1. SaltStack数据系统

SaltStack有两大数据系统，分别是：

• Grains
• Pillar

2. SaltStack数据系统组件

2.1 SaltStack组件之Grains

Grains是SaltStack的一个组件，其存放着minion启动时收集到的信息。

Grains是SaltStack组件中非常重要的组件之一，因为我们在做配置部署的过程中会经常使用它，Grains是SaltStack记录minion的一些静态信息的组件。可简单理解为Grains记录着每台minion的一些常用属性，比如CPU、内存、磁盘、网络信息等。我们可以通过grains.items查看某台minion的所有Grains信息。

Grains的功能：

• 信息查询
• 在命令行下进行目标匹配
• 在top file中进行目标匹配
• 在模板中进行目标匹配

模板中进行目标匹配请看

信息查询实例：

//列出所有grains的key和value
[root@vm1 ~]# salt 'vm1' grains.items
vm1:----------SSDs:biosreleasedate:07/29/2019biosversion:6.00cpu_flags:         //cpu相关的属性- fpu- vme- de- pse- tsc- msr- pae- mce- cx8- apic- sep- mtrr- pge- mca- cmov- pat- pse36- clflush- mmx- fxsr- sse- sse2- ss- syscall- nx- pdpe1gb- rdtscp- lm- constant_tsc- arch_perfmon- nopl- xtopology- tsc_reliable- nonstop_tsc- eagerfpu- pni- pclmulqdq- ssse3- fma- cx16- pcid- sse4_1- sse4_2- x2apic- movbe- popcnt- tsc_deadline_timer- aes- xsave- avx- f16c- rdrand- hypervisor- lahf_lm- abm- 3dnowprefetch- fsgsbase- tsc_adjust- bmi1- avx2- smep- bmi2- invpcid- mpx- rdseed- adx- smap- clflushopt- xsaveopt- xsavec- ibpb- ibrs- stibp- arat- spec_ctrl- intel_stibp- arch_capabilitiescpu_model:Intel(R) Core(TM) i3-9100F CPU @ 3.60GHzcpuarch:x86_64cwd:/disks:- sda- sr0- dm-0- dm-1dns:----------domain:ip4_nameservers:- 114.114.114.114ip6_nameservers:nameservers:- 114.114.114.114options:search:sortlist:domain:localdomainfqdn:localhost.localdomainfqdn_ip4:- 127.0.0.1fqdn_ip6:- ::1fqdns:gid:0gpus:|_----------model:SVGA II Adaptervendor:vmwaregroupname:roothost:localhosthwaddr_interfaces:----------ens33:00:0c:29:e9:2e:d1lo:00:00:00:00:00:00id:vm1init:systemdip4_gw:192.168.30.2ip4_interfaces:----------ens33:- 192.168.30.100lo:- 127.0.0.1ip6_gw:Falseip6_interfaces:----------ens33:- fe80::20c:29ff:fee9:2ed1lo:- ::1ip_gw:Trueip_interfaces:----------ens33:- 192.168.30.100- fe80::20c:29ff:fee9:2ed1lo:- 127.0.0.1- ::1ipv4:- 127.0.0.1- 192.168.30.100ipv6:- ::1- fe80::20c:29ff:fee9:2ed1kernel:Linuxkernelrelease:3.10.0-862.el7.x86_64kernelversion:#1 SMP Fri Apr 20 16:44:24 UTC 2018locale_info:----------defaultencoding:UTF-8defaultlanguage:en_USdetectedencoding:UTF-8timezone:unknownlocalhost:localhost.localdomainlsb_distrib_codename:CentOS Linux 7 (Core)lsb_distrib_id:CentOS Linuxmachine_id:133563fc63ee4915b7789dc9c16b9989manufacturer:VMware, Inc.master:192.168.30.100mdadm:mem_total:1821nodename:localhost.localdomainnum_cpus:1num_gpus:1os:CentOSos_family:RedHatosarch:x86_64oscodename:CentOS Linux 7 (Core)osfinger:CentOS Linux-7osfullname:CentOS Linuxosmajorrelease:7osrelease:7.5.1804osrelease_info:- 7- 5- 1804path:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/binpid:1587productname:VMware Virtual Platformps:ps -efHwwpythonexecutable:/usr/bin/pythonpythonpath:- /usr/bin- /usr/lib64/python27.zip- /usr/lib64/python2.7- /usr/lib64/python2.7/plat-linux2- /usr/lib64/python2.7/lib-tk- /usr/lib64/python2.7/lib-old- /usr/lib64/python2.7/lib-dynload- /usr/lib64/python2.7/site-packages- /usr/lib/python2.7/site-packagespythonversion:- 2- 7- 5- final- 0saltpath:/usr/lib/python2.7/site-packages/saltsaltversion:3000.3saltversioninfo:- 3000- 3selinux:----------enabled:Falseenforced:Disabledserialnumber:VMware-56 4d c4 ee 08 78 5f ce-99 23 cf ef 41 e9 2e d1server_id:147626591shell:/bin/shswap_total:1023systemd:----------features:+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDNversion:219uid:0username:rootuuid:eec44d56-7808-ce5f-9923-cfef41e92ed1virtual:VMwarezfs_feature_flags:Falsezfs_support:Falsezmqversion:4.1.4//只查询所有的grains的key[root@vm1 ~]# salt 'vm1' grains.ls
vm1:- SSDs- biosreleasedate- biosversion- cpu_flags- cpu_model- cpuarch- cwd- disks- dns- domain- fqdn- fqdn_ip4- fqdn_ip6- fqdns- gid- gpus- groupname- host- hwaddr_interfaces- id- init- ip4_gw- ip4_interfaces- ip6_gw- ip6_interfaces- ip_gw- ip_interfaces- ipv4- ipv6- kernel- kernelrelease- kernelversion- locale_info- localhost- lsb_distrib_codename- lsb_distrib_id- machine_id- manufacturer- master- mdadm- mem_total- nodename- num_cpus- num_gpus- os- os_family- osarch- oscodename- osfinger- osfullname- osmajorrelease- osrelease- osrelease_info- path- pid- productname- ps- pythonexecutable- pythonpath- pythonversion- saltpath- saltversion- saltversioninfo- selinux- serialnumber- server_id- shell- swap_total- systemd- uid- username- uuid- virtual- zfs_feature_flags- zfs_support- zmqversion//查询某个key的值，比如想获取ip地址[root@vm1 ~]# salt 'vm1' grains.get fqdn_ip4
vm1:- 127.0.0.1[root@vm1 ~]# salt 'vm2' grains.get ip4_interfaces
vm2:----------ens33:- 192.168.30.128- 192.168.30.130lo:- 127.0.0.1[root@vm1 ~]# salt '*' grains.get ip4_interfaces:ens33
vm2:- 192.168.30.128- 192.168.30.130
vm1:- 192.168.30.100

