自动化运维Saltstack系列（六）之配置管理系统模块
架构图Saltstack配置管理大型web架构网站其实并不是很难，最主要是合理管理各功能模块之间依赖关系，尽量独立各功能模块，让每一个系统功能都可以被业务引用。
Saltstack环境目录
1
2
3
4
5
6
7
8
9
10
file_roots:
base:
- /srv/salt/base
prod:
- /srv/salt/prod
pillar_roots:
base:
- /srv/pillar/base
prod:
- /srv/pillar/prod
Saltstack目录结构
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# tree
.
├── pillar
│ ├── base
│ │ ├── top.sls
│ │ └── zabbix
│ │ └── agent.sls
│ └── prod
└── salt
├── base
│ ├── _grains
│ │ └── my_grain.py
│ ├── init
│ │ ├── audit.sls
│ │ ├── dns.sls
│ │ ├── epel.sls
│ │ ├── files
│ │ │ ├── resolv.conf
│ │ │ └── zabbix_agentd.conf
│ │ ├── history.sls
│ │ ├── init.sls
│ │ ├── sysctl.sls
│ │ └── zabbix-agent.sls
│ ├── _modules
│ │ └── my_disk.py
│ └── top.sls
└── prod
├── bbs
│ ├── files
│ │ └── nginx-bbs.conf
│ ├── memcached.sls
│ └── web.sls
├── cluster
│ ├── files
│ │ ├── haproxy-outside.cfg
│ │ └── haproxy-outside-keepalived.conf
│ ├── haproxy-outside-keepalived.sls
│ └── haproxy-outside.sls
└── modules
├── haproxy
│ ├── files
│ │ ├── haproxy-1.6.3.tar.gz
│ │ └── haproxy.init
│ └── install.sls
├── keepalived
│ ├── files
│ │ ├── keepalived-1.2.17.tar.gz
│ │ ├── keepalived.init
│ │ └── keepalived.sysconfig
│ └── install.sls
├── libevent
│ ├── files
│ │ └── libevent-2.0.22-stable.tar.gz
│ └── install.sls
├── memcached
│ ├── files
│ │ └── memcached-1.4.24.tar.gz
│ └── install.sls
├── nginx
│ ├── files
│ │ ├── nginx-1.9.1.tar.gz
│ │ ├── nginx.conf
│ │ └── nginx-init
│ ├── install.sls
│ └── service.sls
├── pcre
│ ├── files
│ │ └── pcre-8.37.tar.gz
│ └── install.sls
├── php
│ ├── files
│ │ ├── init.d.php-fpm
│ │ ├── memcache-2.2.7.tgz
│ │ ├── php-5.6.9.tar.gz
│ │ ├── php-fpm.conf
│ │ ├── php.ini-production
│ │ └── redis-2.2.7.tgz
│ ├── install.sls
│ ├── php-memcache.sls
│ └── php-redis.sls
├── pkg
│ └── make-pkg.sls
├── user
│ └── www.sls
└── web
├── bbs.sls
└── files
└── bbs.conf
环境初始化1）历史命令优化添加用户、时间信息
1
2
3
4
5
# vim history.sls
/etc/profile:
file.append:
- text:
- export HISTTIMEFORMAT="%F %T `whoami` "
2）历史命令添加日志审计
1
2
3
4
5
# vim audit.sls
/etc/bashrc:
file.append:
- text:
- export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; });logger "":$(who am i):[`pwd`]"$msg"; }'
3）统一DNS
1
2
3
4
5
6
7
# vim dns.sls
/etc/resolv.conf:
file.managed:
- source: salt://init/files/resolv.conf
- user: root
- gourp: root
- mode: 644
4）自定义epel源（这里可以换成自己的yum仓库地址）
1
2
3
4
5
6
# vim epel.sls
yum_repo_release:
pkg.installed:
- sources:
- epel-release: http://mirrors.aliyun.com/epel/epel-release-latest-7.noarch.rpm
- unless: rpm -qa | grep epel-release-7
5）系统初始优化
1
2
3
4
5
6
7
8
9
10
11
12
13
# vim sysctl.sls
net.ipv4.ip_local_port_range:
sysctl.present:
- value: 10000 65000
fs.file-max:
sysctl.present:
- value: 2000000
net.ipv4.ip_forward:
sysctl.present:
- value: 1
vm.swappiness:
sysctl.present:
- value: 0
6）zabbix-agents配置
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
# vim zabbix-agent.sls
zabbix-agent:
pkg.installed:
- name: zabbix-agent
file.managed:
- name: /etc/zabbix/zabbix_agentd.conf
- source: salt://init/files/zabbix_agentd.conf
- template: jinja
- backup: minion
- defaults:
Zabbix_Server: {{ pillar['Zabbix_Server'] }}
Hostname: {{ grains['fqdn'] }}
- require:
- pkg: zabbix-agent
service.running:
- enable: True
- watch:
- pkg: zabbix-agent
- file: zabbix-agent
