SaltStack简介
SaltStack作为开源的自动化批量管理工具，功能很强大，在生产环境中也有很多的企业/公司使用，那么如果每次执行都在SaltStack Master上去通过Salt命令执行sls文件或者Salt的其它命令就显得很麻烦，那么我们可以使用Salt提供的API，那么它的API分为local_client和REST API 两种
两种api的区别
- local_client
- 调用该api必须要在salt master上运行
- 它是salt的python模块，即salt自带的python api
- 依赖于python
- RESTful API
- 调用该api的机器可以是任意的计算机系统
- 基于HTTPS的请求，即任何语言，只需要按照该api的标准，get或者post数据就可以执行salt的相应的操作
- 官方支持三种RESTful API， 分别是rest_cherry; rest_tonado和rest_wsgi
- rest_cherry和rest_tonado两个模块支持监听所有的IP的指定端口接收请求
- rest_wsgi只支持本机访问，只绑定了127.0.0.1
再次声明为何使用RESTful API？
local_client必须依赖于python去调用，必须还得把该python脚本放到salt master本地执行，但是RESTful API支持任意语言调用，因为它是基于https，七层协议
[基于rest_cherry RESTful_API官网](https://docs.saltstack.com/en/latest/ref/netapi/all/salt.netapi.rest_cherrypy.html#authentication)
注意：本文选择使用rest_cherry模块来实现SaltStack的HTTP API
1、Salt_Master 安装和设置salt-api
1.安装salt-api，并设置开机启动
[root@linux-node1 ~]# yum -y install salt-api pyOpenSSL [root@linux-node1 ~]# systemctl enable salt-api
2.配置自签名证书
[root@linux-node1 ~]# cd /etc/pki/tls/certs/ [root@linux-node1 certs]# make testcert umask 77 ; /usr/bin/openssl genrsa -aes128 2048 > /etc/pki/tls/private/localhost.key Generating RSA private key, 2048 bit long modulus .......+++ ................................+++ e is 65537 (0x10001) Enter pass phrase: # 输入加密密码，这里我使用123456 Verifying - Enter pass phrase: # 确认加密密码 umask 77 ; /usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt Enter pass phrase for /etc/pki/tls/private/localhost.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Guangdong Locality Name (eg, city) [Default City]:guangzhou Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []: Email Address []: // 解密key文件，生成无密码的key文件, 过程中需要输入key密码，该密码为之前生成证书时设置的密码 [root@linux-node1 ~]# cd /etc/pki/tls/private/ [root@linux-node1 private]# openssl rsa -in localhost.key -out localhost_nopass.key
3.创建普通用户
[root@linux-node1 ~]# useradd saltapi -M -s /sbin/nologin // 为新建的saltapi用户设置密码 [root@linux-node1 ~]# echo "salt123456" |passwd --stdin saltapi
4.修改/etc/salt/master文件
[root@linux-node1 ~]# sed -i '/#default_include/s/#default/default/g' /etc/salt/master
5.创建/etc/salt/master.d/目录
[root@linux-node1 ~]# mkdir -p /etc/salt/master.d/ [root@linux-node1 ~]# cd /etc/salt/master.d/ [root@linux-node1 ~]# touch eauth.conf && touch api.conf
• 编辑eauth.conf，添加下面内容
external_auth: pam: # 可插入式验证模块 saltapi: # 用户 - .* # 该配置文件给予saltapi用户所有模块使用权限，出于安全考虑一般只给予特定模块使用权限 - '@wheel' # 查看salt-key权限 - '@runner' # 查看minion是否存活权限
• 编辑api.conf，添加下面内容
rest_cherrypy: port: 8001 ssl_crt: /etc/pki/tls/certs/localhost.crt ssl_key: /etc/pki/tls/private/localhost_nopass.key
6.启动salt-api
$ systemctl restart salt-master $ systemctl start salt-api $ ps -ef|grep salt-api $ netstat -lnput|grep 8001
7.测试请求salt-api的token
$ curl -k https://10.0.0.170:8001/login -H 'Accept: application/x-yaml' -d username=saltapi -d password=salt123456 -d eauth=pam return: - eauth: pam expire: 1556680076.98615 perms: - .* - '@wheel' - '@runner' start: 1556636876.986149 token: 8b3d2a0d9b7708a599173ecd072834321c9d4187 user: saltapi
2、基于python调用REST API
import requests import json # 使用urllib2请求https出错，做的设置 import ssl context = ssl._create_unverified_context() # 移除https警告 requests.packages.urllib3.disable_warnings() salt_api = "https://10.0.0.170:8001/" class SaltApi: """ 定义salt api接口的类 初始化获得token """ def __init__(self, url): self.url = url self.username = "saltapi" self.password = "salt123456" self.headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36", "Content-type": "application/json" } self.params = {'client': 'local', 'fun': '', 'tgt': ''} self.login_url = salt_api + "login" # https://10.0.0.170:8001/login # 将salt api的用户名和密码，认证方式封装到get参数里 self.login_params = {'username': self.username, 'password': self.password, 'eauth': 'pam'} # 将salt url以及封装的参数，传给get_data函数执行，并获取token self.token = self.get_data(self.login_url, self.login_params).get('token') # 将token值添加到headers里的X-Auth-Token字段（每次对象执行的时候都会先获取到token，将其赋值给 self.headers['X-Auth-Token'] ） self.headers['X-Auth-Token'] = self.token def get_data(self, url, params): ''' 执行post或get请求，并返回执行结果 :param url: api url地址 :param params: post传入的参数 :return: ''' # 必须将 params 携带的参数转换成json格式，才能获得到json格式的返回结果（这是salt的规定） if params: # params 不为空执行post方法 