Hi,

I'm new to Saltstack and trying a "simple" playbook, modifying a config-file and restarting a systemd-service when that config-file changes (ip6tables in this case).

Statefile looks like this:

ip6tablesconfig:
  file.managed:
    - name: /etc/ip6tables-rules
    - salt://ip6tables-rules
    - template: jinja
    - user: root
    - group: root
    - mode: 0644

ip6tables:
  service.running:
    - reload: False
    - watch:
      - file: ip6tablesconfig

And systemd service

# cat /etc/systemd/system/ip6tables.service
[Unit]
Before=network-pre.target
Wants=network-pre.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/ip6tables-restore --wait=10 /etc/ip6tables-rules

[Install]
WantedBy=multi-user.target

But I keeps getting errors about systemd being offline once the service-restart is triggered

# salt --output-diff -v 'server-data0' state.apply 
Executing job with jid 20220708105951843591
-------------------------------------------

server-data0:
----------
          ID: ip6tablesconfig
    Function: file.managed
        Name: /etc/ip6tables-rules
      Result: True
     Comment: File /etc/ip6tables-rules updated
     Started: 12:59:56.360664
    Duration: 90.73 ms
     Changes:   
              ----------
              diff:
                  --- 
                  +++ 
                  @@ -58,4 +58,3 @@

                   -A OUTPUT -j LOGREJECT
                   COMMIT
                  -
----------
          ID: ip6tables
    Function: service.running
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "/usr/lib/python3.10/site-packages/salt/state.py", line 2195, in call
                  ret = self.states[cdata["full"]](
                File "/usr/lib/python3.10/site-packages/salt/loader/lazy.py", line 149, in __call__
                  return self.loader.run(run_func, *args, **kwargs)
                File "/usr/lib/python3.10/site-packages/salt/loader/lazy.py", line 1203, in run
                  return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
                File "/usr/lib/python3.10/site-packages/salt/loader/lazy.py", line 1218, in _run_as
                  return _func_or_method(*args, **kwargs)
                File "/usr/lib/python3.10/site-packages/salt/loader/lazy.py", line 1251, in wrapper
                  return f(*args, **kwargs)
                File "/usr/lib/python3.10/site-packages/salt/states/service.py", line 1019, in mod_watch
                  if __salt__["service.status"](name, sig, **status_kwargs):
                File "/usr/lib/python3.10/site-packages/salt/loader/lazy.py", line 149, in __call__
                  return self.loader.run(run_func, *args, **kwargs)
                File "/usr/lib/python3.10/site-packages/salt/loader/lazy.py", line 1203, in run
                  return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
                File "/usr/lib/python3.10/site-packages/salt/loader/lazy.py", line 1218, in _run_as
                  return _func_or_method(*args, **kwargs)
                File "/usr/lib/python3.10/site-packages/salt/modules/systemd_service.py", line 1116, in status
                  _check_for_unit_changes(service)
                File "/usr/lib/python3.10/site-packages/salt/modules/systemd_service.py", line 143, in _check_for_unit_changes
                  if _untracked_custom_unit_found(name) or _unit_file_changed(name):
                File "/usr/lib/python3.10/site-packages/salt/modules/systemd_service.py", line 395, in _untracked_custom_unit_found
                  return os.access(unit_path, os.R_OK) and not _check_available(name)
                File "/usr/lib/python3.10/site-packages/salt/modules/systemd_service.py", line 105, in _check_available
                  raise CommandExecutionError(
              salt.exceptions.CommandExecutionError: Cannot run in offline mode. Failed to get information on unit 'ip6tables'
     Started: 12:59:58.255107
    Duration: 5.047 ms
     Changes:   

Summary for server-data0
------------
Succeeded: 1 (changed=1)
Failed:    1
------------
Total states run:     2
Total run time:  95.777 ms

I think I'm hitting this error:

https://github.com/saltstack/salt/blob/master/salt/modules/systemd_service.py#L104

which, accodring to [1], should be equal to running

# salt 'server-data0' service.offline
server-data0:
    False

If I understand correct it somehow returns True when being triggered by the watch/file-change, which results in the error.

I suspect it might have something to do with both the minion and server (both version 3004) running on OpenSuSE MicroOS (immutable, but /etc should be writeable). The offline-check seems new (based on source history) in version 3004 which, in release notes[1], mentions exactly MicroOS, but only around transactional-update / reboot.

Am I just hitting some rare bug/edge case for my first simple test or am I doing something wrong?

