02：saltstack-api使用详解

1.1 salt-api安装

　　 参考博客：https://www.jianshu.com/p/012ccdff93cc

　　1、介绍

　　　　　　1. saltsatck本身就提供了一套算完整的api，使用 CherryPy 来实现 restful 的 api，供外部的程序调用。

　　　　　　2. salt-api需要安装，然后进行一些配置才可以正常使用

　　2、安装salt-api，并设置开机启动

　　　　　　yum -y install salt-api pyOpenSSL

　　　　　　systemctl enable salt-api

　　3、配置自签名证书

　　　　　　cd /etc/pki/tls/certs/

　　　　　　make testcert

Enter pass phrase:    ===>  输入加密短语，这里我使用salt2017

Verifying - Enter pass phrase:    ===>  确认加密短语

umask 77 ; \

/usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt -set_serial 0

Enter pass phrase for /etc/pki/tls/private/localhost.key:    ===>  再次输入相同的加密短语

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:BeiJing

Locality Name (eg, city) [Default City]:BeiJing

Organization Name (eg, company) [Default Company Ltd]:

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:

Email Address []:

交互模式输入密码等

　　4、解密key文件，生成无密码的key文件

　　　　　　注：过程中需要输入key密码，该密码为之前生成证书时设置的密码

　　　　　　cd /etc/pki/tls/private/

　　　　　　openssl rsa -in localhost.key -out localhost_nopass.key

　　5、修改文件权限

　　　　　　chmod 755 /etc/pki/tls/certs/localhost.crt
　　　　　　chmod 755 /etc/pki/tls/private/localhost.key
　　　　　　chmod 755 /etc/pki/tls/private/localhost_nopass.key

　　6、添加用户

　　　　　　注：生产环境请使用密码复杂度高的密码，这里我使用 chnsys@2016

　　　　　　useradd -M -s /sbin/nologin saltapi # 创建用户 saltapi

　　　　　　passwd saltapi # 为用户saltapi设置密码

　　7、配置salt-api

　　　　　　sed -i '/#default_include/s/#default/default/g' /etc/salt/master

　　8、创建/etc/salt/master.d/目录　　　　

　　　　　　mkdir -p /etc/salt/master.d/
　　　　　　cd /etc/salt/master.d/
　　　　　　touch eauth.conf
　　　　　　touch api.conf

external_auth:

  pam:

    saltapi:   # 用户

      - .*     # 该配置文件给予saltapi用户所有模块使用权限，出于安全考虑一般只给予特定模块使用权限

eauth.conf

rest_cherrypy:

  port: 8001

  ssl_crt: /etc/pki/tls/certs/localhost.crt

  ssl_key: /etc/pki/tls/private/localhost_nopass.key

api.conf

　　9、启动salt-api

　　　　　　systemctl restart salt-master
　　　　　　systemctl start salt-api
　　　　　　ps -ef|grep salt-api
　　　　　　netstat -lnput|grep 8001

　　10、测试获取token

　　　　　　curl -k https://192.168.56.11:8001/login -H "Accept: application/x-yaml" -d username='saltapi' -d password='chnsys@2016' -d eauth='pam'

　　11、调用test.ping

　　　　　　curl -k https://192.168.56.11:8001/ -H "Accept: application/x-yaml" -H "X-Auth-Token: 87cbb68e0babf3d0ad6b3741795667dbe62b3c11" -d client='local' -d tgt='*' -d fun='test.ping'

1.2 编写python脚本请求salt api接口

　　1、使用python简单测试接口执行命令

#!/usr/bin/env python

# _*_ coding:utf-8 _*_

__author__ = 'junxi'

import requests

import json

try:

    import cookielib

except:

    import http.cookiejar as cookielib

# 使用urllib2请求https出错，做的设置

import ssl

context = ssl._create_unverified_context()

# 使用requests请求https出现警告，做的设置

from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

salt_api = "https://192.168.56.11:8001/"

class SaltApi:

    """

    定义salt api接口的类

    初始化获得token

    """

    def __init__(self, url):

        self.url = url

        self.username = "saltapi"

        self.password = "chnsys@2016"

        self.headers = {

            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36",

            "Content-type": "application/json"

        }

        self.params = {'client': 'local', 'fun': '', 'tgt': ''}

        self.login_url = salt_api + "login"

        self.login_params = {'username': self.username, 'password': self.password, 'eauth': 'pam'}

        self.token = self.get_data(self.login_url, self.login_params)['token']

        self.headers['X-Auth-Token'] = self.token

    def get_data(self, url, params):

        send_data = json.dumps(params)

        request = requests.post(url, data=send_data, headers=self.headers, verify=False)

        response = request.json()

        result = dict(response)

        return result['return'][0]

    def salt_command(self, tgt, method, arg=None):

        """远程执行命令，相当于salt 'client1' cmd.run 'free -m'"""

        if arg:

            params = {'client': 'local', 'fun': method, 'tgt': tgt, 'arg': arg}

        else:

            params = {'client': 'local', 'fun': method, 'tgt': tgt}

        print '命令参数: ', params

        result = self.get_data(self.url, params)

        return result

def main():

    salt = SaltApi(salt_api)

    salt_client = '*'

    salt_test = 'test.ping'

    result1 = salt.salt_command(salt_client, salt_test)

    print result1

    # 返回结果：{u'linux-node1.example.com': True, u'linux-node2.example.com': True}

if __name__ == '__main__':

    main()

