Busk: Created page with "- Shameless rip from - https://sites.google.com/site/mrxpalmeiras/saltstack/salt-cheat-sheet ``` Contents 1 BOOTSTRAP 2 SERVICES 3 TARGETING 4 KEY MANAGEMENT 5 SERVER DIAGN..."

2020-07-21T12:31:49Z

Created page with "- Shameless rip from - https://sites.google.com/site/mrxpalmeiras/saltstack/salt-cheat-sheet ``` Contents 1 BOOTSTRAP 2 SERVICES 3 TARGETING 4 KEY MANAGEMENT 5 SERVER DIAGN..."

New page

- Shameless rip from
- https://sites.google.com/site/mrxpalmeiras/saltstack/salt-cheat-sheet

```
Contents

1 BOOTSTRAP
2 SERVICES
3 TARGETING
4 KEY MANAGEMENT
5 SERVER DIAGNOSTICS
6 GRAINS
7 MINE
8 PACKAGES AND INSTALLATION
9 JOBS AND PROCESS CONTROL
10 REACTOR
11 DEBUG
12 FILE OPERATIONS
13 USER AND GROUP MGMT
14 STATES
15 SSH Management (Agentless)
16 PILLAR
17 PORTS & NETWORK
18 JINJA
19 ETC
DOCS & FILES
Modules List
https://docs.saltstack.com/en/latest/salt-modindex.html
State List
https://docs.saltstack.com/en/latest/ref/states/all/index.html#all-salt-states

Salt source files
/usr/lib/python<version>/site-packages/salt

BOOTSTRAP
Bootstrap Install
https://repo.saltstack.com/#bootstrap

wget -O bootstrap_salt.sh https://bootstrap.saltstack.com

install Master
sh bootstrap_salt.sh -M

install specific Salt version
sh bootstrap_salt.sh git v2015.8.8
SERVICES

Start / Stop / Restart service on Minion
salt 'target' service.start "service name" (start/stop/restart)

Restart Minion on Win target
salt 'target' cmd.run 'start powershell "Restart-Service -Name salt-minion"'

Restart Minion on Linux target
salt 'target' cmd.run 'service salt-minion restart"'

Execute a script remotely
salt target cmd.exec_code python 'import sys; print sys.version'
2.7.8 GCC 4.9.1

salt target cmd.exec_code sh 'echo $PATH'
/usr/local/bin:/usr/local/sbin

Check service on minion
salt target service.status httpd

Check if service is available
salt target service.available httpd

get all services
salt target service.get_all

reload a service config (avoids restart)
salt target service.reload httpd

start | stop | restart a service
salt target service.start httpd

TARGETING
by OS grain
salt -G os:Windows cmd.run "net stop Firewall"

by other grains
salt –G 'server_type:app and env:prod' state.highstate

target EC2 instances only
salt -G uuid:ec2\* test.ping

compound match
salt –C 'server_type:web and clo*' state.sls nginx

list based match
salt –L 'hostname1,hostname2,hostname3' state.sls ntp

Nodegroup match
salt –N ny_db_servers cmd.run 'ps –ef | grep mysql'

regex OR
salt -E "(nyweb|db5)" test.ping

by pillar value
salt -I 'role:webserver' test.ping
KEY MANAGEMENT

Add Minions to Master
salt-key -L (show pending to be accepted)
salt-key -A (accept all pending)
salt-key -a target (accept by hostname)

Remove inactive minions from Salt
salt-run manage.down removekeys=True

Remove minions by name
salt-key -D targetName

SERVER DIAGNOSTICS

Test Connection
salt 'target' test.ping

Diagnostics
salt target status.all_status // gets all info
status.cpu_info
status.cpustats
status.uptime
status.diskusage // or disk.usage
status.loadavg
status.meminfo
status.netdev // network device
status.netstats //network stats
status.procs
status.version //system version
status.vmstats //virtual mem stats
status.w //who is logged in

Show Minions by State (Up/Down)
salt-run manage.up
salt-run manage.down
salt-run manage.status (show all by status)

Compliance and Audit

to get a compliance result, run a State check with test=True
salt \* state.highstate test=True

This will return any differences from existing configuration to whats in
the Top file

Show Salt Master version
salt --versions-report

Show Salt Minion version
salt-call --versions-report

Start Minion in Debug mode
salt-master --log-level=debug

