forked from SUSE/salt-netapi-client
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Copy Docker image containers to launch SaltStack master (+ net-api) and minion from https://github.com/mbologna/salt-docker-demo - Put everything under docker/ directory (perhaps this should be a git-subtree? from the above repo?) - Everything (especially etc_* directories are needed for travis container launching because they contain configurations and keys/certs). - Dockerfile(s) are NOT needed but I added them for clarification (just to show how the container recipe).
- Loading branch information
Showing
20 changed files
with
2,097 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
FROM ubuntu:14.04 | ||
MAINTAINER Michele Bologna <michele.bologna@gmail.com> | ||
|
||
RUN apt-get update && \ | ||
apt-get install -qqy wget supervisor && \ | ||
wget -O - https://repo.saltstack.com/apt/ubuntu/ubuntu14/latest/SALTSTACK-GPG-KEY.pub | sudo apt-key add - && \ | ||
echo "deb http://repo.saltstack.com/apt/ubuntu/ubuntu14/latest trusty main" >> /etc/apt/sources.list && \ | ||
apt-get update && \ | ||
apt-get install -qqy salt-master salt-api && \ | ||
useradd saltdev -p '$6$0BIlOqYqg5Rcuu5A$ojdWZ.aZztdSqPCnqsEE3ViRDcFAZ0MSp0UUvT23GG5mnbUOcalZPh8basKox2wcn4F1if2kfChOO/J1K2boe.' && \ | ||
apt-get clean && \ | ||
rm -fr /var/lib/apt/lists/* | ||
|
||
COPY etc_master/supervisord.conf /etc/supervisor/conf.d/supervisord.conf | ||
VOLUME ["/etc/salt"] | ||
EXPOSE 8000 | ||
CMD ["/usr/bin/supervisord"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
FROM ubuntu:14.04 | ||
MAINTAINER Michele Bologna <michele.bologna@gmail.com> | ||
|
||
RUN apt-get install -qqy wget && \ | ||
wget -O - https://repo.saltstack.com/apt/ubuntu/ubuntu14/latest/SALTSTACK-GPG-KEY.pub | sudo apt-key add - && \ | ||
echo "deb http://repo.saltstack.com/apt/ubuntu/ubuntu14/latest trusty main" >> /etc/apt/sources.list && \ | ||
apt-get update && \ | ||
apt-get install -qqy salt-minion && \ | ||
apt-get clean && \ | ||
rm -fr /var/lib/apt/lists/* | ||
|
||
VOLUME ["/etc/salt"] | ||
CMD ["/usr/bin/salt-minion"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,111 @@ | ||
# SaltStack Dockerfiles | ||
|
||
## Introduction | ||
|
||
This repository contains two **Dockerfile**s of [*SaltStack*](https://http://saltstack.com) for [Docker](https://www.docker.com/)'s automated build published to the public [Docker Hub Registry](https://registry.hub.docker.com/). | ||
|
||
In particular, this repository contains two Docker images: | ||
|
||
* [**saltstack-master**](https://registry.hub.docker.com/u/mbologna/saltstack-master): a SaltStack master container image with netapi module (cherrypy) enabled. | ||
This container works with `supervisord` to automatically launch `salt-master` and `salt-api` daemons. | ||
* [**saltstack-minion**](https://registry.hub.docker.com/u/mbologna/saltstack-minion): a SaltStack minion container image. | ||
|
||
Both of the images *expect* that you declare a volume in which you pass config files and keys (see `etc_*` directories and usage). | ||
In this way, the two images are standard and can be customized by specifing a volume with config files. | ||
|
||
## Base Docker image | ||
|
||
* ubuntu/14.04 | ||
|
||
## Installation | ||
|
||
1. Install [Docker](https://www.docker.com/). | ||
|
||
2. Download [SaltStack master automated build](https://registry.hub.docker.com/u/mbologna/saltstack-master) from public [Docker Hub Registry](https://registry.hub.docker.com/): `docker pull mbologna/saltstack-master` | ||