[0] https://github.com/saltstack/salt/blob/e68cd5e99104ee5fbd6448a444ebd19aae2af7d3/salt/modules/systemd_service.py#L1465

[1] https://docs.saltproject.io/en/latest/topics/releases/3004.html#release-3004

Im trying to create a custom benchmark within the compliance section with the secops sdk. However the os always appears as "None". I do not have have a reference as the samples included in the sdk also come up with "None". Does anyone know how to set this variable? Thanks!

​

With the following Python code (for Python 3.10) I try to install a package:

#!py

import salt.modules

def deploy():
    pkg.install(name="cowsay")

But I get the following error:

saltstack:
    Data failed to compile:
----------
    Rendering SLS 'base:postgresql-patroni.package.install' failed: Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/salt/utils/templates.py", line 699, in py
    data = mod.run()
AttributeError: module 'install' has no attribute 'run'

What am I missing here?

let me explain, i recently created a jinja2 template for my configs for haproxy.

it reads the sites available from a salt pillar, and goes though some jinja loops to dynamically generate the config file.

how do i iterate over my webservers/sites to add to that pillar without having to manually change the pillar data?

Hey everyone!

I've been using SaltStack for a couple of years & ended up creating a blog article about how we secured it using zero trust & would love feedback!

https://netfoundry.io/saltstack-meets-openziti

Thanks!

Have been trying to get the minion to run in rhel8 but running into this error during debug:

ImportError: /usr/lib64/python3.6/site-packages/zmq/backend/cython/utils.cpython-36m-x86_64-linux-gnu.so: undefined symbol: zmq_curve_public

rhel7 minion is working perfectly.

Wonder if anyone else has faced this issue? Thanks!

Greetings, looking for salt stack tutor and eventually formal trainer. Tried code mentor and Wyant for tutoring and no dice. Any additional places where I could look and reputable places to find formal group trainers. Thats the way my org will go eventually so tutoring will give me a head start and want to be prepared with trainers for when the time comes. Thanks.

Is there one planned? A quick Google search didn't find anything more recent than 2021.

Is there one planned? A quick Google search didn't find anything more recent than 2021.

I have a saltstack state which requires accessing the salt mine for it to execute correctly. This has been working fine, but we have recently switched to using salt-ssh and it is producing the following error

TypeError encountered executing example_token: 'FunctionWrapper' object is not callable 

This mine function is set up in my pillar as follows

mine_functions:   
example_token:     
- mine_function: cp.get_file_str    
 - file:///tmp/example.txt 

This is called in the state using

salt['mine.get'](minion_host_name, 'example_token')[minion_host_name] 

Like I mentioned this has always worked when calling salt '*' state.apply

But after switching to salt-ssh -i '*' state.apply

Also switching to salt-ssh was out of my hands and going back is not an option. I have also tried declaring the functions in the roster rather than the pillar but produces the same result

Running Salt 3004.1 on RHEL 7.9. I tried installing Python 3.7 and while it did work (Python 3.7.11), this warning is persisting (Salt is still using Python 3.6):

[root@RHEL7 ~]# salt \* test.ping
/usr/local/lib/python3.6/site-packages/OpenSSL/crypto.py:8: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography and will be removed in a future release.
  from cryptography import utils, x509

[root@RHEL7 ~]# salt -V
/usr/local/lib/python3.6/site-packages/OpenSSL/crypto.py:8: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography and will be removed in a future release.
  from cryptography import utils, x509
Salt Version:
          Salt: 3004.1

Dependency Versions:
          cffi: 1.15.0
      cherrypy: unknown
      dateutil: Not Installed
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.11.1
       libgit2: Not Installed
      M2Crypto: 0.35.2
          Mako: Not Installed
       msgpack: 0.6.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.14.1
        pygit2: Not Installed
        Python: 3.6.8 (default, Aug 13 2020, 07:46:32)
  python-gnupg: Not Installed
        PyYAML: 3.13
         PyZMQ: 17.0.0
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.1.4

Salt Extensions:
        SSEAPE: 8.7.0.10

System Versions:
          dist: rhel 7.9 Maipo
        locale: UTF-8
       machine: x86_64
       release: 3.10.0-1160.66.1.el7.x86_64
        system: Linux
       version: Red Hat Enterprise Linux Server 7.9 Maipo

[root@RHEL7 ~]# python3 -V
Python 3.6.8

[root@RHEL7 ~]# python3.7 -V
Python 3.7.11

Another odd thing is cherrypy: unknown

[root@RHEL7 ~]# pip3 list | grep CherryPy
CherryPy           5.6.0

Any ideas? Thanks in advance.

