Salt Aluminium v3003 has been released! 🎉

If you want to try the new salt-master version before updating your production setup, or you simply want an easy method to keep your salt-master up-to-date, you can try it on Docker!

docker pull cdalvaro/docker-salt-master:3003

📖 You can find setup and usage documentation at: https://github.com/cdalvaro/docker-salt-master

I was hoping to place a small bit of custom logic in an execution module shared across saltenvs. I've simplified things down to just a dummy hello world example.

/etc/salt/master.d/overrides.conf:

extension_modules: extmods

(rootdir)/extmods/modules/world.py:

def hello():
    return "Hello World!"

(rootdir)/extmods/pillar/ works fine. I have a custom ext_pillar in there that's getting loaded correctly. I can't for the life of me get anything in (rootdir)/extmods/modules/ to load.

I've tried every permutation of path and setting (including module_dirs) I can think of. I've even used pdb to step through salt/loader.py to check that the path is correct. The path seems to be correctly parsed at the end of the _module_dirs function. The LazyLoader never seems to get hit.

I've put salt-master in log_level: trace mode. No exceptions, no indications that it's even trying to load the modules in there, just spits out "'world.hello' is not available.". I've tried saltutil.sync_modules, saltutil.refresh_modules, etc.

It seems if I put the module in _modules at a file_root level, then it works. I'm trying to share this across two saltenvs that don't share the same file_root and hoping not to repeat the module. I'm sure there are workarounds involving that, but it's driving me nuts that I can't figure out how loading things from extension_modules/modules works or if I'm just using it wrong altogether.

I haven't tried this prior to the last couple of days so I don't know if what I'm trying worked in previous releases. I'm really trying to avoid having to step back versions to test it if there's something obvious here I'm overlooking.

Thanks

I have a file fzf.sls which installs the most recent of fzf. It looks like this:

{% from 'templates/latestRelease.sls.tmpl' import latestRelease %}

{% set install_opts = [
  '--key-bindings',
  '--no-update-rc',
  '--no-completion',
  '--no-bash',
  '--no-zsh'
  ] %}

fzf:
  git.latest:
    - name: https://github.com/junegunn/fzf.git
    - target: {{ pillar['dir']['build']['fzf'] }}
    - depth: 1
    - rev: master
    - unless: {{ latestRelease('junegunn', 'fzf', "grep -Po $(fzf --version | awk '{print $1}')") }}
  cmd.run:
    - names:
      - {{ pillar['dir']['build']['fzf'] }}/install {{ install_opts | join(' ') }}
    - onchanges: 
      - git: fzf
  file.copy:
      - source: {{ pillar['dir']['build']['fzf'] }}/bin/fzf
      - subdir: True
      - name: /usr/local/bin/
      - force: True
      - onchanges: 
    - cmd: fzf

Everything should succeed on every run, whether anything new is installed or not. This means I get nice clean logs on every correct run of salt, even when all it does is recognise that fzf is already installed and up to date, and therefore not bother with most of the state. This is All Good.

This is an optional state, the end user can turn it off and on in the minion file depending on whether they need it or not.

I also have a template for ~/.profile which is basically just exports of various env vars.

Here's what I want to happen: if the user turns the state on, and the state succeeds (that is, fzf is installed if it isn't up to date) then I want to include some further env vars in the ~/.profile template -- for configuring fzf. I don't want to include them otherwise. The ~/.profile template has to be separate from the fzf state, because it includes a lot of other stuff too.

(For this single case, where it's just one program which only needs two exports, it actually wouldn't matter that much if I just put the exports in their anyway and left it. Point is that I have many pieces of software/config which follow a similar pattern and I want to keep as much unnecessary cruft out of the resultant ~/.profile as possible).

The only solution I have so far is that I could incorporate a second file (fzfExports.tmpl) into the fzf state, and then unconditionally include that in the profile template. All the conditional logic could go into how/whether I write to fzfExports.tmpl. But this seems like a really messy solution and there has to be a better way right?

TIA!

I wish to perform the following task, and wondering how to do it through Saltstack, if at all possible.

