[wiki] use:saltstack

[sjorge]

Introduction

This document describes how to set up a salt-master using pkgsrc packages available on SmartOS. Most of the information is applicable to other pkgsrc platforms but you may need to change paths and init services.

This was all done using the following image: 23b267fc-ad02-11e7-94da-53e3d3884fe0

what is saltstack

Saltstack is a modern tool for IT automation, it offers both configuration management, remote command execution, and much more. Here after refered to as salt.

It can both be use in a standalone mode and a mode where all minions (clients) talk to a master. In this guide we will cover bootstrapping a master from a minion running in standalone mode.

setting up the salt-master

We will use salt to setup our salt-master, we call this node salt.example.org.
The initial execution will be salt in standalone mode.

installing the packages

: Install package
$ pkgin -y install salt py27-pygit2 git-base

: Edit the minion config file
$ vi /opt/local/etc/salt/minion

/opt/local/etc/salt/minion

####
## bootstrap configuration (standalone)
####
## minion id
# NOTE: we set both the id and append_domain beacause we are running
#       on illumos where socket.getfqdn() does not behave properly from
#       salt's perspective.
id: salt
append_domain: example.org

## configure local pillar/state storage and the salt-formula from git
file_client: local
file_roots:
  base:
    - /var/salt/file-roots
pillar_roots:
  base:
   - /var/salt/pillar-roots
fileserver_backend:
  - roots
  - git
gitfs_remotes:
  - http://github.com/saltstack-formulas/salt-formula.git

# vim: tabstop=2 expandtab shiftwidth=2 softtabstop=2

create a bare minimal salt environment

Here we create a bare minimal salt environment that manages the salt-master on salt.example.org and will manage the salt-minion on all other nodes.

: Lets explorer what salt knows about our system
salt-call grains.items

: Find out if we are identified as salt.example.org (FQDN, also id and domain set earlier)
salt-call grains.get id

We make sure that salt identifies us correctly. More information about grains can be find in the SaltStack Docs

: Create a top.sls for our states
$ vi /var/salt/file-roots/top.sls

: Create top.sls for our pillar
$ vi /var/salt/pillar-roots/top.sls

: Create salt.sls to hold our salt-master/minion configuration
$ vi /var/salt/pillar-roots/salt.sls

: Override some salt configuration if we are the salt-master node.
$ mkdir -p /var/salt/pillar-roots/minion/
$ vi /var/salt/pillar-roots/minion/salt_example_org.sls

: Bootstrap ourselves
$ salt-call state.apply

: Accept our key so the master can talk to itself
$ salt-key -y -a salt.example.org

After this the master is still configured to work in standalone mode, this is by design.
In theory you can always rebootstrap the master this way.

To run salt standalone: salt-call state.apply
To run salt from the master on a minion: salt minion_id state.apply

Basically we said that salt.example.org should get both the salt.master and salt.minion state and all other nodes should get the salt.minion state. We provided those states with information they need to configure everything for us using the salt pillar.

There is a big collection of formulas available for other software, you can learn more here.

/var/salt/file-roots/top.sls

####
## top state
####
base:
  # NOTE: we bootstrap the last master
  'salt.example.org':
    - salt.master
  # NOTE: manage minion configuration on all nodes
  '*':
    - salt.minion

# vim: tabstop=2 expandtab shiftwidth=2 softtabstop=2

/var/salt/pillar-roots/top.sls

[root@salt /var/salt/pillar-roots]# cat top.sls
####
## top pillar
####
{% set safe_id = salt['grains.get']('id')|replace('.', '_') %}
base:
  # NOTE: on all minions we include:
  #       - salt configuration
  #       - minion specific overrides
  '*':
    - salt
{% if salt['file.file_exists']('minion/{0}.sls'.format(safe_id)) %}
    - minion.{{ safe_id }}
{% endif %}

# vim: tabstop=2 expandtab shiftwidth=2 softtabstop=2

/var/salt/pillar-roots/salt.sls

####
## salt configuration
####
salt:
  append_domain: example.org
  master_remove_config: True
  minion_remove_config: True
  minion:
    master: salt.example.org

# vim: tabstop=2 expandtab shiftwidth=2 softtabstop=2

/var/salt/pillar-roots/minion/salt_example_org.sls

####
## salt master configuration
####
salt:
  ## NOTE: configure the salt master
  master:
    fileserver_backend:
      - roots
      - git
    gitfs_remotes:
      - https://github.com/saltstack-formulas/salt-formula.git
    file_roots:
      base:
        - /var/salt/file-roots
    pillar_roots:
      base:
        - /var/salt/pillar-roots
  ## NOTE: configure this salt minion to work standalone
  minion:
    id: salt
    append_domain: example.org
    file_client: local
    fileserver_backend:
      - roots
      - git
    gitfs_remotes:
      - https://github.com/saltstack-formulas/salt-formula.git
    file_roots:
      base:
        - /var/salt/file-roots
    pillar_roots:
      base:
        - /var/salt/pillar-roots

# vim: tabstop=2 expandtab shiftwidth=2 softtabstop=2

setting a new minion

Now that we have a master, we want some minions we can manage and configure.

installing the packages

: Install package
$ pkgin -y install salt

: Announce the minion to the master
$ mkdir -p /opt/local/etc/salt/pki/minion
$ salt-call --master=salt.example.org --id=saltmin.example.org test.ping

: Accept the minion's key on the master
$ salt-key -y -a minion_id

: Bootstrap the minion
$ salt-call --master=salt.example.org --id=saltmin.example.org state.apply

[sjorge]

Couldn't figure out how to create a wiki-page and do a pull request for this, so doing it in the issue.

[sjorge]

@jperkin I guess this got closed by mistake?

[jperkin]

Stupid GitHub auto-close.