8000 Merge branch 'develop' of github.com:saltstack/salt into develop · linuxadmin/salt@6640e95 · GitHub
[go: up one dir, main page]
Skip to content

Commit 6640e95

Browse files
s0undt3chs0undt3ch
committed
Merge branch 'develop' of github.com:saltstack/salt into develop
2 parents 94b9dec + 5286006 commit 6640e95

File tree

23 files changed

+222
-70
lines changed

23 files changed

+222
-70
lines changed

‎HACKING.rst

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,12 @@ Install Salt (and dependencies) into the virtualenv::
8686

8787
env SWIG_FEATURES="-cpperraswarn -includeall -D__`uname -m`__ -I/usr/include/openssl" pip install M2Crypto
8888

89+
Debian and Ubuntu systems have modified openssl libraries and mandate that
90+
a patched version of M2Crypto be installed. This means that M2Crypto
91+
needs to be installed via apt:
92+
93+
apt-get install python-m2crypto
94+
8995
Running a self-contained development version
9096
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9197

@@ -116,6 +122,13 @@ Edit the minion config file:
116122
"saltdev". This isn't strictly necessary but it will serve as a reminder of
117123
which Salt installation you are working with.
118124

125+
.. note:: Using `salt-call` with a :doc:`Standalone Minion </topics/tutorials/standalone_minion>`
126+
127+
If you plan to run `salt-call` with this self-contained development
128+
environment in a masterless setup, you should invoke `salt-call` with
129+
``-c /path/to/your/virtualenv/etc/salt`` so that salt can find the minion
130+
config file. Without the ``-c`` option, Salt finds its config files in `/etc/salt`.
131+
119132
Start the master and minion, accept the minon's key, and verify your local Salt
120133
installation is working::
121134

‎doc/man/salt.7

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7705,7 +7705,7 @@ salt \(aq*\(aq pkg.available_version <package name>
77057705
.UNINDENT
77067706
.INDENT 0.0
77077707
.TP
7708-
.B salt.modules.freebsdpkg.install(name, *args, **kwargs)
7708+
.B salt.modules.freebsdpkg.install(name, refresh=False, repo='', **kwargs)
77097709
Install the passed package
77107710
.sp
77117711
Return a dict containing the new package names and versions:
@@ -7807,20 +7807,20 @@ salt \(aq*\(aq pkg.remove <package name>
78077807
.INDENT 0.0
78087808
.TP
78097809
.B salt.modules.freebsdpkg.search(pkg_name)
7810-
Use \fIpkg search\fP if pkg is being used.
7810+
Use \fIpkg search\fP if pkgng is being used.
78117811
.sp
78127812
CLI Example:
78137813
.sp
78147814
.nf
78157815
.ft C
7816-
salt \(aq*\(aq pkg.pkgng_search \(aqmysql\-server\(aq
7816+
salt \(aq*\(aq pkg.search \(aqmysql\-server\(aq
78177817
.ft P
78187818
.fi
78197819
.UNINDENT
78207820
.INDENT 0.0
78217821
.TP
78227822
.B salt.modules.freebsdpkg.upgrade()
7823-
Run a full system upgrade, a \fBfreebsd\-update fetch install\fP
7823+
Run \fBpkg upgrade\fP, if pkgng used. Otherwise do nothing
78247824
.sp
78257825
Return a dict containing the new package names and versions:
78267826
.sp

‎doc/ref/states/ordering.rst

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,3 +210,18 @@ set the order to ``last``:
210210
vim:
211211
pkg.installed:
212212
- order: last
213+
214+
Remember that requisite statements override the order option. So the order
215+
option should be applied to the highest component of the requisite chain:
216+
217+
.. code-block:: yaml
218+
219+
vim:
220+
pkg.installed:
221+
- order: last
222+
- require:
223+
- file: /etc/vimrc
224+
225+
/etc/vimrc:
226+
file.managed:
227+
- source: salt://edit/vimrc

