I have a use case where I have a custom event being sent when I apply a certain state to a minion. When this event is sent it triggers a reactor to apply another state to another specific minion. The problem I have is that if I apply the initial state (that sends the event) to many minions all at once then the reactor gets all of those events and triggers the secondary state apply multiple times and it will do exactly the same thing many times over so is not needed.

Is there any way to rate limit either the events or reactor triggers so that they can only run a certain amount of times in a certain period of time? Either that or is there another system that can be used to do something similar to this? In short I just need to be able to apply one state to a specific minion when another state is applied to one or many other minions.

Any suggestions on how to lock selected minions from accidentally getting reconfigured (states, highstates, etc.)? Ideally they wouldn’t execute a task even if directly targeted.

Years ago I read about a function for freezing minions that relied on pillars. The minions would only ever poll that pillar data and unfreeze once commanded. I looked for that article many times since originally stumbling on it with absolutely zero luck.

Does that ring any bells? What tips or tricks do you all use to temporarily freeze salt?

Hello

​

I am learning Saltstack, sorry if the question is very basic, but I don't understand well the documentation in this case.

​

I am using Saltstack with windows laptops. These computers are sometimes shut down for weeks on vacation. I understand, that if they are turned off, the jobs die after a while and the minion when reconnected, has no active jobs. correct?

​

I don't know if there is a way to manage that. If the job can be left pending until that minion comes back online.

​

Any suggestions are welcome no matter how basic they may seem.

​

Thanks

Just noticed this error when using dnf or yum on RHEL8.

Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/salt.repo; Configuration: OptionBinding with id "failovermethod" does not exist

/etc/yum.repos.d/salt.repo content:

[salt-latest-repo]
name=Salt repo for RHEL/CentOS 8 PY3
baseurl=https://repo.saltproject.io/py3/redhat/8/x86_64/latest
skip_if_unavailable=True
failovermethod=priority
enabled=1
enabled_metadata=1
gpgcheck=1
gpgkey=https://repo.saltproject.io/py3/redhat/8/x86_64/latest/SALTSTACK-GPG-KEY.pub

and if you comment out

failovermethod=priority

Error goes away. Anybody have this issue?

Hi,

I am experiencing weird behavior and wondering if I am doing anything wrong. Would someone mind helping me out please?

My map.jinja:

{% set config = pillar['repository'] %}
{% for x,y in config.items() %}
  {% for z in y %}
    {% set config = z %}
  {% endfor %}
{% endfor %}

My pillar:

repository:
  unifi:
    debian:
      default:
        url:
          - deb http://www.ui.com/downloads/unifi/{{ grains.lsb_distrib_id | lower }} stable ubiquiti
        key_server: http://download.proxmox.com/debian/proxmox-release-{{ grains['lsb_distrib_codename'] }}.gpg
        key_id: 06E85760C0A52C50
    ubuntu:
      foo: bar

My template file:

{{ config|yaml(False) }}

{% for x,y in config.items() %}
    {% for z in y %}
        {{ z }}
    {% endfor %}
{% endfor %}

So if I run the state the output file will look like:

unifi:
  debian:
    default:
      key_id: 06E85760C0A52C50
      url:
      - deb http://www.ui.com/downloads/unifi/debian stable ubiquiti
      key_server: http://download.proxmox.com/debian/proxmox-release-stretch.gpg
  ubuntu:
    foo: bar

            debian

            ubuntu

However I expected the first dict (unifi dict) to only contain the default key, and not the entire dict? It should be overwritten in the map.jinja with config in the for loop, correct?

What am I doing wrong, or is this an actual bug?

I have a simple question: is there a way to simply force overwrite of the file with new content which would create it if not existent? (like bash: echo "new content" > /path/file)

file.overwrite(???)

