.131	Centos release 6.5 (final)	192.168.139.131	Master
192.168.139.128	Centos release 6.5 (final)	192.168.139.128-centos	Minion
192.168.139.130	Ubuntu 12.04.4	192.168.139.130-Ubuntu	Minion

Before proceeding, take a look at Salt-key as an example:

[[email protected] www]# salt-key  -LAccepted Keys:192.168.139.128-centos192.168.139.130-ubuntuUnaccepted Keys:Rejected Keys:

We first perform operations on the master end, first grouping, because there are only two, we can perform simple grouping according to the grans glob in the above table (grouping this part should be considered. Good roles can greatly improve efficiency. So, is it based on services, OS, and services, or some of them, and so on, I haven't thought about it yet... Haha ...)

Open the master configuration file, find the node groups, and modify it accordingly.

[[email protected] www]# vi /etc/salt/master

nodegroups:  group1: ‘[email protected]:Centos‘  group2: ‘[email protected]:Ubuntu‘

Break in...: there is a problem with user permissions. For example, if I send a permission to Tom, only test. Ping and status. uptime are allowed. (For example, if you run cmd. Run Rm-F, an error is reported ). We can also add the following in/etc/salt/master:

Client_acl:

Tom:

-Test. Ping

-Status. uptime

After the modification, restart the salt-master service and check the result:

[[email protected] www]# service salt-master restartStopping salt-master daemon: [  OK  ]Starting salt-master daemon: [  OK  ][[email protected] www]# salt -N group2 test.ping192.168.139.130-ubuntu:    True[[email protected] www]# salt -N group1 test.ping192.168.139.128-centos:    True

In addition, we can also directly filter nodes on the command line without modifying node groups. It should be noted that the matchers here can also use and, or, and not.

[[email protected] www]# salt -C ‘[email protected]:Ubuntu or 192*‘ test.ping192.168.139.130-ubuntu:    True192.168.139.128-centos:    True

In the same way, you can also restrict the top file:

 base:     ’[email protected]：Ubuntu or 192* ’:        - match: compound        - webserver

Note that the not header does not support the compund matchers table above. We can avoid it as follows:

    salt -C ’* and not [email protected]:Darwin’ test.ping    salt -C ’* and not web-dc1-srv’ test.ping

Next, let's talk about manual file push.

First, create a file named test under/srv/salt/on the master end. The file contains a string of Adada. It is then transferred to the minion end through salt, under the root directory, and renamed to 1234.

[[email protected] salt]# pwd/srv/salt[[email protected] salt]# cat test adada[[email protected] salt]# salt ‘*‘ cp.get_file salt://test /root/1234192.168.139.128-centos:    /root/1234192.168.139.130-ubuntu:    /root/1234

Then, let's go to the minion side and check the results.

[email protected]:~# lltotal 36drwx------  4 root root 4096 Jul 28 06:09 ./drwxr-xr-x 22 root root 4096 Jul  1 23:55 ../-rw-r--r--  1 root root    6 Jul 28 06:09 1234-rw-------  1 root root  525 Jul 28 02:01 .bash_history-rw-r--r--  1 root root 3106 Apr 19  2012 .bashrcdrwx------  2 root root 4096 Jul  2 00:02 .cache/-rw-r--r--  1 root root  140 Apr 19  2012 .profiledrwxr-xr-x  2 root root 4096 Jul 28 02:47 .rpmdb/-rw-------  1 root root  749 Jul 28 01:52 .viminfo[email protected]:~# cat 1234adada[[email protected] ~]# cd /root/[[email protected] ~]# lltotal 24-rw-r--r--. 1 root root    6 Jul 29 12:06 1234-rw-------. 1 root root 1090 Apr 10 00:44 anaconda-ks.cfg-rw-r--r--. 1 root root 9017 Apr 10 00:44 install.log-rw-r--r--. 1 root root 3091 Apr 10 00:41 install.log.syslog[[email protected] ~]# cat 1234 adada

Call... File Transfer demonstration is complete. Alas, you may say, "Isn't it faster to manually go to those servers and change those items one by one ?", Indeed (in the case of a small number, you don't want to be "lazy", no one can stop you ...). In short, salt is attractive only when there are servers of a certain scale.

In addition, we can also perform operations on a certain, some, or all minions through salt on the master end. (Do you still remember the compound matcher table and or not mentioned above:

[[email protected] salt]# salt ‘*‘  cmd ‘ps -ef|grep http‘192.168.139.130-ubuntu:    ‘cmd‘ is not available.192.168.139.128-centos:    ‘cmd‘ is not available.[[email protected] salt]# salt ‘*‘  cmd.run ‘ps -ef|grep http‘192.168.139.130-ubuntu:    root      3584  3583  0 02:14 ?        00:00:00 /bin/sh -c vi /etc/www/httpd/conf/httpd.conf    root      3585  3584  0 02:14 ?        00:00:00 vi /etc/www/httpd/conf/httpd.conf    root      5724  5723  0 06:24 ?        00:00:00 /bin/sh -c ps -ef|grep http    root      5726  5724  0 06:24 ?        00:00:00 grep http192.168.139.128-centos:    root     28979     1  0 09:40 ?        00:00:00 /usr/sbin/httpd    apache   30026 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd    apache   30027 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd    apache   30028 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd    apache   30029 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd    apache   30030 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd    apache   30031 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd

    apache   30032 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd    apache   30033 28979  0 11:19 ?        00:00:00 /usr/sbin/httpd    root     30566 30565  0 12:21 ?        00:00:00 /bin/sh -c ps -ef|grep http    root     30568 30566  0 12:21 ?        00:00:00 grep http[[email protected] salt]# salt ‘*‘  cmd.run ‘date‘192.168.139.130-ubuntu:    Mon Jul 28 06:24:17 EDT 2014192.168.139.128-centos:    Tue Jul 29 12:21:34 CST 2014[[email protected] salt]# salt -N group1  cmd.run ‘df -h‘192.168.139.128-centos:    Filesystem            Size  Used Avail Use% Mounted on    /dev/mapper/VolGroup-lv_root                           19G  1.3G   17G   8% /    tmpfs                 242M     0  242M   0% /dev/shm    /dev/sda1             485M   53M  407M  12% /boot

The basic operation is almost written. Is it sweet to taste it? For more information, see ~

This article is from the "Aaron" blog, please be sure to keep this source http://qishiding.blog.51cto.com/3381613/1532123