‎doc/ref/states/startup.rst

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
==============
2+
Startup States
3+
==============
4+
5+
Sometimes it may be desired that the salt minion execute a state run when it is
6+
started. This alleviates the need for the master to initiate a state run on a
7+
new minion and can make provisioning much easier.
8+
9+
As of Salt 0.10.3 the minion config reads options that allow for states to be
10+
executed at startup. The options are `startup_states`, `sls_list` and
11+
`top_file`.
12+
13+
The `startup_states` option can be passed one of a number of arguments to
14+
define how to execute states. The available options are:
15+
16+
highstate
17+
Execute ``state.highstate``
18+
19+
sls
20+
Read in the ``sls_list`` option and execute the named sls files
21+
22+
top
23+
Read in the ``top_file`` option and execute states based on that top file
24+
on the Salt Master
25+
26+
Examples:
27+
---------
28+
29+
Execute ``state.highstate`` when starting the minion:
30+
31+
32+
.. code-block:: yaml
33+
34+
startup_states: highstate
35+
36+
Execute the sls files `edit.vim` and `hyper`:
37+
38+
.. code-block:: yaml
39+
40+
startup_states: sls
41+
42+
sls_list:
43+
- edit.vim
44+
- hyper

‎doc/topics/releases/0.10.3.rst

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ The latest taste of Salt has come, this release has many fixes and feature
66
additions. Modifications have been made to make ZeroMQ connections more
77
reliable, the begining of the ACL system is in place, a new command line
88
parsing system has been added, dynamic module distribution has become more
9-
environment aware, the new `master_fingerprint` option and many more!
9+
environment aware, the new `master_finger` option and many more!
1010

1111
Major Features
1212
==============
@@ -32,6 +32,29 @@ and is configured like so:
3232
Where `fred` is allowed access to functions in the test module and to the
3333
``pkg.list_pkgs`` function.
3434

35+
Master Finger Option
36+
--------------------
37+
38+
The `master_finger` option has been added to improve the security of minion
39+
provisioning. The `master_finger` option allows for the fingerprint of the
40+
master public key to be set in the configuration file to double verify that the
41+
master is valid. This option was added in response to a motivation to pre
42+
authenticate the master when provisioning new minions to help prevent
43+
man in the middle attacks in some situations.
44+
45+
Salt Key Fingerprint Generation
46+
-------------------------------
47+
48+
The ability to generate fingerprints of keys used by Salt has been added to
49+
``salt-key``. The new option `finger` accepts the name of the key to generate
50+
and display a fingerprint for.
51+
52+
.. code-block:: base
53+
54+
salt-key -F master
55+
56+
Will display the fingerprints for the master public and private keys.
57+
3558
Parsing System
3659
--------------
3760

@@ -127,4 +150,9 @@ specifying the text.
127150
file.append:
128151
- source: salt://testfile
129152
153+
Security Fix
154+
============
130155

156+
A timing vulnerability was uncovered in the code which decrypts the AES
157+
messages sent over the network. This has been fixed and upgrading is
158+
strongly recommended.

‎salt/config.py

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -151,19 +151,23 @@ def minion_config(path):
151151
'''
152152
opts = {'master': 'salt',
153153
'master_port': '4506',
154+
'master_finger': '',
154155
'user': 'root',
155156
'root_dir': '/',
156157
'pki_dir': '/etc/salt/pki',
157158
'id': socket.getfqdn(),
158159
'cachedir': '/var/cache/salt',
159160
'cache_jobs': False,
160161
'conf_file': path,
161-
'sock_dir': os.path.join(tempfile.gettempdir(), '.salt-unix'),
162+
'sock_dir': '/var/run/salt',
162163
'renderer': 'yaml_jinja',
163164
'failhard': False,
164165
'autoload_dynamic_modules': True,
165166
'environment': None,
166167
'state_top': 'top.sls',
168+
'startup_states': '',
169+
'sls_list': [],
170+
'top_file': '',
167171
'file_client': 'remote',
168172
'file_roots': {
169173
'base': ['/srv/salt'],
@@ -254,7 +258,7 @@ def master_config(path):
254258
'publish_port': '4505',
255259
'user': 'root',
256260
'worker_threads': 5,
257-
'sock_dir': os.path.join(tempfile.gettempdir(), '.salt-unix'),
261+
'sock_dir': '/var/run/salt',
258262
'ret_port': '4506',
259263
'timeout': 5,
260264
'keep_jobs': 24,
@@ -307,6 +311,9 @@ def master_config(path):
307311
'default_include': 'master.d/*.conf',
308312
}
309313

