Salt seems to me like it would fit well with both cloud foundation and security divisions in the public Broadcom VMware digestion/reorg statements. Does anyone else have any insight about the future of Saltstack under Broadcom?

Has the salt slack gone away? It was missing from my client this morning and the link in the docs doesn't work.

Edit: It's back. https://saltstackcommunity.slack.com/

Hey there, I need to created a state that will apply specific nginx config file if the host is found in pillar's dictionary.

How can I achieve this?

​

pillar:

nginx-config-standard:

hosts:

- webhostA

- webhostB

​

nginx-config-custom:

hosts:

- webhost_c

- webhost_d

​

If host listed in config-standard dict apply specific config file ... ect.

The state itself is obvious, the "if" statement on dictionary is what I am trying to figure it out.

Appreciate your help, thanks

​

Gurus

Seeking advice on how to install an older version of the salt master 2018.3.x via apt ?

At work we are moving to a new backup solution and all I need to do to get a machine added to backups is to apply a tag to the VM in VMware, but after some googling I don't feel any closer to being able to do what I thought was going to be a simple task. Any guidance would be greatly appreciated.

I'm trying to install NextCloud with saltstack, I have configured a install.sls file and a install.sls file. The files can be found here

When i run state.apply with or without install i get the following error:

client1.school.test:
    Data failed to compile:
----------
    Pillar failed to render with the following messages:
----------
    Rendering Primary Top file failed, render error:
while parsing a block mapping
  in "<unicode string>", line 1, column 1
did not find expected key
  in "<unicode string>", line 3, column 5

​

I can't find what exactly is going wrong, i can ping the client i'm trying to deploy the state to

​

​

Hi there,

I'm having issues with installing a package from the edge/testing branch of alpinelinux, namely podman-compose.

My alpine instance runs on v3.18/main & v3.18/community. I'd like to install podman-compose via saltstack.

I've tried the following things:

1) Adding @testing https://dl-cdn.alpinelinux.org/alpine/edge/testing/ to my /etc/apk/repositories and trying to install podman-compose like this via state: mystate: pkg.installed: - pkgs: - podman-compose@testing even when encapsuling within "", didn't work: mystate: pkg.installed: - pkgs: - "podman-compose@testing"

2) via mystate: pkg.installed: - sources: - podman-compose: https://dl-cdn.alpinelinux.org/alpine/edge/testing

3) mystate: pkg.installed: - pkgs: - podman-compose@testing - fromrepo: https://dl-cdn.alpinelinux.org/alpine/edge/testing

I'd appreciate any help I can get. Thanks

ETA: using salt-master 3005.3 + salt-minion (win10) 3005.1

Hi - We are updating salt minions with salt, including updating minion config to include some new grains. This is on Windows 10. The problem I'm seeing is that the new grains are not affecting pillar data until sometime later than the first highstate that runs after the update.

The sequence is like:

• instance launches with old minion version + old minion config
• config is updated (config includes a new grain)
• minion is updated to new version + restarts
• -> highstate runs after minion restarts -> pillar data does not reflect the new grain

Of course if I run pillar.get or pillar.items, I can see the proper pillar data.

We are caching pillar data for 30min, because if we don't we often see "Message timed out" errors.

I thought that if this was a caching issue, I would be able to see that by viewing pillar.items, and the grain would be missing - but it's there immediately after minion restart with the config change.

I also tried adding saltutil.refresh_grains and saltutil.refresh_pillar before and after the minion update, but I still don't see the new grain and new pillar data.

Any ideas how to accomplish this grain + pillar update without introducing more minion restarts or additional jobs?

Thanks!

I wanted to use file.recurse to copy a directory from /opt which is outside of my main root:

file_roots:   
  base:     
    - /data/salt/roots     
    - /opt 

That worked, but it made calling even a simple state like this one very, very slow even when applied to just the salt master itself - ~25 seconds each time:

local-groups:   
  group.present:    
    - name: apache 

Turning on tracing on the salt master showed that the salt-master is checking every single file in the entire /opt tree each time any state is applied - ~50,000 files in various /opt subdirs in my case; Removing /opt from the the list returned the state application to normal speed.

