...

Internal Ports (Backend Server 간): Trusted Network 구간

• 8000 : Salt-API Server - CH Server와 데이터 송수신.

• 9094 : Kapacitor - InfluxDB와 데이터 송수신.

Intermediate Ports (Agent ↔︎ Backend Server 간): Semi-Trusted Network 구간

• 4505-4506 : Salt-Master - Salt-Minion과 데이터 송수신.

• 8086 : InfluxDB - telegraf로부터 데이터 수신.

아래는 firewalld 설정 파일 예시이며,

<!-- /etc/firewalld/zones/public.xml -->
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas.</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <port protocol="tcp" port="443"/>
  <rule family="ipv4">
    <source address="xxx.xxx.xxx.0/24"/>
    <port protocol="tcp" port="4505-4506"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="xxx.xxx.xxx.xxx"/>
    <port protocol="tcp" port="8000"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="xxx.xxx.xxx.xxx"/>
    <port protocol="tcp" port="8086"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="xxx.xxx.xxx.xxx"/>
    <port protocol="tcp" port="9094"/>
    <accept/>
  </rule>
</zone>

...

chmod 755 Miniconda3-latest-Linux-x86_64.sh # 쉘 실행 권한 부여
./Miniconda3-latest-Linux-x86_64.sh -b -u -p /opt/miniconda3 # /opt/miniconda3에 설치

conda 환경 변수 등록

conda 환경 변수 설정을 위해 conda init 명령어를 입력해야 합니다.

$ /opt/miniconda3/bin/conda init

conda 기본 환경을 비활성화

$ conda config --set auto_activate_base false

Download from Github release page

https://github.com/snetsystems/salt/releases 에서 원하는 버전의 인스톨 파일들을 다운로드 합니다.
여기서는 “3001.4-6-ge56e905”버전으로 인스톨 할 것이며, 관련 파일들을 적당한 경로에 다운로드 합니다.

1. Conda 가상환경 압축 파일: 예> saltenv-3001.4-6-ge56e905-linux.tar.gz

2. install_salt_svc_for_conda_centos7.sh

saltenv unpack

/opt/miniconda3/envs/에 saltenv-3001.4-6-ge56e905-linux.tar.gz를 압축 해제합니다.

...

Config path : $ vim /opt/miniconda3/envs/saltenv/etc/salt/master

## log_level ##
# One of 'garbage', 'trace', 'debug', info', 'warning'(default), 'error', 'critical'.
log_level: info
root_dir: /opt/miniconda3/envs/saltenv

##### Primary configuration settings #####
##########################################
# The address of the interface to bind to:
interface: x.x.x.x
 
# The tcp port used by the publisher:
publish_port: 4505
 
# Allow minions to push files to the master. This is disabled by default, for
# security purposes.
# file_recv: True
 
#####      State System settings     #####
##########################################
# The state system uses a "top" file to tell the minions what environment to
# use and what modules to use. The state_top file is defined relative to the
# root of the base environment as defined in "File Server settings" below.
state_top: top.sls
 
#####      File Server settings      #####
##########################################
# Salt runs a lightweight file server written in zeromq to deliver files to
# minions. This file server is built into the master daemon and does not
# require a dedicated port.
 
# The file server works on environments passed to the master, each environment
# can have multiple root directories, the subdirectories in the multiple file
# roots cannot match, otherwise the downloaded files will not be able to be
# reliably ensured. A base environment is required to house the top file.
file_roots:
  base:
    - /srv/salt/prod
 
# File Server Backend
#
# Salt supports a modular fileserver backend system, this system allows
# the salt master to link directly to third party systems to gather and
# manage the files available to minions. Multiple backends can be
# configured and will be searched for the requested file in the order in which
# they are defined here. The default setting only enables the standard backend
# "roots" which uses the "file_roots" option.
fileserver_backend:
  - roots
 
#####        Security settings       #####
##########################################
# The external auth system uses the Salt auth modules to authenticate and
# validate users to access areas of the Salt system.
external_auth:
  pam:
    saltdev:
      - .*
      - '@runner'
      - '@wheel'
      - '@jobs'
 
# Allow eauth users to specify the expiry time of the tokens they generate.
# A boolean applies to all users or a dictionary of whitelisted eauth backends
# and usernames may be given.
token_expire_user_override:
  pam:
    - saltdev

#####        API Server settings     #####
##########################################
rest_cherrypy:
  port: 8000
  disable_ssl: True

...

Config path: $ vim /opt/miniconda3/envs/saltenv/etc/salt/minion

## log_level ##
# One of 'garbage', 'trace', 'debug', info', 'warning'(default), 'error', 'critical'.
log_level: info
root_dir: /opt/miniconda3/envs/saltenv
master: <master ip address>
id: <유일한 minion id 설정해야 하며, 생략 시, hostname = minion id>

계정 생성 및 패스워드 설정

$ useradd saltdev
$ passwd <password>
Changing password for user saltdev.
New password:

...