send_data = json.dumps(params) request = requests.post(url, data=send_data, headers=self.headers, verify=False) response = request.json() result = dict(response) return result['return'][0] # 返回结果 elif params is None: # params 为空执行get方法 request = requests.get(url, headers=self.headers, verify=False) response = request.json() result = dict(response) return result['return'][0] # 返回结果 def get_jobs(self,jid): ''' get方法去获取对应jid的任务执行结果 :param jid: 接收任务ID/jobs ID :return: ''' jobs_url = self.url + "jobs/" +jid result = self.get_data(jobs_url,params=None) return result def salt_command(self, tgt, method, arg=None): """ 直接执行salt命令, 远程执行命令，相当于salt 'client1' cmd.run 'free -m', :param tgt: 目标主机 例如(linux-node1 / linux-* / *) :param method: 执行的模块 例如(test.ping / cmd.run) :param arg: 执行的模块参数 例如(cmd.run -m "df -h") :return: """ if arg: params = {'client': 'local', 'fun': method, 'tgt': tgt, 'arg': arg} else: params = {'client': 'local', 'fun': method, 'tgt': tgt} result = self.get_data(self.url, params) return result def salt_sls(self,tgt,mods,pillar=None,saltenv='base'): """ 执行salt的sls文件，支持pillar变量和纯sls文件 :param tgt: 目标主机 :param mods: sls文件名，（test.sls == > test），去掉结尾的sls :param pillar: 传给文件的pillar变量值 :param saltenv: sls的环境变量，这里默认为base，如果你有dev、test等，就可以自己传入 :return: """ if pillar: # 如果pillar传了参数，则执行下面的代码 data = { 'mods': mods, 'saltenv': saltenv, 'pillar': pillar, "concurrent": True } elif pillar is None: # 如果pillar 为None，则执行下面代码 data = { 'mods': mods, 'saltenv': saltenv, "concurrent": True } params = {'client': 'local', 'fun': 'state.sls', 'tgt':tgt,'kwarg':data} result = self.get_data(self.url, params) return result def salt_async_command(self, tgt, method, arg=None): """ 异步执行salt命令，只会返回任务id 即jid """ if arg: params = {'client': 'local_async', 'fun': method, 'tgt': tgt, 'arg': arg} else: params = {'client': 'local_async', 'fun': method, 'tgt': tgt} # 将返回的jid传给 self.get_data 函数执行并获取该jid的执行结果 jid_result = self.get_data(self.url, params) jid = jid_result['jid'] result = self.get_jobs(jid) return result def salt_async_sls(self,tgt,mods,pillar=None,saltenv='base'): """ 异步执行salt的sls文件，返回jib """ if pillar: # 如果pillar传了参数，则执行下面的代码 data = { 'mods': mods, 'saltenv': saltenv, 'pillar': pillar, "concurrent": True } elif pillar is None: # 如果pillar 为None，则执行下面代码 data = { 'mods': mods, 'saltenv': saltenv, "concurrent": True } params = {'client': 'local_async', 'fun': 'state.sls', 'tgt':tgt,'kwarg':data} # 将返回的jid传给 self.get_data 函数执行并获取该jid的执行结果 jid_result = self.get_data(self.url, params) jid = jid_result['jid'] result = self.get_jobs(jid) return result def get_minion_status(self): """ 判断当前sallt管理的minion是否存活，并获取返回结果 :return: """ method = "manage.status" params = {'client': 'runner','fun': method,} result = self.get_data(self.url, params) return result def get_grains(self,tgt, arg=None): """ 执行grains """ if arg: # 如果arg传入参数，执行下面代码，获取到对应的grains结果 method = "grains.get" params = {'client': 'local', 'fun': method, 'tgt': tgt, 'arg': arg} elif arg is None: # 如果arg为None，执行下面代码，获取到grains的所有结果 method = "grains.items" params = {'client': 'local', 'fun': method, 'tgt': tgt} result = self.get_data(self.url, params) return result def salt_evens(self): """ salt事件监听， :return: """ events_url = self.url + "/events" result = self.get_data(events_url,params=None) print(self.url) return result def salt_main(): try: salt = SaltApi(salt_api) return salt except Exception as e: raise print('saltstack api连接异常') # 实例化 salt = salt_main() # 执行sls命令 def x1(): result = salt.salt_command('*','cmd.run','df -h') print(result) # 检测已添加的minion是否存活 def x2(): result = salt.get_minion_status() print(result) # 测试salt执行sls def x3(): pillar = {'name':'ok'} result = salt.salt_sls('*', 't2',pillar) # result = salt.salt_sls('*','t2') print(result) # 执行grains def x4(): # result = salt.get_grains('*','ip_interfaces') # 获取所有主机指定的grains信息 result = salt.get_grains('*') # 获取所有主机的grains信息 print(result) # 异步 执行salt命令 def x5(): result = salt.salt_async_command('*', 'cmd.run', 'df -h') print(result) # 异步 执行salt sls def x6(): pillar = {'name':'ok'} result = salt.salt_async_sls('*', 't2',pillar) # result = salt.salt_sls('*','t2') print(result) # 执行salt事件监听 def x7(): result = salt.salt_evens() print(result)