314+
if len(opts['sock_dir']) > len(opts['cachedir']) + 10:
315+
opts['sock_dir'] = os.path.join(opts['cachedir'], '.salt-unix')
316+
310317
load_config(opts, path, 'SALT_MASTER_CONFIG')
311318

312319
default_include = opts.get('default_include', [])

‎salt/master.py

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -728,7 +728,7 @@ def _minion_event(self, load):
728728
if 'id' not in load or 'tag' not in load or 'data' not in load:
729729
return False
730730
tag = '{0}_{1}'.format(load['tag'], load['id'])
731-
return self.event.fire_event(load['data'], tag)
731+
return self.event.fire_event(load, tag)
732732

733733
def _return(self, load):
734734
'''
@@ -737,6 +737,11 @@ def _return(self, load):
737737
# If the return data is invalid, just ignore it
738738
if 'return' not in load or 'jid' not in load or 'id' not in load:
739739
return False
740+
if load['jid'] == 'req':
741+
# The minion is returning a standalone job, request a jobid
742+
load['jid'] = salt.utils.prep_jid(
743+
self.opts['cachedir'],
744+
self.opts['hash_type'])
740745
log.info('Got return from {id} for job {jid}'.format(**load))
741746
self.event.fire_event(load, load['jid'])
742747
if not self.opts['job_cache']:

‎salt/minion.py

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99

1010
import fnmatch
1111
import os
12+
import hashlib
1213
import re
1314
import threading
1415
import time
@@ -423,6 +424,23 @@ def _return_pub(self, ret, ret_cmd='_return'):
423424
open(fn_, 'w+').write(self.serial.dumps(ret))
424425
return ret_val
425426

427+
def _state_run(self):
428+
'''
429+
Execute a state run based on information set in the minion config file
430+
'''
431+
if self.opts['startup_states']:
432+
data = {'jid': 'req', 'ret': ''}
433+
if self.opts['startup_states'] == 'sls':
434+
data['fun'] = 'state.sls'
435+
data['arg'] = [self.opts['sls_list']]
436+
elif self.opts['startup_states'] == 'top':
437+
data['fun'] = 'state.top'
438+
data['arg'] = [self.opts['top_file']]
439+
else:
440+
data['fun'] = 'state.highstate'
441+
data['arg'] = []
442+
self._handle_decoded_payload(data)
443+
426444
@property
427445
def master_pub(self):
428446
return 'tcp://{ip}:{port}'.format(ip=self.opts['master_ip'],
@@ -482,13 +500,14 @@ def tune_in(self):
482500
# Prepare the minion event system
483501
#
484502
# Start with the publish socket
503+
id_hash = hashlib.md5(self.opts['id']).hexdigest()
485504
epub_sock_path = os.path.join(
486505
self.opts['sock_dir'],
487-
'minion_event_{0}_pub.ipc'.format(self.opts['id'])
506+
'minion_event_{0}_pub.ipc'.format(id_hash)
488507
)
489508
epull_sock_path = os.path.join(
490509
self.opts['sock_dir'],
491-
'minion_event_{0}_pull.ipc'.format(self.opts['id'])
510+
'minion_event_{0}_pull.ipc'.format(id_hash)
492511
)
493512
epub_sock = context.socket(zmq.PUB)
494513
if self.opts.get('ipc_mode', '') == 'tcp':
@@ -542,6 +561,9 @@ def tune_in(self):
542561
# Make sure to gracefully handle SIGUSR1
543562
enable_sigusr1_handler()
544563