zabbix_agentd.conf.d:
file.directory:
- name: /etc/zabbix/zabbix_agentd.d
- watch_in:
- service: zabbix-agent
- require:
- pkg: zabbix-agent
- file: zabbix-agent
7）合计初始化功能
# vim init.sls
include:
- init.dns
- init.history
- init.audit
- init.epel
- init.sysctl
- init.zabbix-agent
业务模块业务模块目录
1
2
3
4
5
6
# cd /srv/salt/prod/
# ll
total 0
drwxr-xr-x3 root root52 Sep 28 17:28 bbs
drwxr-xr-x3 root root81 Sep 28 17:28 cluster
drwxr-xr-x 12 root root 132 Sep 28 17:28 modules
服务部署安装模块
1
2
3
4
5
6
7
8
9
10
11
12
13
# cd modules/
# ll
total 0
drwxr-xr-x 3 root root 36 Sep 28 17:28 haproxy
drwxr-xr-x 3 root root 36 Sep 28 17:28 keepalived
drwxr-xr-x 3 root root 36 Sep 28 17:28 libevent
drwxr-xr-x 3 root root 36 Sep 28 17:28 memcached
drwxr-xr-x 3 root root 54 Sep 28 17:28 nginx
drwxr-xr-x 3 root root 36 Sep 28 17:28 pcre
drwxr-xr-x 3 root root 79 Sep 28 17:28 php
drwxr-xr-x 2 root root 25 Sep 28 17:28 pkg
drwxr-xr-x 2 root root 20 Sep 28 17:28 user
drwxr-xr-x 3 root root 32 Sep 28 17:28 web
1）安装系统必要组件包
1
2
3
4
5
6
7
8
9
10
11
12
13
# vim make-pkg.sls
make-pkg:
pkg.installed:
- pkgs:
- gcc
- gcc-c++
- glibc
- make
- autoconf
- openssl
- openssl-devel
- pcre
- pcre-devel
2）安装Haproxy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
# vim install.sls
include:
- modules.pkg.make-pkg
haproxy-install:
file.managed:
- name: /usr/local/src/haproxy-1.6.3.tar.gz
- source: salt://modules/haproxy/files/haproxy-1.6.3.tar.gz
- mode: 755
- user: root
- group: root
cmd.run:
- name: cd /usr/local/src && tar xf haproxy-1.6.3.tar.gz && cd haproxy-1.6.3 && make TARGET=2628 PREFIX=/usr/local/haproxy-1.6.3 && make install PREFIX=/usr/local/haproxy-1.6.3 && ln -s /usr/local/haproxy-1.6.3 /usr/local/haproxy
- require:
- pkg: make-pkg
- file: haproxy-install
- unless: test -d /usr/local/haproxy
haproxy-init:
file.managed:
- name: /etc/init.d/haproxy
- source: salt://modules/haproxy/files/haproxy.init
- mode: 755
- user: root
- group: root
- require_in:
- file: haproxy-install
cmd.run:
- name: chkconfig --add haproxy
- unless: chkconfig --list|grep haproxy
net.ipv4.ip_nonlocal_bind:
sysctl.present:
- value: 1
/etc/haproxy:
file.directory:
- user: root
- group: root
- mode: 755
3）安装keepalived
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# vim install.sls
{% set keepalived_tar = 'keeplived-1.2.17.tar.gz' %}
{% set keepalived_source = 'salt://modules/keepalived/files/keepalived-1.2.17.tar.gz' %}
keepalived-install:
file.managed:
- name: /usr/local/src/{{ keepalived_tar }}
- source: {{ keepalived_source }}
- mode: 755
- user: root
- group: root
cmd.run:
- name: cd /usr/local/src && tar zxf keepalived-1.2.17.tar.gz && cd keepalived-1.2.17 && ./configure --prefix=/usr/local/keepalived --disable-fwmark && make && make install
- unless: test -d /usr/local/keepalived
- require:
- file: keepalived-install
/etc/sysconfig/keepalived:
file.managed:
- source: salt://modules/keepalived/files/keepalived.sysconfig
- mode: 644
- user: root
- group: root
/etc/init.d/keepalived:
file.managed:
- source: salt://modules/keepalived/files/keepalived.init
- mode: 755
- user: root
- group: root
keepalived-init:
cmd.run:
- name: chkconfig --add keepalived
- unless: chkconfig --list | grep keepalived
- require:
- file: /etc/init.d/keepalived
/etc/keepalived:
file.directory:
- user: root
- group: root
