SaltStack入门篇（七）之架构部署实战

模块：https://docs.saltstack.com/en/2016.11/ref/states/all/index.html 
实战架构图：

实验环境设置：

主机名    　　　　　　　　　　　　　　IP地址    　　　　　　　　　　　　角色
linux-node1.example.com    192.168.56.11    Master、Minion、Haproxy+Keepalived、Nginx+PHP
linux-node2.example.com    192.168.56.12    Minion、Memcached、Haproxy+Keepalived、Nginx+PHP

SaltStack环境设置： 
base环境用于存放初始化的功能，prod环境用于放置生产的配置管理功能

[root@linux-node1 ~]# vim /etc/salt/master
file_roots:
  base:
    - /srv/salt/base
  dev:
    - /srv/salt/dev
  test:
    - /srv/salt/test
  prod:
    - /srv/salt/prod

pillar_roots:
  base:
    - /srv/pillar/base
  prod:
    - /srv/pillar/prod

1、系统初始化

当我们的服务器上架并安装好操作系统后，都会有一些基础的操作，所以生产环境中使用SaltStack，建议将所有服务器都会涉及的基础配置或者软件部署归类放在base环境下。此处，在base环境下创建一个init目录，将系统初始化配置的sls均放置到init目录下，称为“初始化模块”。

（1）需求分析和模块识别

初始化内容	模块使用	文件
关闭SElinux	file.managed	/etc/selinux/config
关闭默认firewalld	service.disabled
时间同步	pkg.installed
文件描述符	file.managed	/etc/security/limits.conf
内核优化	sysctl.present
SSH服务优化	file.managed、service.running
精简开机系统服务	service.dead
DNS解析	file.managed	/etc/resolv.conf
历史记录优化history	file.append	/etc/profile
设置终端超时时间	file.append	/etc/profile
配置yum源	file.managed	/etc/yum.repo.d/epel.repo
安装各种agent	pkg.installed 、file.managed、service.running
基础用户	user.present、group.present
常用基础命令	pkg.installed、pkgs
用户登录提示、PS1的修改	file.append	/etc/profile

（2）需求实现

 [root@linux-node1 base]# pwd
 /srv/salt/base
 [root@linux-node1 base]# mkdir init/files -p

 、关闭selinux
 #使用了file模块的managed方法
 [root@linux-node1 init]# vim selinux.sls
 selinux-config:
   file.managed:
     - name: /etc/selinux/config
     - source: salt://salt/init/files/selinux-config
     - user: root
     - group: root
     - mode:
 [root@linux-node1 init]# cp /etc/selinux/config files/selinux-config

 、关闭firewalld
 #使用service模块的dead方法，直接关闭firewalld，并禁止开机启动
 [root@linux-node1 init]# vim firewalld.sls
 firewall-stop:
   service.dead:
     - name: firewalld.service
     - enable: False

 、时间同步
 #先使用pkg模块安装ntp服务，再使用cron模块加入计划任务
 [root@linux-node1 init]# vim ntp.sls
 ntp-install:
   pkg.installed:
     - name: ntpdate

 cron-ntpdate:
   cron.present:
     - name: ntpdate time1.aliyun.com
     - user: root
     - minute: 

 、修改文件描述符
 #使用file模块的managed方法
 [root@linux-node1 init]# vim limit.sls
 limit-config:
   file.managed:
     - name: /etc/security/limits.conf
     - source: salt://init/files/limits.conf
     - user: root
     - group: root
     - mode:
 [root@linux-node1 init]# cp /etc/security/limits.conf files/
 [root@linux-node1 init]# echo "*               -       nofile          65535
 " >> files/limits.conf 