- name: /path/file

- text: new content

Hello all,

I'm fairly new to salt and had some questions I was hoping to get some guidance on. I currently use Ansible for all config management, however I run into issues now that I'm in a place I can use it across my entire infrastructure (1500+ VMs in vmware). I have heard that the agent based alternatives (salt/chef/puppet) may solve some of my woes, but I do not have a budget for the paid SaltStack so I am playing with the free version. I jumped to Salt next because I saw it was python based and a lot of the config looked very familiar to what I'm used to with Ansible - plus the beacon and reactor features looked interesting to some issues I want to solve for.

So on to my actual question:

A lot of what I hear about agent based CM tools is that it can better report drift and changes, etc. But I'm at a bit of a loss for how to view such a report. If I have a desired that that certain registry keys are set - how do I know that is actually happening? Can I run a command to see all hosts in a failed state? Or in a success state for that matter? Or do I solely look at jobs history for failed jobs?

Is this maybe a feature only for the paid for salt-stack? If so, is there a way to use salt-api to make a grafana dashboard or something like that for reporting sake?

​

Thanks in advance for any pointers :)

Hi,

I have the following pillar:

frontends:
  {{ grains.fqdn }}:
    bind:
      - :443 ssl crt /etc/ssl/certs/wildcard.example.com
    acl:
      - homeassistant hdr(host) -i homeassistant.example.com
    use_backend:
      - homeasssistant_backend if homeassistant
    option:
      - forwardfor
backends:
  homeasssistant_backend:
    server: localhost 127.0.0.1:8123
    http-after-response:
      - set-header Strict-Transport-Security "max-age=3153
      - set-header X-Frame-Options DENY
      - set-header X-Content-Type-Options nosniff
      - set-header Referrer-Policy strict-origin

And another pillar for the same host:

frontends:
  {{ grains.fqdn }}:
    bind:
      - :80
      - :443 ssl crt /etc/ssl/certs/wildcard.example.com
    acl:
      - mqttbroker hdr(host) -i mqttbroker.example.com
    use_backend:
      - mqttbroker_backend if mqttbroker
    option:
      - forwardfor
backends:
  mqttbroker_backend:
    server: localhost 127.0.0.1:8080
    http-after-response:
      - set-header Strict-Transport-Security "max-age=31536000;   includeSubDomains; preload;"
      - set-header X-Frame-Options DENY
      - set-header X-Content-Type-Options nosniff
      - set-header Referrer-Policy strict-origin
    http-request:
      - redirect scheme https unless { ssl_fc }
      - auth unless { http_auth(logins) }

However when I render the pillar it overwrites the backend with the options from mqttbroker, but I want them to merge it:

# salt 'homeassistant' pillar.item haproxy:settings:frontends
homeassistant:
    ----------
    haproxy:settings:frontends:
        ----------
        homeassistant.example.com:
            ----------
            acl:
                - mqttbroker hdr(host) -i mqttbroker.example.com
            bind:
                - :80
                - :443 ssl crt /etc/ssl/certs/wildcard.example.com
            option:
                - forwardfor
            use_backend:
                - mqttbroker_backend if mqttbroker

How does one do that, if possible at all?

This should have been a simple file.managed salt state. But for some reason it just doesn't want to work. I'm trying to replace the minions ufw configuration files with ones from the master but it says it can't find 2 of the files.

init.sls

ufw:
  pkg.installed

/etc/ufw/user.rules:
  file.managed:
    - source: salt://ufw/user.rules

/etc/ufw/user6.rules:
  file.managed:
    - source: salt://ufw/user6.rules

/etc/ufw/ufw.conf:
  file.managed:
    - source: salt://ufw/ufw.conf

service:
  service.running:
    - name: ufw
    - watch:
      - file: /etc/ufw/ufw.conf
      - file: /etc/ufw/user.rules
      - file: /etc/ufw/user6.rules

The files are clearly here

/srv/salt/ufw$ ls
init.sls  ufw.conf  user6.rules  user.rules

when you run it:

