Saltstack学习笔记——安装Salt-API

环境

• python >= 2.6 && <=2.7
• pip
• cherrypy 3.2.3
• salt-api-0.8.4.1

需要注意的是很多问题都是因为各个软件版本引起的

安装pip

wget https://bootstrap.pypa.io/get-pip.py
python get-pip.py

安装cherrypy

#不指定版本安装到3.6.0后面curl的时候会报 curl: (56) SSL read: errno -12263
pip install cherrypy==3.2.3

安装salt-api

#当前的版本是 0.8.4.1
pip install salt-api

配置自签名证书

cd /etc/pki/tls/certs
make testcert

#Enter pass phrase: 键入加密短语
#Verifying - Enter pass phrase: 确认加密短语
#/usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt -set_serial 0
#Enter pass phrase for /etc/pki/tls/private/localhost.key: 再次输入相同的加密短语
#Country Name (2 letter code) [XX]:CN
#State or Province Name (full name) []:Fujian
#Locality Name (eg, city) [Default City]:Fuzhou
#Organization Name (eg, company) [Default Company Ltd]:
#Organizational Unit Name (eg, section) []:
#Common Name (eg, your name or your server's hostname) []:
#Email Address []:

cd ../private/
openssl rsa -in localhost.key -out localhost_nopass.key

#Enter pass phrase for localhost.key: 输入之前的加密短语

添加用户

#生产环境请勿使用弱口令
useradd -M -s /sbin/nologin saltapi
passwd saltapi

配置salt-api

mkdir -p /etc/salt/master.d/ 
cd /etc/salt/master.d/ 
touch eauth.conf
touch api.conf

#vi eauth.conf
external_auth:
  pam:
    saltapi:   #用户
      - .*     #该配置文件给予saltapi用户所有模块使用权限，出于安全考虑一般只给予特定模块使用权限

#vi api.conf
rest_cherrypy:
  port: 8888
  ssl_crt: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/private/localhost_nopass.key

将salt-api加入服务

#下载alt-api的启动脚本，,在页面https://github.com/saltstack/salt-api/releases下载salt-api的source code tar.gz,启动脚本在解压包的这个位置./pkg/rpm/salt-api
cp salt-api /etc/init.d/salt-api #拷贝至init.d
chmod +x salt-api                #
service salt-api start           #启动服务
chkconfig salt-api on            #开机启动

service salt-master restart
service salt-api restart

验证服务

#获取token
curl -k https://192.168.181.15:8888/login -H "Accept: application/x-yaml" -d username='saltapi' -d password='password' -d eauth='pam'

 return:
 - eauth: pam   expire: 1419027555.6693039   perms:
   - .*   start: 1418984355.669301   token: ea5fc2131c88c185698e181cc82db380b06068ad user:saltapi

调用test.ping

curl -k https://192.168.181.15:8888/ -H "Accept: application/x-yaml" -H "X-Auth-Token: ea5fc2131c88c185698e181cc82db380b06068ad" -d client='local' -d tgt='*' -d fun='test.ping'