 、内核优化
 #使用sysctl模块的present方法,此处演示一部分，这里没有使用name参数，所以id就相当于是name
 [root@linux-node1 init]# vim sysctl.sls
 net.ipv4.tcp_fin_timeout:
   sysctl.present:
     - value: 

 net.ipv4.tcp_tw_reuse:
   sysctl.present:
     - value: 

 net.ipv4.tcp_tw_recycle:
   sysctl.present:
     - value: 

 net.ipv4.tcp_syncookies:
   sysctl.present:
     - value: 

 net.ipv4.tcp_keepalive_time:
   sysctl.present:
     - value: 

 、SSH服务优化
 #使用file.managed和service.running以及watch，对ssh服务进行优化配置
 [root@linux-node1 init]# vim sshd.sls
 sshd-config:
   file.managed:
     - name: /etc/ssh/sshd_config
     - source: salt://init/files/sshd_config
     - user: root
     - gourp: root
     - mode:
   service.running:
     - name: sshd
     - enable: True
     - reload: True
     - watch:
       - file: sshd-config
 [root@linux-node1 init]# cp /etc/ssh/sshd_config files/
 [root@linux-node1 init]# vim files/sshd_config
 Port
 UseDNS no
 PermitRootLogin no
 PermitEmptyPasswords no
 GSSAPIAuthentication no

 、精简开机启动的系统服务
 #举例关闭postfix开机自启动
 [root@linux-node1 init]# vim thin.sls
 postfix:
   service.dead:
     - enable: False

 、DNS解析
 [root@linux-node1 init]# vim dns.sls
 dns-config:
   file.managed:
     - name: /etc/resolv.conf
     - source: salt://init/files/resolv.conf
     - user: root
     - group: root
     - mode:
 [root@linux-node1 init]# cp /etc/resolv.conf files/

 、历史记录优化history
 #使用file.append扩展修改HISTTIMEFORMAT的值
 [root@linux-node1 init]# vim history.sls
 history-config:
   file.append:
     - name: /etc/profile
     - text:
       - export HISTTIMEFORMAT="%F %T `whoami` "
       - export HISTSIZE=
       - export HISTFILESIZE=

 、设置终端超时时间
 #使用file.append扩展修改TMOUT环境变量的值
 [root@linux-node1 init]# vim tty-timeout.sls
 ty-timeout:
   file.append:
     - name: /etc/profile
     - text:
       - export TMOUT=

 、配置yum源
 #拷贝yum源
 [root@linux-node1 init]# vim yum-repo.sls
 /etc/yum.repos.d/epel.repo:
   file.managed:
     - source: salt://init/files/epel.repo
     - user: root
     - group: root
     - mode: 

 、安装各种agent（如安装zabbix-agent）
 #相当于一个软件的安装、配置、启动，此处也使用了jinja模板和pillar
 [root@linux-node1 base]# mkdir zabbix
 [root@linux-node1 base]# vim zabbix/zabbix-agent.sls
 zabbix-agent:
   pkg.installed:
     - name: zabbix22-agent
   file.managed:
     - name: /etc/zabbix_agentd.conf
     - source: salt://zabbix/files/zabbix_agentd.conf
     - template: jinja
     - defaults:
       ZABBIX-SERVER: {{ pillar['zabbix-agent']['Zabbix_Server'] }}
     - require:
       - pkg: zabbix-agent
   service.running:
     - enable: True
     - watch:
       - pkg: zabbix-agent
       - file: zabbix-agent
 zabbix_agent.conf.d:
   file.directory:
     - name: /etc/zabbix_agentd.conf.d
     - watch_in:
       - service: zabbix-agent
     - require:
       - pkg: zabbix-agent
       - file: zabbix-agent
 [root@linux-node1 srv]# vim pillar/base/zabbix.sls
 zabbix-agent:
   Zabbix_Server: 192.168.56.11

 、基础用户
 #增加基础管理用户www，使用user.present和group.present
 [root@linux-node1 init]# vim user-www.sls
 www-user-group:
   group.present:
     - name: www
     - gid: 

   user.present:
     - name: www
     - fullname: www
     - shell: /sbin/bash
     - uid:
     - gid: 