目标匹配实例

用Grains来匹配minion：

//在所有centos系统中执行命令
[root@vm1 ~]# salt -G 'os:CentoS' cmd.run 'uptime'
vm1:21:52:38 up 41 min,  2 users,  load average: 0.09, 0.25, 0.24
vm2:21:52:38 up 41 min,  1 user,  load average: 0.00, 0.01, 0.05

在top file里面使用Grains：

[root@vm1 ~]# vim /srv/salt/base/top.slsbase:'os:CentoS':- match: grain- web.apache.apache[root@vm1 ~]# salt '*' state.highstate
vm2:
----------ID: apache-installFunction: pkg.installedName: httpdResult: TrueComment: All specified packages are already installedStarted: 21:56:33.174026Duration: 651.464 msChanges:   
----------ID: apache-servicesFunction: service.runningName: httpdResult: TrueComment: The service httpd is already runningStarted: 21:56:33.826485Duration: 61.248 msChanges:   Summary for vm2
------------
Succeeded: 2
Failed:    0
------------
Total states run:     2
Total run time: 712.712 ms
vm1:
----------ID: apache-installFunction: pkg.installedName: httpdResult: TrueComment: All specified packages are already installedStarted: 21:56:33.212518Duration: 701.662 msChanges:   
----------ID: apache-servicesFunction: service.runningName: httpdResult: TrueComment: The service httpd is already runningStarted: 21:56:33.915166Duration: 70.135 msChanges:   Summary for vm1
------------
Succeeded: 2
Failed:    0
------------
Total states run:     2
Total run time: 771.797 ms