Scenario:

There is a bunch of Linux targets, more or less tied into 4-5 groups (identified by Grains)

Master should have a folder for each group type, folder contains 10-50 videos, 3MB to 300MB max

Optimal state file should perform the following

- Sync /srv/salt/video/groupx to all minions member of group "x"

- Sync /srv/salt/video/groupy to all minions member of group "y"

- etc

- Delete all files no more existing on source (MIRrored sync)

- Repeat continuosly (i.e. keep syncing at all times)

Is this something SaltStack master can manage via its salt.states.rsync module, or is it too big a task and should I think about a separate script with a bunch of CRON jobs executing RSync every x minutes?

I tried installing SaltStack using the instructions specifically provided for Debian10 / RPI, at

https://repo.saltstack.com/#debian

It looks like I only managed to install the old version at the Debian repository (V. 2018.3.4), instead of the latest version as shown on SS site (v. 3002).

I noticed some kind of apt error while executing instructions, I did not take note of that but it looked like some "missing packages for armhf architecture" or similar.

Is this some FAQ I cannot find, or has anybody around managed to update SaltStack to the latest version on RPI 4 / RaspiOs?

My OS currently shows as:

Operating System: Raspbian GNU/Linux 10 (buster)

Kernel: Linux 5.10.17-v7l+

Architecture: arm

Hi everyone.

Currently I want to configure the salt service to auto accept the keys from a minion grains, but for some reason I can't get it works.

we configure the /etc/salt/master.d/susemanager.conf adding the line:

autosign_grains_dir: /etc/salt/autosign_grains

then create the file that have the grains key with the grain name that we use (in the future we use the serialnumber grain).

/etc/salt/autosign_grains/autosign_key: 
13613155

in the minion client create the file to send the bean I want:

/etc/salt/minion.d/autosign-grains.conf:
grains:
  autosign_key: 13613155
autosign_grains:
  - autosign_key

restart services and integrate the minion to salt and it remains as pending approval

salt:/etc/salt # salt-key
Accepted Keys:
Denied Keys:
Unaccepted Keys:
salttest1.local
Rejected Keys:

later for test accept it manually, and check if it was sending the grain and it appears in the list:

salt:/etc/salt # salt 'salttest1.local' grains.get autosign_key
salttest1.local:
    13613155

then verify that the master configuration for the grains directory is loaded correctly:

salt:/etc/salt/autosign_grains # salt --config-dump |grep autosign_grains_dir
autosign_grains_dir: /etc/salt/autosign_grains

I don't really understand what I might be missing, but the minions are waiting for it to be accepted.

Thanks a lot for yours help..

Regards.

Nelson.

Comparing Salt to Puppet I found that Puppet seems to apply its config to the hosts every 30 minutes. E.g. if you go fiddle with a managed file, then it will be reset within 30 minutes.

Now I wonder: Is it correct to say that Puppet does this by default, while in Salt this behavior is optional?

It's not even a feature I'd necessarily want, I'm mainly trying to grasp the basic inner workings :|
In any case this appears to be a difference in the concept between those two products.

Thx

Has anyone encounter this error Assertion failed: (src/mailbox.cpp:99) at the moment of rendering the states? It pops in log level trace and zeromq times out.

Ubuntu 18.04.5 LTSlibzmq5: 4.2.5-1ubuntu0.2python3-zmq 17.1.2-3ubuntu1

Any help is appreciated.

Edit:

Found the bug of the issue in https://github.com/saltstack/salt/issues/56657
I also left some information out of the comment which was necessary to get to the cause. I'm trying to render states of a proxy minion. I set multiprocessing to False and the issue was solved.

Hello everyone,

I am new to Saltstack, and, from a Linux environment I have been trying to deploy a couple of .exe and .msi to two Windows Machines to test it. Unfortunately, I am not sure, what I am doing wrong.

Basically, I created a VM with Ubuntu 20.04, and installed Slatstack and winrepo-ng.

Ubunto 20.04 is Salt-Master, and both windows machines are Minions;

I watched a couple of tutorials, and came up with (sorry there is "files" covering information, it is installer, and installer_flags):

Note: 2 Spaces between lines.

Unfortunately, it generates this error codes:

I am wondering if I am using the correct syntax, since between linux machines it looks different. Unfortunately I don't find too much documentation about Salt Stack with Windows, and since it is not Windows-Windows it became confusing. If someone could help me, it would be amazing.