 、常用基础命令
 #这里因为各软件包会依赖源，所以使用include讲yum源包含进来，并在pkg.installed最后增加require依赖
 [root@linux-node1 init]# vim pkg-base.sls
 include:
   - init.yum-repo
 base-install:
   pkg.installed:
     - pkgs:
       - screen
       - lrzsz
       - tree
       - openssl
       - telnet
       - iftop
       - iotop
       - sysstat
       - wget
       - dos2unix
       - lsof
       - net-tools
       - mtr
       - unzip
       - zip
       - vim
       - bind-utils
     - require:
       - file: /etc/yum.repos.d/epel.repo

 、用户登录提示、PS1的修改
 [root@linux-node1 init]# vim tty-ps1.sls
 /etc/bashrc:
   file.append:
     - text:
       - export PS1=' [\u@\h \w]\$ '

 、编写一个总的状态，并写入top file中
 #将所有初始化所需要的功能编写完成，每个小功能都是一个sls文件，统一放在init目录下。此时再使用include把这些初始化的功能都包含进来。
 [root@linux-node1 init]# vim init-all.sls
 include:
   - init.dns
   - init.yum-repo
   - init.firewalld
   - init.history
   - init.limit
   - init.ntp
   - init.pkg-base
   - init.selinux
   - init.sshd
   - init.sysctl
   - init.thin
   - init.tty-timeout
   - init.tty-ps1
   - init.user-www

 #在top.sls里面给Minion指定状态并执行，强烈建议先测试，确定SaltStack会执行哪些操作然后再应用状态到服务器上
 [root@linux-node1 base]# vim top.sls
 base:
   '*':
     - init.init-all
 [root@linux-node1 base]# salt '*' state.highstate test=True
 [root@linux-node1 base]# salt '*' state.highstate 

2、MySQL主从

1.需求分析： 
配置MySQL主从的有以下步骤： 
（1）MySQL安装初始化—->mysql-install.sls 
（2）MySQL的主配置文件my.cnf配置不同的server_id–>mariadb-server-master.cnf、mariadb-server-slave.cnf 
（3）创建主从同步用户–>master.sls 
（4）master获取bin-log和post值–>通过脚本实现 
（5）slave上，change master && start slave–>slave.sls

2.需求实现：

()在prod环境下载创建modules和mysql目录
[root@linux-node1 prod]# pwd
/srv/salt/prod
[root@linux-node1 prod]# mkdir modules/mysql

（）配置安装和配置状态文件install.sls
[root@linux-node1 mysql]# cat install.sls
mysql-install:
  pkg.installed:
    - pkgs:
      - mariadb
      - mariadb-server

mysql-config:
  file.managed:
    - name: /etc/my.cnf
    - source: salt://modules/mysql/files/my.cnf
    - user: root
    - gourp: root
    - mode:
[root@linux-node1 mysql]# cp /etc/my.cnf files/

（）在主上配置mariadb-server.cnf,并更改server_id，以及创建主从用户
[root@linux-node1 mysql]# cat master.sls
include:
  - modules.mysql.install

master-config:
  file.managed:
    - name: /etc/my.cnf.d/mariadb-server.cnf
    - source: salt://modules/mysql/files/mariadb-server-master.cnf
    - user: root
    - group: root
    - mode: 

master-grant:
  cmd.run:
    - name: mysql -e "grant replication slave on *.* to repl@'192.168.56.0/255.255.255.0' identified by '123456';flush privileges;"
[root@linux-node1 mysql]# cp /etc/my.cnf.d/mariadb-server.cnf files/mariadb-server-master.cnf
[root@linux-node1 mysql]# cp /etc/my.cnf.d/mariadb-server.cnf files/mariadb-server-slave.cnf 

