Extending Salt - Quick Start

Create a SLS file with Jinja code ( the one which got enclosed in flower {} brackets.

# cat /srv/salt/file/base/jinja/simple_var.sls
{% set simple_var = 'a simple variable' %}
jinja_var:
  cmd.run:
    - name: echo "Simple var is {{ simple_var }}"

Test the jinja based SLS file
# salt vag* state.show_sls jinja.simple_var

Jinja list example

# cat /srv/salt/file/base/jinja/list.sls
{% set list1 = ['one', 'two', 'three'] %}
jinja_list:
  cmd.run:
    - name: echo "List is {{ list1 }}"


# salt vag* state.show_sls jinja.list

Jinja example to access a particular list item

# cat /srv/salt/file/base/jinja/list_item.sls
{% set list1 = ['one', 'two', 'three'] %}
jinja_list_item:
  cmd.run:
    - name: echo "List item 2 is {{ list1[2] }}"

# salt vag* state.show_sls jinja.list_item



Jinja dictionary example

# cat /srv/salt/file/base/jinja/dict.sls
{% set my_dict = {'first': 'value 1', 'second': 'value 2'} %}
jinja_dict_first:
  cmd.run:
    - name: echo "First item is {{ my_dict['first'] }}"


# salt vag* state.show_sls jinja.dict

Jinja listing dictionary keys example

Salt Grains and Pillars

Grains

Grains are minion data calculated when minion starts. It contains static data like OS version, CPU cores, etc. This data is generated in minion and presented to master.

List the default grains configured on a minion.

• salt  vagrant-centos65.vagrantup.com grains.ls   # This just lists the keys
• salt vagrant-centos65.vagrantup.com grains.items  # This lists all the keys & values
• salt vagrant-centos65.vagrantup.com grains.item os  --out=txt  # single value

 Setting Grains

• salt vagrant-centos65.vagrantup.com grains.setval myenv prod 
• salt centos65-minion grains.setval myenv stage
• salt ubuntu-14.04-amd64-vbox grains.setval myenv dev
• salt vagrant-centos65.vagrantup.com grains.setval roles '[webserver,appserver]'
• salt centos65-minion grains.setval roles '[webserver,appserver,database]'
• salt ubuntu-14.04-amd64-vbox grains.setval roles '[webserver,appserver,database]'
• salt \* grains.item myenv roles   # query all of these roles

Pillars

Pillars are data from the Master. Pillar data is stored on the master. But the data is available only for the given minion.

Querying pillar data

• salt \* pillar.items

Configuring pillar root in masters configuration

--------------------------------------------
# cat /etc/salt/master.d/pillar.conf

pillar_roots:

  base:

    - /srv/salt/pillar/base

--------------------------------------------

• service salt-master restart

Pillar Top file

--------------------------------------------
# cat /srv/salt/pillar/base/top.sls
base:
  '*':
    - default

--------------------------------------------

--------------------------------------------

# cat /srv/salt/pillar/base/default.sls
my_data: some data for stuff
--------------------------------------------

Pillar data for user management

--------------------------------------------
# cat /srv/salt/pillar/base/users/all.sls
users:
  wilma: 2001
  fred: 2002
  barney: 2003
  betty: 2004

--------------------------------------------

--------------------------------------------

# cat /srv/salt/pillar/base/users/stage.sls
users:
  wilma: 2001
  barney: 2003
  betty: 2004

--------------------------------------------

--------------------------------------------

# cat /srv/salt/pillar/base/users/dba.sls
users:
  wilma: 2001
--------------------------------------------

Re-touch Top file

--------------------------------------------
# cat /srv/salt/pillar/base/top.sls
base:
  '*':
    - default

'G@myenv:prod and G@roles:database':
  - match: compound
  - users.dba

'myenv:stage':
  - match: grain
  - users.stage

'myenv:dev':
  - match: grain
  - users.all
--------------------------------------------

Validate the top file

[root@vagrant-centos65 base]# salt \* pillar.item users

Salt states - Quick Start

Set up the file server

• As per the master configuration file /etc/salt/master, the  master will automatically include all config files from /etc/salt/master.d/*.conf
• Create the below file in master

# cat /etc/salt/master.d/file-roots.conf
file_roots:
    base:
    - /srv/salt/file/base

• Restart the Salt master

# service salt-master restart

Stopping salt-master daemon:                               [  OK  ]

Starting salt-master daemon:                               [  OK  ]

• This sets up our Salt master with our file_roots directory.

SLS file

• Create the below SLS (Salt State) file

Salt common modules

sys.doc: Return the docstrings for all execution modules and functions

• salt * sys.doc test.ping
• salt-call sys.doc test
• salt-call sys.doc  # To see documentation for all modules

sys.state_doc: Get help for state modules and functions. Return the docstrings for all states.

• salt-call sys.state_doc user.present

sys.list_modules: List the execution modules loaded on the minion

• salt-call sys.list_modules

sys.list_functions: List the execution functions for all modules. 

• salt-call sys.list_functions sys 

SaltStack: [ERROR] The master key has changed and [CRITICAL] The Salt Master has rejected this minion's public key!

When the IP address of Salt master got changed and then a salt-minion started throwing the below error

[ERROR   ] The master key has changed, the salt master could have been subverted, verify salt master's public key
[CRITICAL] The Salt Master server's public key did not authenticate!
The master may need to be updated if it is a version of Salt lower than 2015.8.3, or
If you are confident that you are connecting to a valid Salt Master, then remove the master public key and restart the Salt Minion.
The master public key can be found at:
/etc/salt/pki/minion/minion_master.pub
Invalid master key



To get rid of this error, I ran below commands on troubled minion

• cd /etc/salt/pki/minion/
• mv minion_master.pub minion_master.pub.old
• mv minion.pem minion.pem.old
• mv minion.pub minion.pub.old
• salt-key --include-all --reject='ubuntu-14.04-amd64-vbox'         #on master
• service salt-minion restart
• salt-key --include-all --accept=ubuntu-14.04-amd64-vbox --yes      # on master
• service salt-master restart                    # on master

But this didn't help. The minion started throwing another error

root@ubuntu-14:/etc/salt/pki/minion# salt-call test.ping
[CRITICAL] The Salt Master has rejected this minion's public key!
To repair this issue, delete the public key for this minion on the Salt Master and restart this minion.
Or restart the Salt Master in open mode to clean out the keys. The Salt Minion will now exit.

To get rid of this error, I had to run

• salt-key --delete-all   # on master
• service salt-minion restart  # on all minions including master
• salt-key --accept-all

SaltStack Quick start

Reference: This blog post is prepared by referring the book "Salt Essentials; Craig Sebenik & Thomas Hatch; Oreilly publications"

Installation

• yum list salt salt-master salt-minion
• yum install -y salt salt-minion   #Install these 2 packages on minions & master
• yum install -y salt-master   # Install this package on master

Configuring master IP/DNS in minions

The basic minion configuration is located in /etc/salt/minion.You need to configure each minion with the DNS name or IP address of your Salt master. 

The default Salt master configured is

$ grep '#master:' /etc/salt/minion

#master: salt

This needs to be changed to our master IP or DNS name