Configuration Management SaltStack Configuration Management with SaltStack Nathan Fish KWLUG 2017-06-05 CC-BY-SA 3.0

What is SaltStack? Configuration management tool Like Ansible, Puppet, Chef, etc Python, Apache 2.0 License Created to fix gaps in Puppet

Why use Configuration Management? Configuration in git Only backup user data Self-documenting

Installing Salt ‘salt-master’ pkg on 1 master ‘salt-minion’ pkg on all machines Including master Both are daemons

‘salt-master’ listens ‘salt-minion’ connects to it Master pushes Network Architecture ‘salt-master’ listens ‘salt-minion’ connects to it Master pushes Minion reads /etc/salt/minion config to get master hostname If not defined, “salt” Installing salt-minion and writing this file during PXE preseed works great /etc/salt/minion_id defines the minion’s id If not defined, the minion takes it’s FQDN and writes it there Minions trust & save the master’s key the first time Advantages of this architecture: Minions can be completely firewalled / NAT New minions automatically connect

Minion first run /etc/salt/: If ./minion_id doesn’t exist, FQDN Create keypair in ./pki Read ./minion for master hostname Connect

Salt-key ‘salt-key’ tool on master Accept, delete, etc minion keys

Command Line salt <minion match> <module.function> Defaults to Bash globs ‘test.ping’ is a Python function Executed on minion Generally to use Salt you will use the ‘salt’ command line tool.

Example Execution functions system.reboot service.restart apache2 pkg.upgrade

“Idempotent” – safe to re-run *.sls, YAML format States Config is declarative What we want, not how “Idempotent” – safe to re-run *.sls, YAML format

Example State A simple state that installs some handy packages A *.sls file in your State tree can have 1 or more such States.

State Run Output

Assigns files to minions The Top File ( top.sls ) YAML format Assigns files to minions

Example State Top

Pillar Also *.sls, YAML format Rendered by master into Python dict Per minion Can set defaults and override them

Pillar Example

Jinja Templating language / preprocessor Not unique to Salt Template config & *.sls files Salt supports other template languages

Example SLS with Jinja

Tips / Gotchas Keep in mind that some things run on master, some on minion When debugging, you can use ‘salt-call’ on the minion to get more output salt-master has root to all minions - be careful

Questions? I have some extras if we run out of questions

Grains Bits of data about a machine Shouldn’t change often ‘salt ‘*’ grains.ls’ ‘salt ‘*’ grains.get ipv4’

Key management Master hostname can be changed Master key cannot (easily) If reinstalling minion, delete key from master first

LXC salt-run lxc.init <container> host=<host> template=<template> Autoaccept key