#修改主从的配置文件的server_id和开启主上的log-bin功能
[root@linux-node1 mysql]# vim files/mariadb-server-master.cnf
[mysqld]
server_id=
log-bin=mysql-bin
[root@linux-node1 mysql]# vim files/mariadb-server-slave.cnf
[mysqld]
server_id=

（）编写shell脚本获取bin-log值和pos值
[root@linux-node1 mysql]# cat files/start-slave.sh
#!/bin/bash
for i in `seq  `
do
    mysql -h 192.168.56.11 -urepl -p123456 -e "exit"
    if [ $? -eq  ];then
        Bin_log=`mysql -h 192.168.56.11 -urepl -p123456 -e "show master status;"|awk  'NR==2{print $1}'`
        POS=`mysql -h 192.168.56.11 -urepl -p123456 -e "show master status;"|awk  'NR==2{print $2}'`
    mysql -e "change master to master_host='192.168.56.11', master_user='repl', master_password='123456', master_log_file='$Bin_log', master_log_pos=$POS;start slave;"
    exit;
    else
        sleep ;
    fi
done

（）从库上配置slave，并启动
[root@linux-node1 mysql]# cat slave.sls
include:
  - modules.mysql.install

slave-config:
  file.managed:
    - name: /etc/my.cnf.d/mariadb-server.cnf
    - source: salt://modules/mysql/files/mariadb-server-slave.cnf
    - user: root
    - group: root
    - mode: 

start-slave:
  file.managed:
    - name: /tmp/start-slave.sh
    - source: salt://modules/mysql/files/start-slave.sh
    - user: root
    - group: root
    - mode:
  cmd.run:
    - name: /bin/bash /tmp/start-slave.sh

3、HAproxy+Keepalived

（1）pkg配置管理

[root@linux-node1 modules]# mkdir pkg
[root@linux-node1 pkg]# vim pkg-init.sls
pkg-init:
  pkg.installed:
    - names:
      - gcc
      - gcc-c++
      - glibc
      - make
      - autoconf
      - openssl
      - openssl-devel
[root@linux-node1 pkg]# salt 'linux-node1*' state.sls modules.pkg.pkg-init saltenv=prod test=True

（2）haproxy配置管理

[root@linux-node1 modules]# mkdir haproxy/files -p
[root@linux-node1 haproxy]# cat haproxy.sls
include:
  - pkg.pkg-init

haproxy-install:
  file.managed:
    - name: /usr/local/src/haproxy-1.5..tar.gz
    - source: salt://modules/haproxy/files/haproxy-1.5.3.tar.gz
    - user: root
    - group: root
    - mode:
  cmd.run:
    - name: cd /usr/local/src && tar -zxvf haproxy-1.5..tar.gz && cd haproxy-1.5. && make TARGET=linux26 PREFIX=/usr/local/haproxy && make install PREFIX=/usr/local/haproxy
    - unless: test -d /usr/local/haproxy
    - require:
      - pkg: pkg-init
      - file: haproxy-install

/etc/init.d/haproxy:
  file.managed:
    - source: salt://modules/haproxy/files/haproxy.init
    - user: root
    - group: root
    - mode:
    - require:
      - cmd: haproxy-install

net.ipv4.ip_nonlocal_bind:
  sysctl.present:
    - value: 

haproxy-config-dir:
  file.directory:
    - name: /etc/haproxy
    - mode:
    - user: root
    - group: root

haproxy-init:
  cmd.run:
    - name: chkconfig --add haproxy
    - unless: chkconfig --list | grep haproxy
    - require:
      - file: /etc/init.d/haproxy
[root@linux-node1 haproxy]# cp /usr/local/src/haproxy-1.5..tar.gz files/
[root@linux-node1 haproxy]# cp /usr/local/src/haproxy-1.5./examples/haproxy.init files/
[root@linux-node1 haproxy]# tree
.
├── files
│   ├── haproxy-1.5..tar.gz
│   └── haproxy.init
└── install.sls