使用python简单测试接口执行命令

　　2、使用requests模块获取基本信息

#! /usr/bin/env python

# -*- coding: utf-8 -*-

import requests

import json

import logging

logging.captureWarnings(True)  # 屏蔽由于访问https时没有证书警告问题

SALT_BASE_URL = 'https://192.168.56.11:8001/'

SALT_USER = 'saltapi'

SALT_PWD = 'chnsys@2016'

class SaltAPI(object):

    __token_id = ''

    def __init__(self):

        self.__url = SALT_BASE_URL

        self.__user = SALT_USER

        self.__password = SALT_PWD

    def token_id(self):

        """

            用户登陆和获取token

        :return:

        """

        params = {'eauth': 'pam', 'username': self.__user, 'password': self.__password}

        content = self.postRequest(self.__url + '/login', data=params)

        try:

            self.__token_id = content[0]['token']

        except Exception as e:

            print '**** Failed to get token, {} ****'.format(str(e))

    def postRequest(self, url, data=None):

        headers = {"X-Auth-Token": self.__token_id}

        ret = requests.post(url=url, data=data, json='json', headers=headers, verify=False)

        if ret.status_code == 200:

            return ret.json()['return']

        return ret.text

    def remote_execution_module(self, tgt, fun, arg):

        """

            远程执行模块，有参数

        :param tgt: minion list

        :param fun: 模块

        :param arg: 参数

        :return: dict, {'minion1': 'ret', 'minion2': 'ret'}

        """

        params = {'client': 'local', 'tgt': tgt, 'fun': fun, 'arg': arg}

        self.token_id()

        return self.postRequest(self.__url, params)

    def salt_alive(self, tgt):

        '''

        salt主机存活检测

        '''

        params = {'client': 'local', 'tgt': tgt, 'fun': 'test.ping'}

        self.token_id()

        return self.postRequest(self.__url, params)

if __name__ == '__main__':

    salt = SaltAPI()

    minions_list = [

        'cloud:type',

        'cluster:domain',

        'cluster:name',

        'cpu_model',

        'fqdn_ip4',

        'hospital:type',

        'kernelrelease',

        'nodename',

        'os',

        'osmajorrelease',

        'osrelease',

        'saltversion',

        'serialnumber',

        'virtual',

        'num_cpus',

        'mem_total',

        'cloud:region',

        'ipv4',

    ]

    ret = salt.remote_execution_module('*', 'grains.item', minions_list)

    print json.dumps(ret, ensure_ascii=False)

'''

[{

    "linux-node1.example.com": {

        "osrelease": "7.6.1810",

        "fqdn_ip4": ["192.168.56.11"],

        "serialnumber": "VMware-56 4d 26 83 60 7c bb 5a-14 17 6a ab c2 45 f2 7a",

        "nodename": "linux-node1.example.com",

        "kernelrelease": "3.10.0-957.1.3.el7.x86_64",

        "cloud:type": "",

        "num_cpus": 1,

        "saltversion": "2018.3.3",

        "cpu_model": "Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz",

        "virtual": "VMware",

        "cluster:domain": "",

        "cluster:name": "",

        "osmajorrelease": 7,

        "hospital:type": "",

        "cloud:region": "",

        "os": "CentOS",

        "ipv4": ["127.0.0.1", "192.168.56.11"],

        "mem_total": 1819

    },

    "linux-node2.example.com": {

        "osrelease": "7.6.1810",

        "fqdn_ip4": ["192.168.56.12"],

        "serialnumber": "VMware-56 4d 09 af 9d 33 70 99-e9 7b 6d b2 5a 3b 7f 22",

        "nodename": "linux-node2.example.com",

        "kernelrelease": "3.10.0-957.1.3.el7.x86_64",

        "cloud:type": "",

        "num_cpus": 1,

        "saltversion": "2018.3.3",

        "cpu_model": "Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz",

        "virtual": "VMware",

        "cluster:domain": "",

        "cluster:name": "",

        "osmajorrelease": 7,

        "hospital:type": "",

        "cloud:region": "",

        "os": "CentOS",

        "ipv4": ["127.0.0.1", "192.168.56.12"],

        "mem_total": 1819

    }

}]

'''

使用requests模块获取基本信息

　　3、解决访问无证书https报错：requests.exceptions.SSLError: HTTPSConnectionPool

　　　　　　参考博客：https://blog.csdn.net/qq_31077649/article/details/79013199

　　　　　　1）安装相关模块：

　　　　　　　　　　pip install cryptography
　　　　　　　　　　pip install pyOpenSSL
　　　　　　　　　　pip install certifi

　　　　　　2）关闭证书验证（verify=False）

　　　　　　　　　　ret = requests.post(url=url, data=data, json='json', headers=headers, verify=False)

1111111111111111111111111111111

巴特西

02：saltstack-api使用详解

1.1 salt-api安装

1.2 编写python脚本请求salt api接口

最新文章

热门文章