saltstack（三） --- salt-httpapi

以下操作均在master上操作

1. 安装api

netapi modules（httpapi）有三种，分别是rest_cherrypy、rest_tornado、rest_wsig，接下来要讲的是rest_cherrypy

doc：https://docs.saltstack.com/en/latest/ref/netapi/all/salt.netapi.rest_cherrypy.html

yum install -y salt-api
pip install cherrypy

2. 生成证书

[root@localhost ~]# yum install -y openssl
[root@localhost ~]# cd /etc/salt/
[root@localhost salt]# mkdir keycrt
[root@localhost salt]# cd keycrt/
[root@localhost keycrt]# openssl genrsa -out key.pem 4096
[root@localhost keycrt]# openssl req -new -x509 -key key.pem -out cert.pem -days 1826

3. 配置salt-api的配置文件

[root@localhost keycrt]# cd /etc/salt/master.d/
[root@localhost master.d]# cat api.conf
rest_cherrypy:                                            //还有好多可以写的参数，参考docport: 8000ssl_crt: /etc/salt/keycrt/cert.pemssl_key: /etc/salt/keycrt/key.pem------------------------------------------------------>
[root@localhost master.d]# cat eauth.conf
external_auth:pam:saltapi:                                           //认证的用户名- .*- '@wheel'- '@runner'----------------------------------------------------->      //创建用户名
[root@localhost master.d]# useradd -M -s /sbin/nologin saltapi
[root@localhost master.d]# echo "saltapi" |passwd saltapi --stdin

4. 启动api

[root@localhost master.d]# systemctl restart salt-master
[root@localhost master.d]# systemctl start salt-api
[root@localhost master.d]# netstat -lnp |grep 8000
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      36821/python

5. 获取token

# Time (in seconds) for a newly generated token to live. Default: 12 hours

#token_expire: 43200

#token有效期为12个小时，可以在master配置文件更改

5.1 https方式

[root@localhost master.d]# curl -X POST -k https://192.168.123.106:8000/login -d username='saltapi' -d password='saltapi' -d eauth='pam' |python -m json.tool% Total    % Received % Xferd  Average Speed   Time    Time     Time  CurrentDload  Upload   Total   Spent    Left  Speed
100   240  100   197  100    43   1450    316 --:--:-- --:--:-- --:--:--  1459
{"return": [{"eauth": "pam","expire": 1517772071.637639,"perms": [".*","@wheel","@runner"],"start": 1517728871.637638,"token": "55d8ccc1ab3f8ba069b6fbe21cae1686c4d5823e","user": "saltapi"}]
}

通过工具postman提交post请求，基本上是图片，懒得贴了

5.2 http方式

显式禁用证书验证，不需要生成证书

[root@localhost master.d]# cat api.conf     //更改配置文件
rest_cherrypy:port: 8000disable_ssl: True
#  ssl_crt: /etc/salt/keycrt/cert.pem
#  ssl_key: /etc/salt/keycrt/key.pem-------------------------------------------------------------->
[root@localhost master.d]# systemctl restart salt-master
[root@localhost master.d]# systemctl restart salt-api------------------------------------------------------------->
[root@localhost master.d]# curl -X POST -k http://192.168.123.106:8000/login -d username='saltapi' -d password='saltapi' -d eauth='pam' |python -m json.tool% Total    % Received % Xferd  Average Speed   Time    Time     Time  CurrentDload  Upload   Total   Spent    Left  Speed
100   240  100   197  100    43   2594    566 --:--:-- --:--:-- --:--:--  2626
{"return": [{"eauth": "pam","expire": 1517774657.797506,"perms": [".*","@wheel","@runner"],"start": 1517731457.797506,"token": "62dbdca57f854b624802d44601426808c8855b3c","user": "saltapi"}]
}

6. 执行模块

[root@localhost master.d]# curl -X POST -k https://192.168.123.106:8000/login -d username='saltapi' -d password='saltapi' -d eauth='pam' |python -m json.tool% Total    % Received % Xferd  Average Speed   Time    Time     Time  CurrentDload  Upload   Total   Spent    Left  Speed
100   240  100   197  100    43   1281    279 --:--:-- --:--:-- --:--:--  1287
{"return": [{"eauth": "pam","expire": 1517775225.766237,"perms": [".*","@wheel","@runner"],"start": 1517732025.766237,"token": "3643e2f1b04e3280e1aa9cffec9eaaab98feff13","user": "saltapi"}]
}[root@localhost master.d]# curl -X POST -k https://192.168.123.106:8000 -H 'Accept: application/x-yaml' -H 'X-Auth-Token: 3643e2f1b04e3280e1aa9cffec9eaaab98feff13' -d client='local' -d tgt='*' -d fun='test.ping'
return:
- 192.168.123.107: true[root@localhost master.d]# curl -X POST -k https://192.168.123.106:8000 -H 'Accept: application/x-yaml' -H 'X-Auth-Token: 3643e2f1b04e3280e1aa9cffec9eaaab98feff13' -d client='local' -d tgt='*' -d fun='cmd.run' -d arg='uptime'
return:
- 192.168.123.107: ' 16:22:24 up 1 day,  1:40,  2 users,  load average: 0.00, 0.01,0.05'