Restart everything on Master:
pkill salt-minion //Kill minion
pkill salt-syndic // Kill Syndic
salt-run cache.clear_all //Clear all cache
salt '*' saltutil.sync_grains //Sync grains
salt-master -d //Start master daemon
salt-minion -d //Start minion daemon
salt-syndic -d //Start syndic daemon

Agent Env Info

show all information about a minion (lots of data)
salt minion status.all_status

show memory
salt minion status.meminfo

show disk usage
salt minion status.diskusage

show who is logged in
salt minion status.w

GRAINS

Show Grain data
salt '*' grains.ls
salt '*' grains.items

get specific Grain
salt cent7 grains.get selinux
cent7:
----------
enabled:
True
enforced:
Enforcing

can also do the same with
salt cent7 grains.item selinux

set a Grain data on a node
salt cent7 grains.set 'apps:Myapp:port' 2500

salt cent7 grains.item apps
cent7:
----------
apps:
----------
Myapp:
----------
port:
2500

All grain data is stored on the minion in /etc/salt/grains file
if adding more data manually, refresh Grains on the Master to pick up changes
salt target saltutil.refresh_modules

Use grain in a state file
apache:
pkg.installed:
{% if grains['os'] == 'RedHat' %}
- name: httpd

show JSON output
salt target grains.item ipv4 --out=json
{
"target": {
"ipv4": [
"10.0.2.15",
"127.0.0.1",
"192.168.56.102"
]
}
}

Use grain as a variable
{% set nodename = grains['nodename'] %}

base:
'*':
- common
- packages
- users
- servers.{{ nodename }}

MINE

show mine data
salt \* mine.get \* x509.get_pem_entries

PACKAGES AND INSTALLATION

Verbose output (timeout 300 sec)
salt 'target' state.hightstate -t 300 -v

Show package version
salt 'target' pkg.version apache

install package on minions
salt 'target' pkg.install apache

Uninstall pkg
salt 'target' pkg.remove 'npp'
salt 'target' pkg.purge 'npp'

Show Installed Packages or Software
salt 'target' pkg.list_pkgs

show all packages that need updates
salt target pkg.list_upgrades

upgrade all packages
salt target pkg.upgrade

Windows (Chocolatey)
install chocolatey
salt wintarget chocolatey.bootstrap

install pkg using choco
salt mrxwin7 chocolatey.install 7zip

JOBS AND PROCESS CONTROL

Show all Salt jobs run history
salt-run jobs.list_jobs

Show active Salt jobs
salt-run jobs.active // returns a Job ID

Show currently running processes on a minion
salt '*' saltutil.running

Kill active job
salt 'target' saltutil.kill_job $JOB_ID
salt '*' saltutil.term_job <job id>

Clear Job cache
salt '*' saltutil.clear_cache

REACTOR

examples of reactor matching

/etc/salt/master.d/reactor.conf
reactor:
- 'sayhello':
- /srv/reactor/test.sls

/srv/reactor/test.sls
{% if data['id'].startswith('web') %}
sayhello:
local.state.apply:
- tgt: {{ data['id'] }}
- arg:
- say-hello

local.cmd.run:
- tgt: minion1
- arg:
- "echo 'hello' > /tmp hello"

{% endif %}

DEBUG

Run highstate in debug
salt-call -l debug state.highstate

Run specific state in debug
salt-call -l debug state.sls elasticsearch

show highstate process (debug YAML syntax errors)
salt-call state.show_highstate

show specific State details
salt 'target' state.show_sls apache

show only Changed and Failed during run
modify /etc/salt/master and /etc/salt/minion, restart Master after change
state_verbose: True
state_output: mixed

start minion in debug, see connection errors
salt-minion -l debug

https://docs.saltstack.com/en/latest/topics/troubleshooting/minion.html

if Master not seeing Minion key requests, add IPTables rules to Master,
root@master# iptables -I INPUT -s 172.31.23.0/24 -p tcp -m multiport --dports 4505,4506 -j ACCEPT
root@master# iptables -I INPUT -s 172.31.25.0/24 -p tcp -m multiport --dports 4505,4506 -j ACCEPT

# reject everything else,
root@master# iptables -A INPUT -p tcp -m multiport --dports 4505,4506 -j REJECT