自定义Grains的两种方法：

• minion配置文件，在配置文件中搜索grains
• 在/etc/salt下生成一个grains文件，在此文件中定义(推荐方式)

// minion配置
[root@vm2 ~]# vim /etc/salt/miniongrains:roles:- webserver#  deployment: datacenter4[root@vm1 ~]# salt -G 'os:CentoS' grains.get roles
vm2:- webserver
vm1://在/etc/salt下生成一个grains文件[root@vm1 ~]# vim /etc/salt/grains
[root@vm1 ~]# cat /etc/salt/grains
role: webserver
[root@vm1 ~]# salt-cp '*' /etc/salt/grains /etc/salt/grains
vm1:----------/etc/salt/grains:True
vm2:----------/etc/salt/grains:True
[root@vm1 ~]# salt '*' saltutil.sync_grains
vm1:
vm2:
[root@vm1 ~]# salt '*' grains.get role
vm2:webserver
vm1:webserver

2.2 SaltStack组件之Pillar

Pillar也是SaltStack组件中非常重要的组件之一，是数据管理中心，经常配置states在大规模的配置管理工作中使用它。Pillar在SaltStack中主要的作用就是存储和定义配置管理中需要的一些数据，比如软件版本号、用户名密码等信息，它的定义存储格式与Grains类似，都是YAML格式。

在Master配置文件中有一段Pillar settings选项专门定义Pillar相关的一些参数：

[root@vm1 ~]# vim /etc/salt/master
# highstate format, and is generally just key/value pairs.
------
#pillar_roots:
#  base:
#    - /srv/pillar
#-----