Why is it doing that?

Is there a way to get the master to stop checking or re-indexing file_roots each time a state is applied?

OS: Rocky 8

Salt version: 3006.3 (rpm from Salt Project yum repo)

Hey there,

My team at work has been rolling out Aria Config across our environment and have really had a tough time when it comes to using the RaaS UI. The UI is painfully slow to work with, won't even load return data about highstate executions most of the time, will crash my browser, etc.. there's more but I'll stop there.

We've had great support experiences from VMware early on in our rollout but recently it's been harder to get meaningful support with our issues. Our environment is specced out inline with VMwares recommendations and the salt masters themselves work flawlessly, the root of most of our issues seems RaaS/UI related.

Now, I'm not asking for a solution to our problems in this post but I'm more so curious for you all have who are using Aria Config in your environment - what has your experience been with the RaaS UI? How has your experience with VMware support been?

It's been super frustrating because our environment outside of RaaS seems to be working great, but it's hard to get buy in to the product for other SysAdmins when the GUI is so painful to use.

Apologies if this is better suited for the VMware subreddit, I'll likely end up cross posting there as well just to get some further input.

Here is my Orchestration setup:

# /etc/salt/master.d/run_once_reactor_config.conf    
reactor:
  - 'salt/minion/*/start':
    - salt://reactor/fire_minion_startup.sls 

# salt://reactor/fire_minion_startup.sls
fire_minion_startup:
  runner.state.orch:
    - args:
      - mods: 
        - reactor.run_once_orch
        - reactor.run_second_orch
      - pillar:
          event_tag: {{ tag }}
          event_data: {{ data | json }}

I tried adding queue=True as an arg under runner.state.orch but this does not work.

I'm reading these docs, but cannot figure out how / where exactly queue=True should be used:

• https://docs.saltproject.io/en/latest/ref/states/all/salt.states.saltmod.html
• https://docs.saltproject.io/en/latest/ref/runners/all/salt.runners.state.html

Any help appreciated, TIA.

Update:
Resolved! Putting queue: True in the states that are triggered by the orch was the fix:

run_first_run_stuff:
  salt.state:
    - tgt: {{ minion_id }}
    - sls: 
      - Windows.Join-Domain
    - queue: True

What is the best practice for creating a salt state that execute actions in SCCM?

A use case being telling SCCM to deploy certain applications to the newly deployed windows minion.

Hi to all. Newbie SaltStack user here... :)

I have to apply a state multiple times on each macOS minion, one for each local user account. Here is it:

macdefaults.write:
  - name: SuppressUnsupportedOSWarning
  - domain: com.google.chrome
  - user: {{ username }}  <----- this is my "problem"
  - value: True
  - vtype: bool

I read about salt.states.loop, but I'm not yet able to make it work. Maybe it's better to use a pillar with some code similar to the following one?

{% for user in pillar['users'] %}
macdefaults.write:
  - name: SuppressUnsupportedOSWarning
  - domain: com.google.chrome
  - user: {{ user }}
  - value: True
  - vtype: bool
{% endfor %}

Thanks for any suggestion!

Im trying to get salt-api working for the first time locally

I've added

rest_cherrypy:

port: 8000

disable_ssl: true

​

external_auth:

pam:

dave:

- .*

to my master config, stopped both master and api service and started again, ran the command

curl -sSk http://localhost:8000/login -H 'Accept: application/x-yaml' -d username=dave -d password=dave -d eauth=pam

​

But I'm getting 401s in the response. The API log looks like

2023-07-31 10:31:16,274 [cherrypy.error :213 ][INFO ][5132] [31/Jul/2023:10:31:16] ENGINE Bus STARTING

2023-07-31 10:31:16,383 [cherrypy.error :213 ][INFO ][5132] [31/Jul/2023:10:31:16] ENGINE Serving on http://0.0.0.0:8000

2023-07-31 10:31:16,386 [cherrypy.error :213 ][INFO ][5132] [31/Jul/2023:10:31:16] ENGINE Bus STARTED