（3）Keepalived配置管理

[root@linux-node1 keepalived]# vim install.sls
include:
  - pkg.pkg-init

keepalived-install:
  file.managed:
    - name: /usr/local/src/keepalived-1.2..tar.gz
    - source: salt://modules/keepalived/files/keepalived-1.2.17.tar.gz
    - user: root
    - gourp: root
    - mode:
  cmd.run:
    - name: cd /usr/locall/src && tar -zxf keepalived-1.2..tar.gz && cd keepalived-1.2. && ./configure --prefix=/usr/local/keepalived --disable-fwmark && make && make install
    - unless: test -d /usr/local/keepalived
    - require:
      - pkg: pkg-init
      - file: keepalived-install

/etc/sysconfig/keeplived:
  file.managed:
    - source: salt://modules/keepalived/files/keepalived-sysconfig
    - user: root
    - gourp: root
    - mode: 

/etc/init.d/keepalived:
  file.managed:
    - sourcd: salt://modules/keepalived/files/keepalived.init
    - user: root
    - group: root
    - mode: 

keepalive-init:
  cmd.run:
    - name: chkconfig --add keepalived
    - unless: chkconfig --list | grep keepalived
    - require:
      - file: /etc/init.d/keepalived

/etc/keepalived:
  file.directory:
    - user: root
    - group: root
[root@linux-node1 keepalived]# cp /usr/local/src/keepalived-1.2..tar.gz files/
[root@linux-node1 init.d]# pwd
/usr/local/src/keepalived-1.2./keepalived/etc/init.d
[root@linux-node1 init.d]# cp keepalived.init /srv/salt/prod/modules/keepalived/files/
[root@linux-node1 init.d]# cp keepalived.sysconfig /srv/salt/prod/modules/keepalived/files/
[root@linux-node1 keepalived]# tree
.
├── files
│   ├── keepalived-1.2..tar.gz
│   ├── keepalived.init
│   └── keepalived.sysconfig
└── install.sls

4、Nginx+PHP

（1）Nginx配置管理

[root@linux-node1 modules]# mkdir pcre
[root@linux-node1 pcre]# cat init.sls
pcre-install:
  pkg.installed:
    - names:
      - pcre
      - pcre-devel
[root@linux-node1 modules]# mkdir user
[root@linux-node1 user]# cat www.sls
www-user-group:
  group.present:
    - name: www
    - gid: 

  user.present:
    - name: www
    - fullname: www
    - shell: /sbin/nologin
    - uid:
    - gid:
[root@linux-node1 modules]# mkdir nginx/files -p
[root@linux-node1 nginx]# cp /usr/local/src/nginx-1.12..tar.gz files/
[root@linux-node1 nginx]# tree
.
├── files
│   └── nginx-1.12..tar.gz
└── install.sls
[root@linux-node1 nginx]# cat install.sls
include:
  - modules.pcre.init
  - modules.user.www
  - modules.pkg.pkg-init

nginx-source-install:
  file.managed:
    - name: /usr/local/src/nginx-1.12..tar.gz
    - source: salt://modules/nginx/files/nginx-1.12.2.tar.gz
    - user: root
    - group: root
    - mode:
  cmd.run:
    - name : cd /usr/local/src && tar -zxf nginx-1.12..tar.gz && cd nginx-1.12. && ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_ssl_module --with-http_stub_status_module --with-file-aio --with-http_dav_module && make && make install && chown -R www.www /usrl/local/nginx
    - unless: test -d /usr/local/nginx
    - require:
      - user: www-user-group
      - file: nginx-source-install
      - pkg: pcre-install
      - pkg: pkg-init
[root@linux-node1 nginx]# salt 'linux-node1*' state.sls modules.nginx.install saltenv=prod test=True