|
||
(alternatively, you can build an image from Dockerfile: `docker build -t="mbologna/saltstack-master" github.com/mbologna/saltstack-master`) | ||
|
||
3. Download [SaltStack minion automated build](https://registry.hub.docker.com/u/mbologna/saltstack-minion) from public [Docker Hub Registry](https://registry.hub.docker.com/): `docker pull mbologna/saltstack-master` | ||
|
||
(alternatively, you can build an image from Dockerfile: `docker build -t="mbologna/saltstack-minion" github.com/mbologna/saltstack-minion`) | ||
|
||
## Usage | ||
|
||
### run saltstack-master | ||
|
||
% docker run -d --name saltmaster \ | ||
-v `pwd`/etc_master/salt:/etc/salt \ | ||
-p 8000:8000 \ | ||
-ti mbologna/saltstack-master | ||
|
||
### run saltstack-minion1 | ||
|
||
% docker run -d --name saltminion1 \ | ||
--link saltmaster \ | ||
-v `pwd`/etc_minion1/salt:/etc/salt mbologna/saltstack-minion | ||
|
||
### run saltstack-minion2 | ||
|
||
% docker run -d --name saltminion2 \ | ||
--link saltmaster \ | ||
-v `pwd`/etc_minion2/salt:/etc/salt mbologna/saltstack-minion | ||
|
||
### have fun! | ||
|
||
Now you can access `saltstack-master` either via NetAPI: | ||
|
||
|
||
% curl -sS http://localhost:8000/login \ | ||
-c ~/cookies.txt \ | ||
-H 'Accept: application/json' \ | ||
-d username=saltdev \ | ||
-d password=saltdev \ | ||
-d eauth=pam | ||
{"return": [{"perms": [".*"], "start": 1446379166.406894, "token": "4072d45939ad1a33ffbe0565ec7d15d0cf2e24c2", "expire": 1446422366.406895, "user": "saltdev", "eauth": "pam"}]}% | ||
% curl -sS http://localhost:8000 \ | ||
-b ~/cookies.txt \ | ||
-H 'Accept: application/json' \ | ||
-d client=local \ | ||
-d tgt='*' \ | ||
-d fun=test.ping | ||
{"return": [{"minion1": true, "minion2": true}]}% | ||
|
||
|
||
or via command line: | ||
|
||
% docker exec saltmaster /bin/sh -c "salt '*' test.ping" | ||
minion1: | ||
True | ||
minion2: | ||
True | ||
|
||
### (optional) configure additional minions | ||
|
||
I'm sure you grasp the main concept now: | ||
|
||
1. Generate keys and certs and place them in `/etc/salt` | ||
2. Launch a saltstack-minion mapping `/etc/salt/` the correct volume and link the container to `saltmaster` container | ||
3. Remember to accept minion keys on saltstack-master | ||
4. Conquer the world | ||
|
||
## Caveats and security | ||
|
||
1. `saltstack-master` exposes port 8000/tcp (**NO SSL**) in order to consume `salt-api` via its HTTP interface. | ||
**WARNING**: your credentials travel in plain-text. | ||
|
||
2. Please note that the provided keys and certs are intended to use **ONLY** in test environments. **DO NOT** use them in production. | ||
|
||
3. I couldn't get `saltstack-master` to work with EAUTO auth module. | ||
Workaround: I had to manually add a `saltdev` user (password: `saltdev`) to the container (see `Dockerfile-master`) and use PAM authentication. Again, use these containers only in test environments. | ||
|
||
## Credits | ||
|
||
Credits goes to [@UtahDave](https://github.com/UtahDave/salt-vagrant-demo/): I copied certs and keys from its `salt-vagrant-demo` repository. | ||
|
||
## Contributing | ||
|
||
1. Fork it | ||
2. Create your feature branch (`git checkout -b my-new-feature`) | ||
3. Commit your changes (`git commit -am 'Add some feature'`) | ||
4. Push to the branch (`git push origin my-new-feature`) | ||
5. Create new Pull Request |
Oops, something went wrong.