4）libevent安装
1
2
3
4
5
6
7
8
9
10
11
12
13
# vim install.sls
libevent-source-install:
file.managed:
- name: /usr/local/src/libevent-2.0.22-stable.tar.gz
- source: salt://modules/libevent/files/libevent-2.0.22-stable.tar.gz
- user: root
- group: root
- mode: 644
cmd.run:
- name: cd /usr/local/src && tar zxf libevent-2.0.22-stable.tar.gz && cd libevent-2.0.22-stable &&./configure --prefix=/usr/local/libevent && make && make install
- unless: test -d /usr/local/libevent
- require:
- file: libevent-source-install
5）安装pcre
1
2
3
4
5
6
7
8
9
10
11
12
13
# vim install.sls
pcre-source-install:
file.managed:
- name: /usr/local/src/pcre-8.37.tar.gz
- source: salt://modules/pcre/files/pcre-8.37.tar.gz
- user: root
- group: root
- mode: 755
cmd.run:
- name: cd /usr/local/src && tar zxf pcre-8.37.tar.gz && cd pcre-8.37 && ./configure --prefix=/usr/local/pcre && make && make install
- unless: test -d /usr/local/pcre
- require:
- file: pcre-source-install
6）Nginx安装
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# vim install.sls
include:
- modules.pcre.install
- modules.user.www
nginx-source-install:
file.managed:
- name: /usr/local/src/nginx-1.9.1.tar.gz
- source: salt://modules/nginx/files/nginx-1.9.1.tar.gz
- user: root
- group: root
- mode: 755
cmd.run:
- name: cd /usr/local/src && tar zxf nginx-1.9.1.tar.gz && cd nginx-1.9.1&& ./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_ssl_module --with-http_stub_status_module --with-file-aio --with-http_dav_module --with-pcre=/usr/local/src/pcre-8.37 && make && make install && chown -R www:www /usr/local/nginx
- unless: test -d /usr/local/nginx
- require:
- user: www-user-group
- file: nginx-source-install
- pkg: make-pkg
- cmd: pcre-source-install
Nginx服务配置
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# vim service.sls
include:
- modules.nginx.install
nginx-init:
file.managed:
- name: /etc/init.d/nginx
- source: salt://modules/nginx/files/nginx-init
- mode: 755
- user: root
- group: root
cmd.run:
- name: chkconfig --add nginx
- unless: chkconfig --list | grep nginx
- require:
- file: nginx-init
/usr/local/nginx/conf/nginx.conf:
file.managed:
- source: salt://modules/nginx/files/nginx.conf
- user: www
- group: www
- mode: 644
nginx-service:
file.directory:
- name: /usr/local/nginx/conf/vhost_online
- require:
- cmd: nginx-source-install
service.running:
- name: nginx
- enable: True
- reload: True
- require:
- cmd: nginx-init
- watch:
- file: /usr/local/nginx/conf/nginx.conf
7）统一用户
1
2
3
4
5
6
7
8
9
10
11
# vim www.sls
www-user-group:
group.present:
- name: www
- gid: 1000
user.present:
- name: www
- fullname: www
- shell: /sbin/nologin
- uid: 1000
- gid: 1000
8)安装memcache
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# vim install.sls
include:
- modules.libevent.install
memcached-source-install:
file.managed:
- name: /usr/local/src/memcached-1.4.24.tar.gz
- source: salt://modules/memcached/files/memcached-1.4.24.tar.gz
- user: root
- group: root
- mode: 644
cmd.run:
- name: cd /usr/local/src && tar zxf memcached-1.4.24.tar.gz && cd memcached-1.4.24&& ./configure --prefix=/usr/local/memcached --enable-64bit --with-libevent=/usr/local/libevent && make && make install
- unless: test -d /usr/local/memcached
- require:
- cmd: libevent-source-install
- file: memcached-source-install
页:
[1]