Docker中的盐主和盐从连接出现问题

Question

我在最新版本的ubuntu中连接salt master和salt minion时遇到问题。https://bitbucket.org/jmarhee/saltstack-docker/src我使用了这个参考，但由于它使用的是旧版本的ubuntu，我在docker构建文件中更新了ubuntu。但在更新了ubuntu版本后，它就无法与salt master连接了。

以下是文件。提前谢谢。

salt_master_docker_file

FROM ubuntu:latest
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y wget gnupg
RUN wget -O - https://repo.saltstack.com/py3/ubuntu/20.04/amd64/3001/SALTSTACK-GPG-KEY.pub | apt-key add -
RUN echo "deb http://repo.saltstack.com/py3/ubuntu/20.04/amd64/latest focal main" | tee -a /etc/apt/sources.list.d/saltstack.list
RUN apt-get update
RUN apt-get install -y salt-master

EXPOSE 4505 4506
COPY setup.sh /opt/setup.sh
ENTRYPOINT ["sh","/opt/setup.sh"]
CMD []

salt_master_setup.sh

#!/bin/bash
key_checker () {
x=1
while [ $x -le 250 ]
do
salt-key -A -y
x=$(( $x + 1 ))
sleep 1
done
echo "All available keys accepted." && salt "*" test.ping && 
touch /var/log/salt/master && 
tail -f /var/log/salt/master
}
service salt-master start && key_checker

salt_minion_Docker_file

FROM ubuntu:latest
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y wget gnupg
RUN wget -O - https://repo.saltstack.com/py3/ubuntu/20.04/amd64/3001/SALTSTACK-GPG-KEY.pub | apt-key add -
RUN echo "deb http://repo.saltstack.com/py3/ubuntu/20.04/amd64/latest focal main" | tee -a /etc/apt/sources.list.d/saltstack.list
RUN apt-get update
RUN apt-get install -y salt-minion curl

COPY setup.sh /opt/setup.sh
ENTRYPOINT ["sh","/opt/setup.sh"]
CMD []

salt_minion_setup.sh

#!/bin/bash
salt_minion_check () {
if [ ! -f /var/log/salt/minion ]; then
echo "File not found!" && 
touch /var/log/salt/minion && 
salt_minion_check
else
tail -f /var/log/salt/minion
fi
}
echo "master: master_1" >> /etc/salt/minion && 
echo "id: salt-minion-$(hostname)" >> /etc/salt/minion
service salt-minion start && 
salt_minion_check

主docker组成文件

version: '3'
services:
minion:
image: salt-minion
links:
- master
depends_on:
- master
networks:
saltnetwork:
aliases:
- minion

master:
image: salt-master
networks:
saltnetwork:
aliases:
- master
networks:
saltnetwork:
driver: bridge

Answer 1

根据Saltstack文档，有一种方法可以在master上预先设置密钥，以避免交互接受。

如果你只想用docker-compose培养一名盐师和一名仆从，那么下面这样的东西就足够了。

在Docker主机上生成salt-key。这将生成minion1.pub和minion1.pem。

salt-key --gen-keys=minion1

然后我们将在Dockerfile中使用各自的公钥和私钥。示例盐母版Dockerfile:

FROM ubuntu:focal
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get -y install gnupg
COPY SALTSTACK-GPG-KEY.pub /tmp/SALTSTACK-GPG-KEY.pub
COPY saltstack.list /etc/apt/sources.list.d/saltstack.list
RUN apt-key add /tmp/SALTSTACK-GPG-KEY.pub
RUN apt-get update && apt-get install -y salt-master
COPY minion1.pub /etc/salt/pki/master/minions/minion1

示例盐爪Dockerfile:

FROM ubuntu:focal
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get -y install gnupg
COPY SALTSTACK-GPG-KEY.pub /tmp/SALTSTACK-GPG-KEY.pub
COPY saltstack.list /etc/apt/sources.list.d/saltstack.list
RUN apt-key add /tmp/SALTSTACK-GPG-KEY.pub
RUN apt-get update && apt-get install -y salt-minion
COPY minion1.pem /etc/salt/pki/minion/minion.pem
COPY minion1.pub /etc/salt/pki/minion/minion.pub
COPY id.conf /etc/salt/minion.d/id.conf

上述id.conf很简单：

id: minion1

默认情况下，盐小黄人会查找salt主机名。如果它解析为盐主，则使用它。因此，我们可以在docker-compose.yml文件中利用这一点。

version: '3'
services:
minion1:
image: myminion
command: salt-minion
salt:
image: mymaster
command: salt-master
ports:
- 4505
- 4506

注意：

当我们使用salt-key -A命令接受一个爪牙的密钥时，它会在引擎盖下将爪牙的公钥从/etc/salt/pki/master/minions_pre/移动到主机上的/etc/salt/pki/master/minions。