Log Jinja variables to Minion
{% do salt.log.error('testing jinja logging') -%}

show Options passed to a State (ie, test=true)
{% do salt.log.error(opts['test']) -%}

Output variables from State file,
show_var:
- test.show_notification:
- text: This is my var {{ var }}

Exit w failure message

fail_run:
test.fail_without_changes:
- name: your message here

FILE OPERATIONS
Check if file contains a string (true/false)
salt '*' file.contains /etc/ssh/sshd_config 'Port'

Check if a file on the Salt minions contains a certain regex (search file on minions):
salt "*" file.contains_regex /etc/resolv.conf "timeout.4"

check if file is a file or directory
salt target file.stats /etc/hosts

Find a file
salt '*' file.find /etc name=host\*.\*
result
- /etc/host.conf
- /etc/hosts.allow
- /etc/hosts.deny'
copy small file ( > 100kb) from Master to minion
salt-cp 'target' /opt/file (source) /opt (destination)

copy dir from Master /srv/salt area to minion
salt 'target' cp.get_dir salt://myDir /target/dir

copy large file from Master /srv/salt/distribution folder to minion
salt 'target' cp.get_file salt://distribution/myFile.tar /tmp/myFile.tar

copy file from one minion to another using MinionFS (only works on Salt 2016.3.2)
https://docs.saltstack.com/en/latest/topics/tutorials/minionfs.html

add MinionFS to master conf file
vi /etc/salt/master

add this lines:
minionfs_mountpoint: salt://minionfs
file_recv: True

restart Master

get the file from the minion and store it in MinionFS
salt 'target' cp.push /path/to/file/or/dir/on/minion

files are stored on Master in here:
/var/cache/salt/master/minions/<minion>

copy file from Minion to Master
on Master, set "file_recv: True" in /etc/salt/master, restart Master

to copy file,

salt \* cp.push /path/to/file/on/minion

all files are stored on Master /var/cache/salt/master/minions/<minion>/files

add host entry to a minion
salt target hosts.add_host 192.168.55.100 hostname

Replace contents of file with new value
salt '*' file.sed /etc/ssh/sshd_config 'Port 22' 'Port 2201'

Create folder
salt '*' file.makedirs /tmp/testFolder/ (for windows use native Win syntax, ie C:/temp/dir)

Delete folder
salt '*' file.remove /tmp/testFolder

Create new file
salt '*' file.touch /tmp/testFolder/emptyFile

manage file content in State file
/etc/fstab:
file.line:
- content: "proc /proc"
- mode: insert
- after

replace contents of file
update_modprobe:
file.replace:
- name: /etc/modprobe.d/salt_cis.conf
- pattern: "^install {{ fs }} /bin/true"
- repl: install {{ fs }} /bin/true
- append_if_not_found: True

create symlink
symlink:
file.symlink:
- name: /path/to/A
- target: /symlink/path/A
create directory

/home/qb/q3:
file.directory:
- user: qb
- group: qb
- dir_mode: 755
- file_mode: 755
- require:
- user: qb

replace file contents using Augeas
sshd_config:
augeas.change:
- context: /files/etc/ssh/sshd_config
- changes:
- set Port 8888
- set PasswordAuthentication yes
- set PubkeyAuthentication yes

copy directory from Master to minion

app_ta_nix_dir:
file.recurse:
- name: /opt/splunkforwarder/etc/apps/Splunk_TA_nix
- source: salt://{{ slspath }}/files/apps/Splunk_TA_nix
- makedirs: True
- user: splunk
- group: splunk
- file_mode: 0755

File Managed

try several files if 1st one doesnt exist

monit_config:
file.managed:
- name: /etc/monit/monit.conf
- source:
- salt://{{ slspath }}/files/configs/host/{{ grains.id }}.j2
- salt://{{ slspath }}/files/configs/profile/{{ salt['pillar.get']('profile') }}.j2
- salt://{{ slspath }}/files/configs/default.j2
- template: jinja
- makedirs: True
- mode: 0600
- user: monit
- group: monit

USER AND GROUP MGMT

Set user's password to 123123
salt '*' shadow.set_password user02
'$6$EYk3o52W$DaSUIfHpYMBkSShFYXdODyrHbmQlCNKFghNl9FZzZshUn240GCOn5szQ3piyBMtt/x4m.'