7. 执行runner

[root@localhost master.d]# curl -X POST -k https://192.168.123.106:8000 -H 'Accept: application/x-yaml' -H 'X-Auth-Token: 3643e2f1b04e3280e1aa9cffec9eaaab98feff13' -d client='runner' -d fun='manage.status'
return:
- down: []up:- 192.168.123.107

_modules:

[root@bogon _modules]# cat jd.py
#!/usr/bin/env pythonimport codecsdef hello(key ,value, param):return {'key': key, 'value': value, 'param': param}def world(name):return {'name': name}def meminfo():with codecs.open('/proc/meminfo') as fd:for line in fd:if line.startswith('MemAvailable'):result = str(int(line.split()[1])/1024.0) + 'M'return {'MemAvailable': result}

_runner:

[root@bogon _runner]# cat testparam.py
#!/usr/bin/env pythonimport time
import salt.clientdef get(minion, function, params):__opts__ = salt.config.client_config('/etc/salt/master')conf_file = __opts__['conf_file']localclient = salt.client.LocalClient(conf_file)jid = localclient.cmd_async(minion, function, params.split(','))wait_time = 0sleep_interval = 1while wait_time < __opts__['timeout']:print('wait {0} seconds'.format(wait_time))result = localclient.get_cache_returns(jid)if result:print(type(result))return resulttime.sleep(sleep_interval)wait_time += sleep_intervaldef get_no_param(minion, function):__opts__ = salt.config.client_config('/etc/salt/master')conf_file = __opts__['conf_file']localclient = salt.client.LocalClient(conf_file)jid = localclient.cmd_async(minion, function)wait_time = 0sleep_interval = 1while wait_time < __opts__['timeout']:print('wait {0} seconds'.format(wait_time))result = localclient.get_cache_returns(jid)if result:print(type(result))return resulttime.sleep(sleep_interval)wait_time += sleep_interval

8. 判断token是否过期

携带token访问https://192.168.123.106/stats，如果状态码为200，token没过期，状态码为401，token过期

转载于:https://www.cnblogs.com/tobeone/p/8434946.html

saltstack（三） --- salt-httpapi相关推荐

ansible puppet saltstack三款自动化运维工具的对比
一.基础介绍 ansible基础介绍可参考:http://www.linuxidc.com/Linux/2017-12/149671.htm puppet基础介绍可参考:http://www.linu ...
详述SaltStack Salt 命令注入漏洞（CVE-2020-16846/25592）
聚焦源代码安全,网罗国内外最新资讯! 编译:奇安信代码卫士团队 11月3日,SaltStack 发布 Salt 安全补丁,修复了三个严重漏洞,其中两个是为了回应起初通过 ZDI 报告的5个 bug. ...
saltstack的基础入门文档
摘要 saltstack 和 Puppet Chef 一样可以让你同时在多台服务器上执行命令也包括安装和配置软件.Salt 有两个主要的功能:配置管理和远程执行. 这里讲述了saltstack的基本使 ...
自动化运维之SaltStack实践
自动化运维之SaltStack实践 1.1.环境 linux-node1(master服务端) 192.168.0.15 linux-node2(minion客户端) 192.168.0.16 1.2 ...
saltstack 基础入门文档
saltstack 和 Puppet Chef 一样可以让你同时在多台服务器上执行命令也包括安装和配置软件.Salt 有两个主要的功能:配置管理和远程执行.这里讲述了saltstack的基本使用方法. ...
SaltStack技术入门与实践
第1章 SaltStack入门 1.2.1 SaltStack软件依赖 SaltStack有两种消息系统,一种是REAT,一种是ZeroMQ,默认使用ZeroMQ. 软件依赖列表如下: ●Python ...
企业 Saltstack安装配置及远程推送
文章目录 Saltstack 概述通信机制安装与配置安装设置官方YUM仓库安装进行配置 Saltstack远程执行操作远程指令操作编写远程执行模块文件来控制minion 模块使用远程执 ...
自动化运维批量管理saltstack
让运维的日常工作--实现自动化 0)需求分析 1)机房设备上下架 2)系统初始化 3)应用环境初始化 4)应用部署调试配置 5)代码的发布 6)服务监控应用系统监控 7)数据备份 Sat ...
[原创]Saltstack学习笔记：命令参数详解以及配置文件说明
很久没有更新saltstack的文章了,今天还是来更新一点,又开始对saltstack复习了一下. 前边写了一点<saltstack入门概述(1)>以及<Saltstack如何安装( ...
saltstack实战-6
为什么80%的码农都做不了架构师?>>> saltstack除了salt命令外还有一些其他命令也可以用来辅助管理客户端节点,例如:salt-run.salt-key.salt- ...

saltstack（三） --- salt-httpapi

saltstack（三） --- salt-httpapi相关推荐

最新文章

热门文章