1. $ vim /etc/systemd/system/multi-user.target.wants/cloudhub.service

   Code Block
   language yaml
   [Unit] After=network-online.target [Service] User=root Group=root Environment="HOST=0.0.0.0" Environment="PORT=443" # default: 8888 Environment="TLS_CERTIFICATE=/usr/lib/cloudhub/key/cloudhub_self_signed.pem" #Environment="TLS_PRIVATE_KEY=my.key" Environment="BOLT_PATH=/var/lib/cloudhub/cloudhub-v1.db" #Environment="ETCD_ENDPOINTS={ETCD_CLIENT_IP}:2379" Environment="CANNED_PATH=/usr/share/cloudhub/cloudhub-canned" Environment="PROTOBOARDS_PATH=/usr/share/cloudhub/cloudhub-protoboards" EnvironmentFile=-/etc/default/cloudhub ExecStart=/usr/bin/cloudhub $CLOUDHUB_OPTS KillMode=control-group Restart=on-failure [Install] WantedBy=multi-user.target

2. localhost 인증서(cloudhub_self_signed.pem) 발급

   Code Block
   $ cd /usr/lib/cloudhub/key/ $ openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout cloudhub_self_signed.pem -out cloudhub_self_signed.pem -subj "/CN=localhost" -days 365

3. <salt_token> 발급
   /wiki/spaces/CM/pages/254050538
   

   Status
   colour Purple title 노트

   위 페이지 접근 권한이 없는 경우에는 Snetsystems CloudHub 팀에 문의/발급 받은 후,
   아래 4번 -k=salt:<salt_token>에 기입하세요.

4. $ vim /etc/default/cloudhub

   Code Block
   language yaml
   CLOUDHUB_OPTS="-l=debug \ --auth-duration=0 \ -t=74c1e9e2450886060b5bf736b935cd0bf960837f \ -i=any \ -s=any \ -u=salt:http://{salt-master-ip}:8000/run \ -k=salt:<salt_token> \ -u=vsphere:on \ -u=aws:on \ -u=k8s:on \ --login-auth-type=basic \ --password-policy='(?=.*[0-9]{1,50})(?=.*[~`!@#$%\\^&*()-+=]{1,50})(?=.*[a-zA-Z]{2,50}).{8,50}$' \ --password-policy-message='Enter at least 8 digits using at least 1 number and at least 1 special sentence, and at least 2 English characters.' \ --mail-subject='[Notifiy] $user_id Password is reset' \ --mail-body-message='Reset OTP for $user_id is '$user_pw'.<br>Do not forget this!<br>This OTP will use just once when login into cloudhub.<br>Then you must set up the new password' \ --kapacitor-url=http://{Kapacitor_IP}:9094 \ --influxdb-url=http://{InfluxDB_IP}:8086 \ --retry-policy=count:3 \ --retry-policy=delaytime:5 \ --retry-policy=type:delay"

Run

$ sudo systemctl {start|stop|restart} cloudhub

CloudHub Portal UI 초기 설정

Steps

1. 로그인 창에서 Sign up(가입) 합니다.

2. 로그인 후, 아래와 같이 초기 설정에서 단계 별로 적절한 값으로 설정합니다.

   Image Modified

   초기 설정으로는 InfluxDB가 설치된 host IP 정도만 맞게 설정하면 됩니다.
   Connection Name는 Database(=Group) Name과 동일하면 편리합니다.

   Image Modified

   Add Connection → Next를 반복 클릭하여 마무리 합니다.

3. 아래 메뉴 화면에서 원하는 Group(Organization)을 추가합니다.

   Image Modified

4. “Agent Configuration > Minions” 메뉴 화면에서 새로 등록된 minion을 Operation 버튼을 통해 “Accept”합니다.

   Image Modified

5. “Agent Configuration > Collector Control”으로 이동 후, 설치하고자 하는 minion host를 선택하고 콤보박스에서 telegraf를 선택 후, INSTALL 합니다.

   Image Modified

6. Group을 지정한 후, [[outputs.influxdb]]을 설정한 후, Test 후, Apply 합니다.

   Image Modified

   그 외 필요한 설정은 Telegraf Configuration 항목을 참고 합니다.
   또한, Plugins 목록의 “?” 버튼을 클릭하면 해당 Plugin의 기본 Configuration 방법에 대한 help 창이 출력 됩니다. Copy & Paste를 통해 편리하게 Configuration을 편집할 수 있습니다.

주의 사항

위 설정까지 완료하고 나면, InfluxDB에 동적으로 Database가 생성됩니다.