| Table of Contents | ||||
|---|---|---|---|---|
|
...
Internal Ports (Backend Server 간): Trusted Network 구간
8000 : Salt-API Server - CH Server와 데이터 송수신.
9094 : Kapacitor - InfluxDB와 데이터 송수신.
Intermediate Ports (Agent ↔︎ Backend Server 간): Semi-Trusted Network 구간
| Warning |
|---|
아래 포트들은 모니터링 대상 호스트들(MO: Managed Objects)과의 통신에 사용됩니다. 아래 설정 예시와 같이 firewalld filter를 사용하거나, 혹은 tcp_wrappers 등을 사용하여 hosts.allow, hosts.deny 등에 ACL을 설정할 수 있습니다. |
4505-4506 : Salt-Master - Salt-Minion과 데이터 송수신.
8086 : InfluxDB - telegraf로부터 데이터 수신.
아래는 firewalld 설정 파일 예시이며,
| Status | ||||
|---|---|---|---|---|
|
| Code Block | ||
|---|---|---|
| ||
<!-- /etc/firewalld/zones/public.xml -->
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas.</description>
<service name="ssh"/>
<service name="dhcpv6-client"/>
<port protocol="tcp" port="443"/>
<rule family="ipv4">
<source address="xxx.xxx.xxx.0/24"/>
<port protocol="tcp" port="4505-4506"/>
<accept/>
</rule>
<rule family="ipv4">
<source address="xxx.xxx.xxx.xxx"/>
<port protocol="tcp" port="8000"/>
<accept/>
</rule>
<rule family="ipv4">
<source address="xxx.xxx.xxx.xxx"/>
<port protocol="tcp" port="8086"/>
<accept/>
</rule>
<rule family="ipv4">
<source address="xxx.xxx.xxx.xxx"/>
<port protocol="tcp" port="9094"/>
<accept/>
</rule>
</zone> |
...
SaltStack 설치([On/Off]line 설치 겸용)
Predefinitions
설명의 편의를 위해, 아래와 같이 사전 정의된 경로를 사용하는 것을 전제로 합니다.
Conda Installed Path |
|
Conda 설치
| Attachments | ||
|---|---|---|
|
위 첨부 파일 Miniconda3 배포 파일 다운로드 후,
...
| Code Block | ||
|---|---|---|
| ||
chmod 755 Miniconda3-latest-Linux-x86_64.sh # 쉘 실행 권한 부여 ./Miniconda3-latest-Linux-x86_64.sh -b -u -p /opt/miniconda3 # /opt/miniconda3에 설치 |
Download from Github release page
https://github.com/snetsystems/salt/releases 에서 원하는 버전의 인스톨 파일들을 다운로드 합니다.
여기서는 “3001.4-6-ge56e905”버전으로 인스톨 할 것이며, 관련 파일들을 적당한 경로에 다운로드 합니다.
Conda 가상환경 압축 파일: 예>
saltenv-3001.4-6-ge56e905-linux.tar.gzinstall_salt_svc_for_conda_centos7.sh
saltenv unpack
/opt/miniconda3/envs/에 saltenv-3001.4-6-ge56e905-linux.tar.gz를 압축 해제합니다.
...
| Warning |
|---|
크로스 플랫폼 환경으로는 사용 불가. 예를 들어, linux packing → windows unpacking (X) |
Config 설정
Salt-Master와 Salt-API의 Config 설정.
Config path : $ vim /opt/miniconda3/etc/salt/master
| Note |
|---|
|
| Code Block | ||
|---|---|---|
| ||
## log_level ##
# One of 'garbage', 'trace', 'debug', info', 'warning'(default), 'error', 'critical'.
log_level: info
root_dir: /opt/miniconda3/envs/saltenv
##### Primary configuration settings #####
##########################################
# The address of the interface to bind to:
interface: x.x.x.x
# The tcp port used by the publisher:
publish_port: 4505
# Allow minions to push files to the master. This is disabled by default, for
# security purposes.
# file_recv: True
##### State System settings #####
##########################################
# The state system uses a "top" file to tell the minions what environment to
# use and what modules to use. The state_top file is defined relative to the
# root of the base environment as defined in "File Server settings" below.
state_top: top.sls
##### File Server settings #####
##########################################
# Salt runs a lightweight file server written in zeromq to deliver files to
# minions. This file server is built into the master daemon and does not
# require a dedicated port.
# The file server works on environments passed to the master, each environment
# can have multiple root directories, the subdirectories in the multiple file
# roots cannot match, otherwise the downloaded files will not be able to be
# reliably ensured. A base environment is required to house the top file.
file_roots:
base:
- /srv/salt/prod
# File Server Backend
#
# Salt supports a modular fileserver backend system, this system allows
# the salt master to link directly to third party systems to gather and
# manage the files available to minions. Multiple backends can be
# configured and will be searched for the requested file in the order in which
# they are defined here. The default setting only enables the standard backend
# "roots" which uses the "file_roots" option.
fileserver_backend:
- roots
##### Security settings #####
##########################################
# The external auth system uses the Salt auth modules to authenticate and
# validate users to access areas of the Salt system.
external_auth:
pam:
saltdev:
- .*
- '@runner'
- '@wheel'
- '@jobs'
# Allow eauth users to specify the expiry time of the tokens they generate.
# A boolean applies to all users or a dictionary of whitelisted eauth backends
# and usernames may be given.
token_expire_user_override:
pam:
- saltdev
##### API Server settings #####
##########################################
rest_cherrypy:
port: 8000
disable_ssl: True |
Salt-Minion 설정
| Warning |
|---|
이 경우, salt-minion을 실행할 경우, |
| Note |
|---|
|
Config path: $ vim /opt/miniconda3/etc/salt/minion
| Code Block | ||
|---|---|---|
| ||
## log_level ## # One of 'garbage', 'trace', 'debug', info', 'warning'(default), 'error', 'critical'. log_level: info root_dir: /opt/miniconda3/envs/saltenv master: <master ip address> id: <유일한 minion id 설정해야 하며, 생략 시, hostname = minion id> |
계정 생성 및 패스워드 설정
| Note |
|---|
아래 추가된 saltdev에 대한 password는 추후 salt-api authentication을 위한 pam_token를 발급 받는데 쓰이므로, 잘 기억해두어야 합니다. |
| Code Block | ||
|---|---|---|
| ||
$ useradd saltdev $ passwd <password> Changing password for user saltdev. New password: |
...