Generate a password
salt 'target' shadow.gen_password myP@ssword
$6$nTul6WP1$EJ6THWEYKgOuGjqSEhnv8ZcYET6z/sDsSB.YBoyImRWEoDjguvcUahnY3UuNtNpECVhwxsjWI6ucvCc1

Additional ways to generate you own password:
python -c "import crypt, getpass, pwd; print crypt.crypt('yourpassword', '\$6\$SALTsalt\$')"
openssl passwd -1

Add User
salt target user.add Joe

Remove User
salt '*' user.delete Joe remove=True force=True

Show all users on a target
salt target user.list_users

Info on all users on a target
salt target user.getent

Info on specific user
salt target user.info Joe

Add User to Group
salt target user.chgroups Joe Administrator, LocalAdmin True
// or
salt target group.adduser admins Joe

Remove User from Group
salt target group.deluser admins Joe

Show users Groups
salt target user.list_groups Joe

Change Users Shell
salt '*' user.chshell user02 /bin/bash

get info on all groups
salt target group.getent

get info o a particular group
salt target group.info splunk

Delete group
salt target group.delete splunk

STATES
Highstate
salt '*' state.highstate

Deploy specific state
salt '*' state.apply webserver
Run multiple state executions on same minion at once (by design Salt limits 1 state per minion at once)
salt target state.sls yourState concurrent=True

Requisites

https://docs.saltstack.com/en/latest/ref/states/requisites.html

unless
vim:
pkg.installed:
- unless:
- rpm -q vim-enhanced
- ls /usr/bin/vim

onlyif
set_RTC:
cmd.run:
- name: "/usr/bin/timedatectl set-local-rtc 0"
- onlyif: "/usr/bin/timedatectl | grep "RTC in local TZ" | grep yes"

require
bar:
pkg.installed:
- require:
- sls: foo

onchanges
extract_package:
archive.extracted:
- name: /usr/local/share/myapp
- source: /usr/local/share/myapp.tar.xz
- archive_format: tar
- onchanges:
- file: Deploy server package

watch
ntpd:
service.running:
- watch:
- file: /etc/ntp.conf

prereq
prereq allows for actions to be taken based on the expected results of a state that has not yet been executed. The state containing the prereq requisite is defined as the pre-requiring state. The state specified in the prereq statement is defined as the pre-required state.

graceful-down:
cmd.run:
- name: service apache graceful
- prereq:
- file: site-code

use
The use requisite is used to inherit the arguments passed in another id declaration. This is useful when many files need to have the same defaults.
/etc/foo.conf:
file.managed:
- source: salt://foo.conf
- template: jinja
- mkdirs: True
- user: apache
- group: apache
- mode: 755

/etc/bar.conf:
file.managed:
- source: salt://bar.conf
- use:
- file: /etc/foo.conf

require_in
vim:
pkg.installed:
- require_in:
- file: /etc/vimrc

import YAML data into a state (same with import_json, import_text)

{% import_yaml 'formula/facl/files/configs/test.yaml' as myconfig %}

show_config:
- test.show_notification:
- text: {{ myconfig }}

SSH Management (Agentless)

edit the Roster file, include node's IP address and user to use (do this on Master)

vi /etc/salt/roster

# Sample salt-ssh config file
mrxcloud1:
host: 104.131.102.230 # The IP addr or DNS hostname
user: fred # Remote executions will be executed as user fred
passwd: foobarbaz # The password to use for login, if omitted, keys are used
sudo: True # Whether to sudo to root, not enabled by default

Run command on node (salt-ssh -i)
salt-ssh -i mrxcloud1 cmd.run "uname -a"

To run SSH as another user (non-root)

copy /etc/salt directory to /home/user and change perms to user:group
should look like,
/home/user/salt/master
/home/user/salt/minion
/home/user/salt/minion.d
/home/user/salt/minion_uid
/home/user/salt/pki
/home/user/salt/var
/home/user/salt/roster

configure Roster file: /home/joe.shmo/salt/roster

edit /home/joe.shmo/salt/master

change the following paths
pidfile: /home/user/salt/var/run/salt-master.pid
log_file: /home/user/salt/var/log/salt/master
pki_dir: /home/user/salt/pki/master
cachedir: /home/user/salt/var/cache/salt/master

Add to the Roster file, the path to the user's private key
machine1:
host: machine1.company.com
user: joe.shmo
sudo: True
priv: /home/joe.shmo/.ssh/id_rsa

run command with -c option
salt-ssh -c ~/salt -i machine1 cmd.run "/sbin/service jira status"

apply a state file
salt-ssh '*' state.apply network

Salt Roster File - Ansible-syntax (configure Roster to have variables and Groups)

PILLAR
Sample Pillar structure to create system users pillar structure

Salt top file calls the Users state

/srv/salt/top.sls

base:
'*':
- common
- users
Pillar top file tells what pillars to load for what nodes

/srv/pillar/top.sls

base:
'*':
- users

Users Pillar contains actual data for users
/srv/pillar/users.sls
users:
spiderman:
uid: 1280
fullname: 'spider man'
shell: /bin/bash
ssh-keys:
- ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAt1IFQP9xxx

black.hood:
uid: 1281
fullname: black hood
shell: '/bin/bash'
ssh-keys:
- ssh-rsa AADRN34zf12fdfd343434wAAAQEAwAAAQEA

supergirl:
uid: 1282
fullname: super girl!