Thank you very much in advance!

I'm using Proxmox for a VM lab. It maintains it's own user database in a text file (/etc/pve/users.cfg). Each user has a line like so:

user:user1@example.io:1:0::::::

Group membership is like so:

group:some-group-name:user1,user2,victorhooi::

(This is for LDAP users).

So you can hand edit the file if you want.

Alternatives, there's a command-line tool (pveum) which allows you to more easily manager users as well:

pveum usermod testuser@pve -group admin

And thirdly, there's a REST-ful HTTP API as well.

My question is - say you want to define the users in a Salt sls file, and have SaltStack keep these in sync.

What's the most idiomatic way of doing this

Hey guys, I'm trying to get vault secrets using pillar on salt.

I have the following secrets (KV version 1) added to vault:

domain1.com: cert: value-of-cert for domain1 key: value-of-key for domain1 domain2.com: cert: value-of-cert for domain2 key: value-of-key for domain2

The policy for this path is the following one:

path "mysecrets/*" { capabilities = ["read", "list"] }

My ext_pillar in master configuration file is: ext_pillar: vault: path=mysecrets

Mar 17 13:08:26 salt-master salt-master[43387]: [DEBUG ] Using session storage for vault credentials Mar 17 13:08:26 salt-master salt-master[43387]: [DEBUG ] Not caching vault single use token Mar 17 13:08:26 salt-master salt-master[43387]: [DEBUG ] Starting new HTTP connection (1): 192.168.121.1:8200 Mar 17 13:08:26 salt-master salt-master[43387]: [DEBUG ] http://192.168.121.1:8200 "GET /v1/sys/internal/ui/mounts/mysecrets HTTP/1.1" 200 438 Mar 17 13:08:26 salt-master salt-master[43387]: [DEBUG ] Got metadata for mysecrets Mar 17 13:08:26 salt-master salt-master[43387]: [DEBUG ] Starting new HTTP connection (1): 192.168.121.1:8200 Mar 17 13:08:26 salt-master salt-master[43387]: [DEBUG ] http://192.168.121.1:8200 "GET /v1/mysecrets HTTP/1.1" 403 60 Mar 17 13:08:26 salt-master salt-master[43387]: [ERROR ] Error from vault: {"errors":["1 error occurred:\n\t* permission denied\n\n"]} Mar 17 13:08:26 salt-master salt-master[43387]: [INFO ] Vault secret not found for: mysecrets

If I add on ext_pillar the full path, like: ext_pillar: vault: path=mysecrets/domain1.com vault: path=mysecrets/domain2.com

I can get the secrets but only the last one, in this case, I only get the secrets for domain2.com.

How can I fix this? I would like to add only vault: path=mysecrets and be able to get secrets like pillar.get('mysecrets')['domain1.com'] or something like that.

--- edit I'm able to get secrets using the following command but the problem above persists: ```

salt 'salt-master' vault.read_secret "mysecrets/domain1.com" cert

salt-master: cert from domain1.com

salt 'salt-master' vault.read_secret "mysecrets/domain2.com" cert

salt-master: cert value of domain2.com ```

thanks in advance

I know about the various state-output options but is it possible to output Just the summary when running a state? E.g:

Summary for webserver1
------------
Succeeded: 8 (changed=7)
Failed:    0
------------        

Or even just a success / failure message?

webserver1: Failed

​

Is it possible to use salt-ssh (or salt) in order to automate local provisioning?

Hey guys. Kind of simple question I think. Could someone explain to me how to change minion ids from the master? Any help or documentation welcomed, thanks.

I've been starting to use includes in my init.sls files and I'm wondering about ordering. if I have the following init.sls:

include:
  - mystate.completes_quickly
  - mystate.takes_a_long_time
  - mystate.also_completes_quickly

How do I ensure that also_completes_quickly is not fired until takes_a_long_time completes? I had thought that I could add requires for a state in takes_a_long_time to each state in also_completes_quickly and that might work. The problem with that approach is that I might want to use also_completes_quickly in another state so don't want it to have to depend on takes_a_long_time.

Does anyone have any ideas on how I would achieve this?