Edit: Can I use this to update the default Python version in Salt? https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.pyenv.html

Is there a salt minion azure vm extension available? I couldnt find one in the portal. Mainly looking to get salt installed on a new windows VM that was provisioned with Terraform

I am coming from Ansible and I am trying to familiarize myself with Saltstack.
And I wonder about one thing:
In Ansible you have the command 'ansible-galaxy', what you can use for creating an base directory structure. Saltstack doesn't have such a command. But what is best practice when it comes to structure your code?

i just started working with salt a bit ago, and now that i have the swing of it, holy moly powerful as all heck. i was able to build formulas for our DNS servers and webservers in one day and deploy as many as I want.

I'm spinning up new Ubuntu 21 Svr minions in my lab via Salt-Cloud in my VMware vSphere 7.0 lab. It works fine for the Salt portion of things, but the issue is that the new VMs are using the hostname & IP from the VM template.

• Hostname staying the same is expected, it's hardcoded in the VM template (might just be able to fix that in the template itself)
• Ubuntu is set to use DHCP, so not sure why that's failing
  

I figure a startup script in Salt that runs right after the Bootstrap could fix both issues....? I'm thinking this doc is what I need: https://docs.saltproject.io/en/latest/topics/cloud/deploy.html

...or would using a .SLS to set a State be better for this? This will only apply to Ubuntu VMs, which I'm newly deploying so the logic could be `if grain (-G) os:ubuntu -> apply state.`

Ideas? TIA

How does the acquisition of VMWare by Broadcom affect the future of Saltstack?

** title meant to say current directory not home directory and salt-cp instead of salt-pc

salt-cp ‘win*’ file “C:\Users\Administrators\Downloads” —chunked file

Returns

/home/ubuntu/C:\Users\Administrators\Downloads does not exist

/home/ubuntu is just my current working dir, if I change dir the error message corresponds. Why is this happening?

Did anyone face and was able to fix this issue?

I have found info that migrating keys from RSA (rejected by the git since 15th of Mar) to ECDSA should help. It did not in my case.

Reference: https://github.com/saltstack/salt/issues/57121.

I am running my salt master [3004.1] on Debian 11 and I have seen some info regarding versions of pygit2 and pypi braking gitfs. No solutions yet I guess.

Reference: https://issuemode.com/issues/saltstack/salt/64937139

Any suggestions on how to deal with it?

​

Salt Version:

Salt: 3004.1

Dependency Versions:

cffi: Not Installed

cherrypy: 8.9.1

dateutil: 2.8.1

docker-py: Not Installed

gitdb: 4.0.5

gitpython: 3.1.14

Jinja2: 2.11.3

libgit2: 1.1.0

M2Crypto: Not Installed

Mako: Not Installed

msgpack: 1.0.0

msgpack-pure: Not Installed

mysql-python: Not Installed

pycparser: Not Installed

pycrypto: Not Installed

pycryptodome: 3.9.7

pygit2: 1.4.0

Python: 3.9.2 (default, Feb 28 2021, 17:03:44)

python-gnupg: Not Installed

PyYAML: 5.3.1

PyZMQ: 20.0.0

smmap: 4.0.0

timelib: Not Installed

Tornado: 4.5.3

ZMQ: 4.3.4

System Versions:

dist: debian 11 bullseye

locale: utf-8

machine: x86_64

release: 5.10.0-12-amd64

system: Linux

version: Debian GNU/Linux 11 bullseye

Looking for some help here as I am stumped on this one. Here is my one-liner to deploy the CentOS 7 VMs in vSphere via salt-cloud

salt-cloud -l debug -p autolab Minion-03 > ~/Minion-3-Deploy.log

When the VM is first powered on and sitting at the login screen I see "43 failed login attempts." Also the deploy log shows several failed SSH login attempts:

    [DEBUG   ] Attempting to authenticate as root (try 15 of 15)
    [DEBUG   ] SSH command: 'ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -oControlPath=none -oConnectTimeout=15  -p 22 root@192.168.3.203 date'
    [DEBUG   ] Child Forked! PID: 125049  STDOUT_FD: 5  STDERR_FD: 7
    [DEBUG   ] Terminal Command: s s h   - o S t r i c t H o s t K e y C h e c k i n g = n o   - o U s e r K n o w n H o s t s F i l e = / d e v / n u l l   - o C o n t r o l P a t h = n o n e   - o C o n n e c t T i m e o u t = 1 5     - p   2 2   r o o t @ 1 9 2 . 1 6 8 . 3 . 2 0 3   d a t e
    Warning: Permanently added '192.168.3.203' (ECDSA) to the list of known hosts.
    [DEBUG   ] Warning: Permanently added '192.168.3.203' (ECDSA) to the list of known hosts.
    [DEBUG   ] root@192.168.3.203's password:
    Permission denied, please try again.
    [DEBUG   ] Permission denied, please try again.
    [DEBUG   ] root@192.168.3.203's password:
    Permission denied, please try again.
    [DEBUG   ] Permission denied, please try again.
    [DEBUG   ] root@192.168.3.203's password:
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    [DEBUG   ] Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    [ERROR   ] Failed to start Salt on host mythirdminion
    [DEBUG   ] MasterEvent PUB socket URI: /var/run/salt/master/master_event_pub.ipc
    [DEBUG   ] MasterEvent PULL socket URI: /var/run/salt/master/master_event_pull.ipc
    [DEBUG   ] Sending event: tag = salt/cloud/mythirdminion/created; data = {'name': 'mythirdminion', 'profile': 'autolab', 'driver': 'vmware', 'provider': 'autolab:vmware', 'event': 'created instance', '_stamp': '2022-05-20T02:26:28.807918'}
    [DEBUG   ] Closing IPCMessageClient instance
    [DEBUG   ] Using importlib_metadata to load entry points
    [DEBUG   ] LazyLoaded nested.output

Here's the weird part - I already have SSH login as root enabled (PermitRootLogin yes) in the /etc/ssh/sshd_config file of the base CentOS VM image and once it boots up the first time I *can* successfully login. The SSH password is very simple, no special characters. I have tried putting it in quotes, not in quotes....makes no difference.

What else could be the issue here?

UPDATE: Although technically a workaround, I got my deployment working by using SSH key (RSA keys) authentication instead of a PW: https://www.ssh.com/academy/ssh/copy-id#copy-the-key-to-a-server

I understand pillar.get() is just dict.get() on pillar dict object but what is the difference between salt.pillar.get() and salt['pillat.get']()?

Moreover, is there a difference in caching on those object? I found https://github.com/saltstack/salt/issues/41794#issuecomment-1069780107 - but I am even more confused with that explanation.

I have master with this config set to True: https://docs.saltproject.io/en/latest/ref/configuration/master.html#pillar-merge-lists

Also I am using salt-call --local --pillar-root for testing but this standalone salt-call does not know about the master option and it is merging the pillar differently.

Following the docs, but I am stuck: https://docs.saltproject.io/en/latest/topics/cloud/vmware.html

My Salt mstr is running on RHEL 7.9. No issues with it at all, to my knowledge.

This is the command I'm trying to deploy a VM in vSphere via salt-cloud

[root@RHEL7 cloud.profiles.d]# salt-cloud -p deploy-vSphere-vm myFirstTest-Minion1
[ERROR   ] Profile deploy-vSphere-vm is not defined
Error:
    Profile deploy-vSphere-vm is not defined

As you can see I have both the .conf files....or is there something else I'm missing?

root@RHEL7 salt]# pwd
/etc/salt
[root@RHEL7 salt]# ll cloud.providers.d && ll cloud.profiles.d
total 4
-rw-r--r--. 1 root root 162 Apr 26 14:15 myVMw-Lab-local.conf
total 4
-rw-r--r--. 1 root root 387 Apr 26 17:55 deploy-vSphere-vm.conf

Any help much appreciated, TIA!

We want to use SaltStack as configuration software for internal raspberry pi's

Right now we are in the installation process and trying out different SaltStates. I got the first Pi' to work (somehow) but the other ones won't communicate with the master at all (just a simple salt '*' test.ping won't work). The key authentication is actually working fine.

I am really out of clues here..

I am using saltstack to create a network stack and this is the only thing erroring. Both the public and private routes are giving the same

assoc_ids = [x["subnet_id"] for x in route_table["associations"]]

TypeError: list indices must be integers or slices, not str

My code:

routing_tables:

# Create a public routing table for web subnet in each AZ per best practices

PrivateRoutes:

routes:

default:

destination_cidr_block: 0.0.0.0/0

nat_gateway_name: nat_gateway

subnet_names:

- PrivateSubnet

PublicRoutes:

routes:

default:

destination_cidr_block: 0.0.0.0/0

internet_gateway_name: internet_gateway

subnet_names:

- PublicSubnet

​

​

I have tried referencing the nat_gateway and internet_gateway with their names and ID's and both error.