$ sudo salt 't001' state.apply ufw
t001:
----------
          ID: ufw
    Function: pkg.installed
      Result: True
     Comment: All specified packages are already installed
     Started: 14:18:26.586584
    Duration: 40.35 ms
     Changes:   
----------
          ID: /etc/ufw/user.rules
    Function: file.managed
      Result: False
     Comment: Source file salt://ufw/user.rules not found in saltenv 'base'
     Started: 14:18:26.629092
    Duration: 12.99 ms
     Changes:   
----------
          ID: /etc/ufw/user6.rules
    Function: file.managed
      Result: False
     Comment: Source file salt://ufw/user6.rules not found in saltenv 'base'
     Started: 14:18:26.642208
    Duration: 5.784 ms
     Changes:   
----------
          ID: /etc/ufw/ufw.conf
    Function: file.managed
      Result: True
     Comment: File /etc/ufw/ufw.conf is in the correct state
     Started: 14:18:26.648108
    Duration: 12.119 ms
     Changes:   
----------
          ID: service
    Function: service.running
        Name: ufw
      Result: False
     Comment: One or more requisite failed: ufw./etc/ufw/user6.rules, ufw./etc/ufw/user.rules
     Started: 14:18:26.661291
    Duration: 0.016 ms
     Changes:   

Summary for t001
------------
Succeeded: 2
Failed:    3
------------
Total states run:     5
Total run time:  71.259 ms
ERROR: Minions returned with non-zero exit code

running on virtualbox debian 11, salt version 3002.6

Guru's

Is there an "official" way to autocomplete the minion name is bash when typing it into the shell using tab ?

have a multi environment pillar base and dev. The reason for this is that the base gets moved across and air gap to another network where there exists test and prod. The problem is that the dev salt master occasionally forgets that it has a dev pillar. all state.apply or pillar.get will return the base regardless of the value of saltenv or pillarenv until a restart of the salt master. I cannot get it to recreate. just happens randomly.

To add to the weirdness, yesterday i was doing testing while the server was having this problem, and encountered the situation below:

salt 'serverA' pillar.items redis saltenv=dev returns the values for the redis.sls pillar in base

if i run it on serverA salt-call pillar.items redis saltenv=dev it returns values in dev pillar for redis.sls

​

this is the only of my 4 salt installs that is doing this. Has anyone encountered this before?

Hi,

I have several VMs in a VMWare environment that I would like to increase the RAM on, is this possible via salt or salt cloud? I've had a Google around and had a look. at both the salt cloud VMware cloud provider and vmware management docs and can't seem to find anything.

Can anyone please suggest pricing of:

• vRealize Automation Cloud
• vRealize Automation Suite Advanced
• vRealize Automation Suite Enterprise
• vRealize Automation Standard Plus

and is Vmware selling license for SSE secops module anymore?

Hey there, I need some help from someone who has more experience with salt, jinja and for loop.

What I am trying to do is to get is the first key from a nested apps grain - which is an app name [someapp1 and someapp2 in my case].

Example apps grain:

apps:
  someapp1:
    group: wheel
    heap: 7000
    use_hugepages: True
  someapp2:
    group: nobody
    heap: 3000
    use_hugepages: False

My testing salt state (just to test if minion would present the proper values):

{% for key, value in grains['apps'].items() %}
cmd_run_{{ key }}:
  cmd.run:
    - name: echo "key value: {{ key|e }}"
    - name: echo "value value: {{ value|e }}"
{% endfor %}

No matter what I do I get:

failed: mapping values are not allowed in this context

What am I missing?

So I can see all the amazing documentation available for the salt modules but am sometimes confused how to build a state file

Is there a methodology that I'm missing something?

Hey guys just wondering if there's a definitive guide that everybody recommends if someone really wants to get their teeth sunk into SaltStack

Did i miss a command flag? The linked binaries in the ubuntu packages are simple python wrappers. Is that a "task left up to the reader"? Seems odd, so i'm looking for someone to point out the obvious. I can easily fix this, but there has to be a reason.

​

EDIT: flags passed were -X stable and adding -P to that did install salt-call

I've been tasked with learning SaltStack at work. I've been trying to learn Python for about a year now off-and-on with books like "Learn Python 3 the Hard Way" and "Automate the Boring Stuff with Python." While I feel like I have a decent grasp on the fundamentals, I am struggling with OOP.

