saltstack api安装使用

Salt自然也是提供api的，使用api对自动化有极大的帮助，我们使用rest风格的api，当然大家都知道salt是python写的，那么自然也就提供了对应的api，但是并不建议使用，因为调用python api的程序是必须运行在master上的，并且此api对python3并不友好

 [root@linux-node1 ~]# yum install pyOpenSSL salt-api –y
 [root@linux-node1 ~]# salt-call --local tls.create_self_signed_cert
 local:
 Created Private Key: "/etc/pki/tls/certs/localhost.key." Created Certificate: "/etc/pki/tls/certs/localhost.crt."
 [root@linux-node1 ~]# vim /etc/salt/master
 [root@linux-node1 ~]# grep "^[a-Z]" /etc/salt/master
 default_include: master.d/*.conf                    # 打开这个
 file_roots:
 [root@linux-node1 master.d]# cd /etc/salt/master.d/
 [root@linux-node1 master.d]# cat api.conf                 # 定义key存放位置与提供端口
 rest_cherrypy:
   port: 8000
   ssl_crt: /etc/pki/tls/certs/localhost.crt
   ssl_key: /etc/pki/tls/certs/localhost.key
 [root@linux-node1 master.d]# cat auth.conf             # 定义权限
 external_auth:
   pam:
     saltapi:
       - .*
       - '@wheel'
       - '@runner'
       - '@wheel'

 [root@linux-node1 master.d]# systemctl restart salt-master.service
 [root@linux-node1 master.d]# systemctl restart salt-api
 [root@linux-node1 master.d]# netstat -tpln
 Active Internet connections (only servers)
 Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
 tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd
 tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      998/sshd
 tcp        0      0 0.0.0.0:4505            0.0.0.0:*               LISTEN      92795/python
 tcp        0      0 0.0.0.0:4506            0.0.0.0:*               LISTEN      92801/python
 tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      93821/python
 tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd
 tcp6       0      0 :::22                   :::*                    LISTEN      998/sshd
 [root@linux-node1 master.d]# useradd -M -s /sbin/nologin saltapi        # 正式环境指定guid
 [root@linux-node1 master.d]# passwd saltapi
 Changing password for user saltapi.
 New password:
 BAD PASSWORD: The password is shorter than 8 characters
 Retype new password:
 passwd: all authentication tokens updated successfully.

换台机器测试一下

 [root@linux-node2 tmp]# curl -sSk https://192.168.56.11:8000/login \
 >     -H 'Accept: application/x-yaml' \                        # 返回yaml格式，读直观
 >     -d username='saltapi' \
 >     -d password='saltapi' \
 >     -d eauth='pam'                                        # 认证模式是pam
 return:
 - eauth: pam
   expire: 1511276286.304869                                # 该token过期时间
   perms: {}
   start: 1511233086.304869
   token: 9374cd95e861ba80cda73375b50917446d7a45f2            # 这个很重要
   user: saltapi
 [root@linux-node2 tmp]# curl -sSk https://192.168.56.11:8000 \
 >     -H 'Accept: application/x-yaml' \
 >     -H 'X-Auth-Token: 9374cd95e861ba80cda73375b50917446d7a45f2'\        # token
 >     -d client=local \
 >     -d tgt='*' \
 >     -d fun=test.ping
 return:                                            # 返回的信息很直观
 - linux-node1.example.com: true
  linux-node2.example.com: true
 [root@linux-node3 ~]# curl -sSk https://192.168.56.11:8000/login \
 >     -H 'Accept: application/json' \                    # 返回json格式，容易解析
 >     -d username='saltapi' \
 >     -d password='saltapi' \
 >     -d eauth=pam
 {"return": [{"perms": [".*"], "start": 1511235669.459298, "token": "9374cd95e861ba80cda73375b50917446d7a45f2'", "expire": 1511278869.459298, "user": "saltapi", "eauth": "pam"}]}
 [root@linux-node3 ~]# curl -sSk https://192.168.56.11:8000 \
 >     -H 'Accept: application/json' \
 >     -H 'X-Auth-Token: 9374cd95e861ba80cda73375b50917446d7a45f2'\
 >     -d client=local \
 >     -d tgt='*' \
 >     -d fun=test.ping
 {"return": [{"linux-node1.example.com": true, "linux-node2.example.com": true}]}

然后就可以使用小北方的api啦

http://www.cnblogs.com/bfmq/p/7905044.html