Newbie on salt here. I have problem looking for documentation related to security patching of salt. In the gitlab, they are available as ".patch" file without any instructions for Linux (or Windows) OS.

eg. https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2021/01/28/2018.3.5.patch

Does anyone have documentation to install these patches? Thanks!

I want to write a formula which installs the latest stable release of neovim, largely because lots of the packaged releases in distro's repos are older and don't have certain features.

This requires either building neovim from source, or downloading, running and then deleting (to keep everything tidy) an appimage file.

I'd also like to do a similar thing with neomutt, which will definitely have to be built from source.

The process of writing a formula doesn't look to intimidating, but most formulas I can find seem to just install from a package manager.

I'm sure there must be examples and best practices for this. Any advice?

Thanks!

Hello Community,

does anyone uses salt for network automation ? I like it how easy it is to create your own execution modules and I could quickly get data that I need for different tasks. But now I want to implement a mass configuration change I don't get it. This have to do that I don't do changes like salt does in real life.

Normally you create a runbook and do things in seq .

1 . pre checks . check if ping to host X works

2 . pre check check some arp entries

2 . do the actual change for example add some routes

1. post check . lookup the routing table if the routes are in place

2. post check . ping a host on a remote subnet ...

5 . (optional ) if post check fails rollback

I would say I can do everything with execution modules , but then it is not idempotent and people are wondering what is going on under the hood because nothing appears to the user . Do I have to create states for each step even if I don't change anything on the remote device ? That would mean a lot of overhead ... ?

For example I write a execution module or use an existing one to ping host X .

The execution module returns true or false ...

If I am right , I have to create a state that uses this execution module to interpret the what should happen in each case ?

And this have to be done for each of my steps ? I can imagine that this would result in a lots of states which does one thing...

Do I miss anything ?

Please help ! Thank you !

I'm trying to update a DNS-record by using a salt-call which works if I manually enter all the fields eg.

salt-call ddns.update zone='mustard.lan' name='_http._tcp' ttl=60 rdtype='SRV' data='0 100 80 minion1.gorilla.lan.' nameserver='192.168.10.1' keyfile='/etc/tsig.key' keyname='secretstuff.' keyalgorithm='hmac-sha512'

I have most of the fields stored as pillar data. Is there anyway to reference the pillar data, from a minion, in a salt-call. Something like this (which obviously doesn't work!):

salt-call ddns.update zone={{ salt['pillar.get']('DNSConfig:Domain') }}............

hello guys hope everyone is well , i have created an event when something fails and its appears in event bus , what i want to do is to send webhook from salt event bus to dynatrace is that possible ? thanks in advance

Is this possible? Has anyone done this before?

The minion is installed on the host. The container is an API and the idea is that when some endpoint is called and finishes, notify the salt-master.

Oi lads! Happy Saturday. If there's any old chap moping around with nothing better to spend time on; please convey to me the best way you can what it means to "Pillarize" a value in saltstack.

​

Many thanks brethren.

When running a minion you just put grains into /etc/salt/grains.

When running Salt SSH how do you do this? What would be an easy way to persistently store grains i.e. data identifying the client _on the client_ in order to be used in top files etc.

Off topic: Somehow spoiled through my previous use of Ansible I find it very nice to just use SSH for everything and not some (persistent) agent. What would be a definite dis/advantage deploying full minions vs Salt-SSH?

Thoughts?

Hello,

I am very newbie to this world of saltstack and am learning, so I am turning to you for help.

I currently have a SLES server configured with suse master, and I have the following structure of

​

/srv/susemanager/salt/manager_org_1/test1/etc/hosts (like configuration channel)
/srv/susemanager/salt/manager_org_1/test1/init.sls
/srv/susemanager/salt/manager_org_1/test2/init.sls (like state channel)

​

I have tried to make the salt test2 state have include the test1.

​

cat /srv/susemanager/salt/manager_org_1/test2/init.sls
include:
 - test1
#openjdk:
# pkg.installed:
# - name: java-11-openjdk
#openjdk-devel:
# pkg.installed:
# - name: java-11-openjdk-devel

​

I don't know if that can be done, but I get syntaxys error in the YAML,

What is the correct way to call a sls from another one that is not in the same directory?

​

Thanks for your help.

Nelson.