（2）PHP配置管理

[root@linux-node1 modules]# mkdir php/files -p
[root@linux-node1 php]# cp /usr/local/src/php-5.6./sapi/fpm/init.d.php-fpm files/
[root@linux-node1 php]# cp /usr/local/php/etc/php-fpm.conf.default files/
[root@linux-node1 php]# cp /usr/local/src/php-5.6./php.ini-production files/
[root@linux-node1 php]# cp /usr/local/src/php-5.6..tar.gz files/
[root@linux-node1 php]# tree
.
├── files
│   ├── init.d.php-fpm
│   ├── php-5.6..tar.gz
│   ├── php-fpm.conf.default
│   └── php.ini-production
└── install.sls
[root@linux-node1 php]# cat install.sls
include:
  - modules.user.www

pkg-php:
  pkg.installed:
    - names:
      - mysql-devel
      - openssl-devel
      - swig
      - libjpeg-turbo
      - libjpeg-turbo-devel
      - libpng
      - libpng-devel
      - freetype
      - freetype-devel
      - libxml2
      - libxml2-devel
      - zlib
      - zlib-devel
      - libcurl
      - libcurl-devel

php-source-install:
  file.managed:
    - name: /usr/local/src/php-5.6..tar.gz
    - source: salt://modules/php/files/php-5.6.9.tar.gz
    - user: root
    - gourp: root
    - mode:
  cmd.run:
    - name: cd /usr/local/src && tar -zxf php-5.6..tar.gz && cd php-5.6. && ./configure --prefix=/usr/local/php -with-pdo-mysql=mysqlnd --with-mysqli=mysqlnd --with-mysql=mysqlnd --with-jpeg-dir --with-png-dir --with-zlib --enable-xml  --with-libxml-dir --with-curl --enable-bcmath --enable-shmop --enable-sysvsem  --enable-inline-optimization --enable-mbregex --with-openssl --enable-mbstring --with-gd --enable-gd-native-ttf --with-freetype-dir=/usr/lib64 --with-gettext=/usr/lib64 --enable-sockets --with-xmlrpc --enable-zip --enable-soap --disable-debug --enable-opcache --enable-zip --with-config-file-path=/usr/local/php-fastcgi/etc --enable-fpm --with-fpm-user=www --with-fpm-group=www && make && make install
    - require:
      - file: php-source-install
      - user: www-user-group
    - unless: test -d /user/local/php

php-ini:
  file.managed:
    - name: /usr/local/php/etc/php.ini
    - source: salt://modules/php/files/php.ini-production
    - user: root
    - group: root
    - mode: 

php-fpm:
  file.managed:
    - name: /usr/local/php/etc/php-fpm.conf
    - source: salt://modules/php/files/php-fpm.conf.default
    - user: root
    - group: root
    - mode: 

php-service:
  file.managed:
   - name: /etc/init.d/php-fpm
   - source: salt://modules/php/files/init.d.php-fpm
   - user: root
   - group: root
   - mode:
  cmd.run:
    - name: chkconfig --add php-fpm
    - unless: chkconfig --list | grep php-fpm
    - require:
      - file: php-service
  service.running:
    - name: php-fpm
    - enable: True
    - reload: True
    - require:
      - file: php-ini
      - file: php-fpm
      - file: php-service
      - cmd: php-service

统一使用的功能都抽象成一个模块，如安装以及基本配置（nginx中包含include，php中包含的include，那么就可以将nginx.conf放在功能模块，而虚拟主机配置文件，可以放在业务模块）。 
其它配置和服务启动可以抽象在一个业务模块，每一个业务都是使用不同的配置文件。

服务全部使用www用户，统一id，只开放8080端口，对于web服务只开放ssh的8022端口以及web的8080端口。其余不用的端口一律不开启

这里将nginx，php都抽象成一个模块，把安装和基础配置都放在了modules中，在nginx衍生的业务模块web目录下，做一个bbs的虚拟主机。

[root@linux-node1 base]# vim top.sls
prod:
  '*':
    - web.bbs
[root@linux-node1 base]# salt '*' state.highstate