Installing and configuring the Salt master
In this section, we are going to configure the most important component of the Salt architecture—the Salt master. We'll install the Salt master package and configure the most important parameters needed for our infrastructure.
Let's see how we can install the Salt master on various types of OS.
Installing the Salt master on RedHat/CentOS/Fedora
- Salt packages are available in the EPEL repository. First, the repository needs to be added to the system. As the system being used is CentOS 6.5 (64-bit), we are using the
epel-release package at http://dl.fedoraproject.org/pub/epel/6/x86_64/. This needs to be changed as per the version and architecture of the operating system being used: - After the EPEL release package has been installed, we will install the
salt-master package with the following command, and the dependencies should automatically be fetched from the repository:
Installing the Salt master on Ubuntu
While installing the Salt master on Ubuntu, the SaltStack PPA repository needs to be added to the system. It is to be noted that the following commands need to be executed as a privileged user, that is, either the root user can be used, or the sudo command needs to be added before the mentioned commands:
- The following command adds the
add-apt-repository binary to the system: - Now, we will add the repository with the command given here:
- The Salt master package then needs to be installed with the following command:
Configuring the Salt master
The primary configuration file for the Salt master is /etc/salt/master. It is also a good practice to create additional configuration files in /etc/salt/master.d/ with the .conf extension, and they will get read along with all the other files when the Salt master daemon starts.
Most of the Salt configuration parameters are set by default and need not be set explicitly. However, let's look at some of the important parameters that can be altered to suit one's needs:
- To determine which network interface the service binds to:
- The port on which to listen to for client node (minion) communications:
- The path that gets prepended to other files such as
log_file, pki_dir, and cache_dir if set. It is also to be noted that this path gets prepended to all other defined configuration parameters in the master configuration files, where each of them is also explained in detail: - The directory to hold the master and minion keys that have already been authenticated or rejected:
- The file containing log entries for the master daemon:
- The file that allows the keys of the host's that match the listed patterns to be accepted automatically (it is always a good practice to define this file). We will uncomment this line and set the filename as follows:
- Edit the file
/etc/salt/autosign.conf and set the content to be a wild card entry as follows (this is being done to facilitate easier demonstrations in the rest of the book, it is to be noted that this is a security risk otherwise): - The Salt service daemon then needs to be started and configured to start at boot time.
On RedHat/CentOS/Fedora:
On Ubuntu, the installation process automatically starts the daemon, hence the daemon needs to be restarted:
The firewall needs to be configured to allow communication on ports 4505 and 4506 from the minions:
- Save the firewall rules:
On RedHat/CentOS/Fedora:
On Ubuntu:
In the scenario that a virtualized environment is being used, such as a cloud provider, the aforementioned ports should be opened in the respective security group of the master node.
The salt-master is the package for the Salt master service and it also requires a few other dependencies, such as the ZeroMQ library, msgpack, jinja, yaml, and so on, which is automatically pulled along with the package from the configured repositories.
Most of the Salt configuration parameters are set by default and need not be explicitly mentioned in the file. The options can be found commented in the file and act as the defaults. However, if they need to be changed, then they can be uncommented and necessary changes can be made.
We have explicitly uncommented the autosign_file parameter and set the value as /etc/salt/autosign.conf:
We then populated the file with a wildcard entry, that is, *, to allow all minions' certificate requests to be automatically signed and accepted by the master.
Finally, the service daemons for salt master are started/restarted, configured to start automatically at boot time, and firewalls are configured to open the ports 4505 and 4506 for communication with the minions using the system-specific commands.
Free Chapter
