1. Configuration Management
SaltStack
Configuration Management
with SaltStack
Nathan Fish
KWLUG
CC-BY-SA 3.0

2. What is SaltStack? Configuration management tool
Like Ansible, Puppet, Chef, etc
Python, Apache 2.0 License
Created to fix gaps in Puppet

3. Why use Configuration Management?
Configuration in git
Only backup user data
Self-documenting

4. Installing Salt ‘salt-master’ pkg on 1 master
‘salt-minion’ pkg on all machines
Including master
Both are daemons

5. ‘salt-master’ listens ‘salt-minion’ connects to it Master pushes
Network Architecture
‘salt-master’ listens
‘salt-minion’ connects to it
Master pushes
Minion reads /etc/salt/minion config to get master hostname
If not defined, “salt”
Installing salt-minion and writing this file during PXE preseed works great
/etc/salt/minion_id defines the minion’s id
If not defined, the minion takes it’s FQDN and writes it there
Minions trust & save the master’s key the first time
Advantages of this architecture:
Minions can be completely firewalled / NAT
New minions automatically connect

6. Minion first run /etc/salt/: If ./minion_id doesn’t exist, FQDN
Create keypair in ./pki
Read ./minion for master hostname
Connect

7. Salt-key
‘salt-key’ tool on master
Accept, delete, etc minion keys

9. Command Line salt <minion match> <module.function>
Defaults to Bash globs
‘test.ping’ is a Python function
Executed on minion
Generally to use Salt you will use the ‘salt’ command line tool.

10. Example Execution functions
system.reboot
service.restart apache2
pkg.upgrade

11. “Idempotent” – safe to re-run *.sls, YAML format
States
Config is declarative
What we want, not how
“Idempotent” – safe to re-run
*.sls, YAML format

12. Example State A simple state that installs some handy packages
A *.sls file in your State tree can have 1 or more such States.

13. State Run Output

14. Assigns files to minions
The Top File ( top.sls )
YAML format
Assigns files to minions

15. Example State Top

16. Pillar Also *.sls, YAML format Rendered by master into Python dict
Per minion
Can set defaults and override them

17. Pillar Example

18. Jinja Templating language / preprocessor Not unique to Salt
Template config & *.sls files
Salt supports other template languages

19. Example SLS with Jinja

20. Tips / Gotchas
Keep in mind that some things run on master, some on minion
When debugging, you can use ‘salt-call’ on the minion to get more output
salt-master has root to all minions - be careful

21. Questions?
I have some extras if we run out of questions

22. Grains Bits of data about a machine Shouldn’t change often
‘salt ‘*’ grains.ls’
‘salt ‘*’ grains.get ipv4’

23. Key management Master hostname can be changed
Master key cannot (easily)
If reinstalling minion, delete key from master first

24. LXC
salt-run lxc.init <container> host=<host> template=<template>
Autoaccept key