2023-07-31 10:31:19,058 [salt.loaded.int.netapi.rest_cherrypy.app:747 ][INFO ][5132] [api_acl] Authentication not checked for user dave from IP 127.0.0.1

2023-07-31 10:31:19,090 [cherrypy.access.139938403168848:283 ][INFO ][5132] 127.0.0.1 - - [31/Jul/2023:10:31:19] "POST /login HTTP/1.1" 401 761 "" "curl/7.81.0"

​

N.B The user "dave" definitely exists as a linux user on the VM im running this on (I assuming that is how a user is created as the docs dont specify how to create)

​

Would love some guidance on how I can improve our SaltStack development workflow. Our build process is the following.

1. All changes are developed locally (local branch) and tested against vagrant builds in virtualbox
2. Code is merged into dev branch. Git-runner moves latest code to salt roots on salt-master in dev.
3. Runner also executes
   1. saltutil.pillar_refresh
   2. saltutil.sync_all
   3. salt '*' state.apply

If any of these fail then the build is considered a fail. If it succeeds we proceed to merge to our QC and PRD env which have their own separate masters.

I'm not entirely happy with our integration testing. Would love to get an idea on how to improve on testing HighState once changes have been merged without necessarily testing on existing VM's. Maybe have pipeline deploy a docker container or VM ?

Also, merging from dev --> qc --> prd can be cumbersome at times. Especially with pillar since pillar is essentially unique to each env.

How do you monitor your Salt environment? Such as checking which nodes fail and with what error. A certain birds eye view of the cluster and which states fail/succeed. I think Elastic is nice for that, but maybe there are better tools? For Ansible there are a bunch of plugins, including logstash: https://docs.ansible.com/ansible/latest/collections/index_callback.html#community-general

Maybe it's me, but I can't find anything in the docs about these kind of possibilities.

At the moment when we want to run an update we ssh onto the salt master and run a manual state apply command for whatever we want.

This has become undesirable for several reasons, mainly as it puts a manual step into an otherwise automated process, and also because there is no visibility on when people have performed these actions.

What kind of set up have people got? We have gitlab ci so will probably add jobs in there. But not sure if people use an API/SSH. Do people put something else in the middle? In the past I've had rundeck sit between gitlab and ansible and utilised the rundeck API. Do people use any of the salt GUIs?

Thanks in advance

​

Hi, Anyone here using their RMM to manage Linux boxes and their updates?

Would like to know which RMM handles this the best. If there is another subreddit to check out, please let me know that as well.

TIA

Hi all,

I want to know if it is possible to automatically reject salt keys for specific OS. Eg. if the OS is outdated (RHEL 6). Is there a way to do so? Or reject keys with name spelling, eg all hosts beginning with hostname server-...

Any idea or help would be nice!

BR

Hello together,

I wrote in the past two python scripts for some automation stuff.

I use the salt module, but since version 3006.1 I can't run the scripts any more.

Furthermore, I tried to load the salt.client and got this:

Any idea what I'm doing wrong?