默认Base环境下Pillar的工作目录在/srv/pillar目录下。若你想定义多个环境不同的Pillar工作目录，只需要修改此处配置文件即可。

Pillar的特点：

• 可以给指定的minion定义它需要的数据
• 只有指定的人才能看到定义的数据
• 在master配置文件里设置

//查看pillar的信息[root@vm1 ~]# salt '*' pillar.items
vm2:----------
vm1:----------

默认pillar是没有任何信息的，如果想查看信息，需要在 master 配置文件上把 pillar_opts的注释取消，并将其值设为 True。

[root@vm1 ~]# vim /etc/salt/master# the pillar called "master". This is used to set simple configurations in the
# master config file that can then be used on minions.
pillar_opts: True# The pillar_safe_render_error option prevents the master from passing pillar
# render errors to the minion. This is set on by default because the error co//重启master并查看pillar的信息[root@vm1 ~]# systemctl restart salt-master[root@vm1 ~]# salt '*' pillar.items      thorium_roots:----------base:- /srv/thoriumthorium_top:top.slsthoriumenv:Nonetimeout:5token_dir:/var/cache/salt/master/tokenstoken_expire:43200token_expire_user_override:Falsetop_file_merging_strategy:mergetransport:zeromqunique_jid:Falseuser:rootutils_dirs:- /var/cache/salt/master/extmods/utilsverify_env:Truewinrepo_branch:masterwinrepo_cachefile:winrepo.pwinrepo_dir:/srv/salt/win/repowinrepo_dir_ng:/srv/salt/win/repo-ngwinrepo_insecure_auth:Falsewinrepo_passphrase:winrepo_password:winrepo_privkey:winrepo_pubkey:winrepo_refspecs:- +refs/heads/*:refs/remotes/origin/*- +refs/tags/*:refs/tags/*winrepo_remotes:- https://github.com/saltstack/salt-winrepo.gitwinrepo_remotes_ng:- https://github.com/saltstack/salt-winrepo-ng.gitwinrepo_ssl_verify:Truewinrepo_user:worker_threads:5zmq_backlog:1000zmq_filtering:Falsezmq_monitor:False
vm1:----------master:----------__cli:salt-master__role:masterallow_minion_key_revoke:Truearchive_jobs:Falseauth_events:Trueauth_mode:1auto_accept:Falseazurefs_update_interval:60cache:localfscache_sreqs:Truecachedir:/var/cache/salt/masterclean_dynamic_modules:Truecli_summary:Falseclient_acl_verify:Truecluster_mode:Falsecon_cache:Falseconf_file:/etc/salt/masterconfig_dir:/etc/saltcython_enable:Falsedaemon:Falsedecrypt_pillar:decrypt_pillar_default:gpgdecrypt_pillar_delimiter::decrypt_pillar_renderers:- gpgdefault_include:master.d/*.confdefault_top:basediscovery:Falsedjango_auth_path:django_auth_settings:drop_messages_signature_fail:Falsedummy_pub:Falseeauth_acl_module:eauth_tokens:localfsenable_gpu_grains:Falseenable_ssh_minions:Falseenforce_mine_cache:Falseengines:env_order:event_match_type:startswithevent_return:event_return_blacklist:event_return_queue:0event_return_whitelist:ext_job_cache:ext_pillar:extension_modules:

pillar自定义数据：

在master的配置文件里找pillar_roots可以看到其存放pillar的位置

[root@vm1 ~]# vim /etc/salt/master# highstate format, and is generally just key/value pairs.
pillar_roots:base:- /srv/pillar/base
#
#ext_pillar:[root@vm1 ~]# mkdir -p /srv/pillar/base
[root@vm1 ~]# systemctl restart salt-master
[root@vm1 ~]# vim /srv/pillar/base/apache.sls
[root@vm1 ~]# cat /srv/pillar/base/apache.sls
{% if grains['os'] == 'CentOS' %}
apache: httpd
{% elif grains['os'] == 'Debian' %}
apache: apache2
{% endif %}//定义top file入口文件
[root@vm1 ~]# cat /srv/pillar/base/top.sls
base:        //指定环境'vm1':         //指定目标 - apache       //引用apache.sls或apache/init.sls//这个top.sls文件的意思表示的是vm1这台主机的base环境能够访问到apache这个pillar
[root@vm1 ~]# vim /etc/salt/master
# master config file that can then be used on minions.
#pillar_opts: True[root@vm1 ~]# systemctl restart salt-master
[root@vm1 ~]# salt '*' pillar.items
vm2:----------
vm1:----------apache:httpd//在salt下修改apache的状态文件，引用pillar的数据[root@vm1 ~]# vim /srv/salt/base/web/apache/apache.slsapache-install:pkg.installed:- name: {{ pillar['apache'] }}apache-services:service.running:- name: {{ pillar['apache'] }}- enable: True//执行高级状态文件[root@vm1 ~]# salt 'vm1' state.highstate
vm1:
----------ID: apache-installFunction: pkg.installedName: httpdResult: TrueComment: All specified packages are already installedStarted: 22:56:30.139663Duration: 635.878 msChanges:   
----------ID: apache-servicesFunction: service.runningName: httpdResult: TrueComment: The service httpd is already runningStarted: 22:56:30.776506Duration: 56.911 msChanges:   Summary for vm1
------------
Succeeded: 2
Failed:    0
------------
Total states run:     2
Total run time: 692.789 ms

2.3 Grains与Pillar的区别

	存储位置	类型	采集方式	应用场景
Grains	minion	静态	minion启动时采集 可通过刷新避免重启minion服务	1.信息查询 2.在命令行下进行目标匹配 3.在top file中进行目标匹配 4.在模板中进行目标匹配
Pillar	master	动态	指定，实时生效	1.目标匹配 2.敏感数据配置