564+
# On first startup execute a state run if configured to do so
565+
self._state_run()
566+
545567
if self.opts['sub_timeout']:
546568
last = time.time()
547569
while True:

‎salt/modules/django.py renamed to ‎salt/modules/djangomod.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
import os
66

7+
def __virtual__():
8+
return 'django'
79

810
def _get_django_admin(bin_env):
911
'''

‎salt/modules/freebsdpkg.py

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ def search(pkg_name):
1919
2020
CLI Example::
2121
22-
salt '*' pkg.pkgng_search 'mysql-server'
22+
salt '*' pkg.search 'mysql-server'
2323
'''
2424
if _check_pkgng():
2525
res = __salt__['cmd.run']('pkg search {0}'.format(pkg_name))
@@ -114,7 +114,7 @@ def list_pkgs():
114114
return ret
115115

116116

117-
def install(name, *args, **kwargs):
117+
def install(name, refresh=False, repo='', **kwargs):
118118
'''
119119
Install the passed package
120120
@@ -127,12 +127,19 @@ def install(name, *args, **kwargs):
127127
128128
salt '*' pkg.install <package name>
129129
'''
130-
if _check_pkgng:
130+
env = ()
131+
if _check_pkgng():
131132
pkg_command = 'pkg install -y'
133+
if not refresh:
134+
pkg_command += ' -L'
135+
if repo:
136+
env = (('PACKAGESITE', repo),)
132137
else:
133138
pkg_command = 'pkg_add -r'
139+
if repo:
140+
env = (('PACKAGEROOT', repo),)
134141
old = list_pkgs()
135-
__salt__['cmd.retcode']('%s {0}'.format(name) % pkg_command)
142+
__salt__['cmd.retcode']('%s {0}'.format(name) % pkg_command, env=env)
136143
new = list_pkgs()
137144
pkgs = {}
138145
for npkg in new:
@@ -154,7 +161,7 @@ def install(name, *args, **kwargs):
154161

155162
def upgrade():
156163
'''
157-
Run a full system upgrade, a ``freebsd-update fetch install``
164+
Run pkg upgrade, if pkgng used. Otherwise do nothing
158165
159166
Return a dict containing the new package names and versions::
160167
@@ -165,8 +172,13 @@ def upgrade():
165172
166173
salt '*' pkg.upgrade
167174
'''
175+
176+
if not _check_pkgng():
177+
# There is not easy way to upgrade packages with old package system
178+
return {}
179+
168180
old = list_pkgs()
169-
__salt__['cmd.retcode']('freebsd-update fetch install')
181+
__salt__['cmd.retcode']('pkg upgrade -y')
170182
new = list_pkgs()
171183
pkgs = {}
172184
for npkg in new:

‎salt/modules/freebsdservice.py

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,6 @@ def status(name, sig=None):
122122
123123
salt '*' service.status <service name> [service signature]
124124
'''
125-
sig = name if not sig else sig
126-
cmd = "{0[ps]} | grep {1} | grep -v grep | awk '{{print $2}}'".format(
127-
__grains__, sig)
128-
return __salt__['cmd.run'](cmd).strip()
125+
return __salt__['status.pid'](sig if sig else name)
129126

130127

‎salt/modules/gentoo_service.py

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,7 @@ def status(name, sig=None):
112112
113113
salt '*' service.status <service name> [service signature]
114114
'''
115-
sig = name if not sig else sig
116-
cmd = "{0[ps]} | grep {1} | grep -v grep | awk '{{print $2}}'".format(
117-
__grains__, sig)
118-
return __salt__['cmd.run'](cmd).strip()
115+
return __salt__['status.pid'](sig if sig else name)
119116

120117
def enable(name):
121118
'''

0 commit comments

Comments
 (0)
0