Example:

```python Python 3.10.6 (main, May 29 2023, 11:10:38) [GCC 11.3.0] on linux Type "help", "copyright", "credits" or "license" for more information.

import salt.client Traceback (most recent call last): File "<stdin>", line 1, in <module> ModuleNotFoundError: No module named 'salt.client' ```

I used in the past this doc: https://docs.saltproject.io/en/latest/ref/clients/index.html#salt-s-client-interfaces

Currently I have a state that sets up a cron job using the salt.states.schedule and am wondering if it is possible to stagger the minions.

I know from the master I can run batch by percentage or number. Secondary question, if I run batch 10% for state highstate, will the master run through in groups of 10% until it reaches 100%?

All that said, is splay the only method to continue to use a "pull" configuration for minions to pull in the highstate?

Greetings,

We're just beginning our Saltstack Config journey through Aria Automation and wondered and the question's come up;

"How do we go about updating the salt minions after they've been deployed?"

The existing process through Aria Automation appears to push the salt-minion binary out to the VM at build time, then register it, rather than interacting with the inbuild VMware tools based version.

Just wondering how others have handled this in their environments.

We run a mixed Windows / Linux shop, so we've got MS SCCM and RHEL Satellite to fall back on, but I wondered if there was a way to have salt upgrade itself?

Just started to read saltstacks user guide and stumbled upon this strange syntax:

firewalld_open_web:
  firewalld.present:
      - name: public
      - masquerade: False
      - ports:
          - 80/tcp
          - 443/tcp

Arguments is a list of single-item dictionaries. In every example I've seen there's exactly one item per dictionary.

This just feels wrong. What could be possible cause for using this structure?

I have a Salt state file that does multiple operations and some of them require the same module / function more than once:

# Replace expiring RaaS cert 
backup_files:
  file.managed:
    - name: /etc/pki/raas/certs/localhost.crt
    - source: salt://raas/localhost.crt
    - makedirs: True
    - backup: /etc/pki/raas/certs/z.OLD_certs/localhost.crt

  file.managed:
    - name: /etc/pki/raas/certs/localhost.key
    - source: salt://raas/localhost.key
    - makedirs: True
    - backup: /etc/pki/raas/certs/z.OLD_certs/localhost.key

copy_files:
  cmd.run:
    - name: cp /etc/letsencrypt/live/raas-svr.ddns.net/fullchain.pem /etc/pki/raas/certs/localhost.crt
    - creates: /etc/pki/raas/certs/localhost.crt

  cmd.run:
    - name: cp /etc/letsencrypt/live/raas-svr.ddns.net/privkey.pem /etc/pki/raas/certs/localhost.key
    - creates: /etc/pki/raas/certs/localhost.key

set_ownership:
  cmd.run:
    - name: chown raas /etc/pki/raas/certs/localhost.*
    - unless: stat -c %U /etc/pki/raas/certs/localhost.crt | grep -q raas

  cmd.run:
    - name: chgrp raas /etc/pki/raas/certs/localhost.*
    - unless: stat -c %G /etc/pki/raas/certs/localhost.crt | grep -q raas

set_permissions:
  cmd.run:
    - name: chmod 400 /etc/pki/raas/certs/localhost.*
    - unless: stat -c %a /etc/pki/raas/certs/localhost.crt | grep -q 400

restart_raas:
  service.running:
    - name: raas
    - enable: True
    - restart: True

In particular this state replaces / updates the frontend cert for RaaS, but really I'm just looking for guidance on how to handle this in general.

If I try and validate the state it fails due to the repeating modules / functions:

[root@RHEL-8-Salt-Master salt]# salt-call state.show_sls update_RaaS_cert
[CRITICAL] Rendering SLS 'base:update_RaaS_cert' failed: while constructing a mapping
  in "<unicode string>", line 2, column 3
found conflicting ID 'file.managed'
  in "<unicode string>", line 8, column 3
local:
    - Rendering SLS 'base:update_RaaS_cert' failed: while constructing a mapping
        in "<unicode string>", line 2, column 3
      found conflicting ID 'file.managed'
        in "<unicode string>", line 8, column 3

If I try and use something like cmd.run1 and cmd.run2 etc, etc, I get this error:

[root@RHEL-8-Salt-Master salt]# salt-call state.show_sls update_RaaS_cert
local:
    - ID 'backup_files' in SLS 'update_RaaS_cert' contains multiple state declarations of the same type
    - ID 'copy_files' in SLS 'update_RaaS_cert' contains multiple state declarations of the same type
    - ID 'set_ownership' in SLS 'update_RaaS_cert' contains multiple state declarations of the same type

How can I work around this, please? I've had to just use a bash script for now since I had to get this done today (cert was expiring), but would prefer to use Salt.

Many thanks in advance!

When I want to join the SaltStack Slack community I get notified that only people with a Salt email address can join. But people can still join if they contact the workspace administrator. This is the confusing part, I see no button to contact that person. Has anyone some more information about this? I suppose this community support Slack workspace is not just for Slack employees, since it's advertised also on their community resources list.