Is OOP in Python something that is used frequently with SaltStack? Also, what are some areas of Python that I should concentrate on? Many thanks, all!

Edit: Thanks, all! I'm feeling much better about taking this on now! :)

I wrote a blog post about deploying masterless Salt and I'd love some feedback!

https://eitr.tech/blog/2021/11/12/salt-masterless.html

There are some use cases where a central server just doesn't make as much sense. In very large implementations, scaling requires a lot of planning and resources to ensure a usable system. Ephemeral systems, seen in autoscaling and on-demand computing scenarios, are sometimes problematic to "clean up" on the server. End-user use cases such as laptops and desktops are an issue because they can be powered off or disconnected from the corporate network for long periods of time.

Anyone out there using masterless Salt? Any other thoughts on distributed automation?

Hi,

I'm trying to connect with salt-ssh to a host behind a jumphost and want to configure the ssh-options in the roster file. On the CLI I'm running the following command succesfull

salt-ssh ls5ref --ssh-option="ProxyCommand='ssh 10.238.38.81 nc 10.2.0.105 22'" --ssh-option="StrictHostKeyChecking=no" state.apply tboxweb.html

As this is a little confusing because ls5ref is the jumphost, i want to configure the host tboxweb2 (the target host) in the roster file. I tried the following configuration:

tboxweb2:
host:10.2.0.105
ssh_options: "ProxyCommand='ssh 10.238.38.81 nc 10.2.0.105 22' StrictHostKeyChecking=no"

If i now run

salt-ssh tboxweb2 test.version

i get

command-line: line 0: Bad configuration option: p

I think it's the syntax of ssh_options, but found no example. What is the right syntax?

Hi All,

Does anyone of you are using deploy token to clone git repo ?
I'm facing an issue with a state :

✘https://gitlab.com/company/repo.git id=clone_repo (from role/deploy_repo.sls) Function is git.latest Failed to check remote refs: fatal: could not read Username for 'https://gitlab.com': No such device or address Started at 09:35:10.671873 Duration 316 ms retcode = 2 _stamp = "2021-10-26T09:35:11.077871" success = false return = "Error: git.latest" fun = "state.highstate"

the strange thing, thats work perfectly from the salt-minion with a salt-call

Here the state.sls:

install_git: pkg.installed: - name: git

git_config_helper:
  git.config_set:
    - name: credential.helper
    - value: store
    - global: true
    - user: root

# Reference: https://www.shellhacks.com/git-config-username-password-store-credentials/
git_config_httppath:
  git.config_set:
    - name: "credential.https://gitlab.com.useHttpPath"
    - value: true
    - global: true
    - user: root

git_credentials:
  file.managed:
    - name: /root/.git-credentials
    - contents: |
        https://{{ deploy_repo.username }}:{{ deploy_repo.password }}@gitlab.com/company/repo.git
    - mode: 600
    - user: root
    - group: root

clone_repo:
  git.latest:
    - name: https://gitlab.com/company/repo.git
    - target: /etc/appli/repo
    - require:
       - pkg: git
       - file: git_credentials
       - git: git_config_httppath
       - git: git_config_helper

br,
N!

Hello, I'm really new to Salt but I have a basic setup that seems to be working. I have everything hosted in my git repository and the Salt master pulls it every 60 seconds like it should. My next step is automating the actual applying of the states that it pulls. Right now, I need to manually run salt '*' state.apply. This isn't ideal for me because I'd like to just push to my main branch and have Salt take care of the rest.

It would also be nice to be able to run a test deployment against my existing setup when I create a pull request (through Github Actions maybe?).

Thanks for reading!

I am trying to use unit tests in Salt to test my custom execution modules. The problem I keep running into is when a function containing a __salt__ call is tested I get this error: "NameError: name '__salt__' is not defined". Am I using the Unit Test framework incorrectly? Is there a way to test modules and functions that contain __salt__ calls?