shell: '/bin/bash'
ssh-keys:
- ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNWRiUmFXjxrp4V
- ssh-rsa ABCDEF134343434343dfdfdf343111dgfdfdfdf

Salt Users state parses array and creates users,

/srv/salt/users.sls
{% for user, args in pillar.get('users',{}).iteritems() %}

{{ user }}:

group.present:
- gid: {{ args['uid'] }}

user.present:
- fullname: {{ args['fullname'] }}
- uid: {{ args['uid'] }}
- gid: {{ args['uid'] }}
- shell: {{ args['shell'] }}
- home: /home/{{ user }}

{% endfor %}

Refresh pillars on all nodes
salt \* saltutil.refresh_pillar

Look at pillar data
salt \* pillar.items

get a Pillar value in a state file or Jinja file (and pass a default value if no pillar is found)
{{ salt['pillar.get']('role:name', 'default') }}

get Pillar value by passing a variable
{% for rt in salt['pillar.get']('network:routes:{0}:networks'.format(interface)) -%}
get nested pillar value (use semi colon to get to specific key)
salt nycweb01 pillar.get users:joe
PORTS & NETWORK
Master - Agent ports: 4505 (master to agent), 4506 (agent to master)

Get IP of a Minion
salt target network.ip_addrs

Ping from Minion
salt target network.ping someHostname

get all active TCP connections on a minion
salt target network.active_tcp

get ARP table
salt target network.arp

test port connectivity for certain port
salt target network.connect www.google.com 80

get hardware address for a MAC
salt target network.hw_addr eth0

get intet address for interface
salt target network.interface eth0

get all interfaces
salt target network.interfaces

JINJA
For Loop
{% for usr in 'moe','larry','curly' %}
{{ usr }}:
group:
- present
user:
- present
- gid_from_name: True
- require:
- group: {{ usr }}
{% endfor %}
If Conditional

{% if var == 2 %}
Var is 2
{% elif var == 5 %}
var is 5
{% else %}
var is not 2
{% endif %}
While loop

{% range number from 3 to 6 %}
{{ number }}
(...)
{% endrange %}

Comparisons

{% if 'Watermelon' ends with 'n' %}
It ends with N
{% endif %}

{% if varA == varB %}
{% if varA != varB %}

get shell command value from inside Jinja
{% set procs = salt['cmd.run']('ps aux') %}

disable tab space in a for loop
{% for server in servers %}
{{ server }}
{% endfor %}

results in:
server1
server2

to disable this, add

#jinja2: lstrip_blocks: True

to top of the template

Run a state only if a file doesnt exist,

{% if not salt['file.directory_exists']('/opt/q') %}

deploy_kdb:
file.managed:
- name: /opt/q.tar.gz
- source: salt://repo/q.tar.gz

extract_kdb:
archive.extracted:
- name: /opt/
- source: /opt/q.tar.gz
- user: kdb
- group: kdb

{% endif %}

Test for File

{% if not salt['file.file_exists']('/opt/file') %}

render parameter
{{ var_name }}

set a parameter
{% set fruit = 'apple' %}

Iterate dictionary (For Loop)
{% for name, app in applications.iteritems() %}
{{ name }}
{{ app['version'] }}
{% endfor %}

sort a list
{% for vm in vcenter['vm_list']|sort %}
{{ vm }}
{% endfor %}

or by attribute or reverse
{% for vm in vcenter['vm_list']|sort(attribute='osname', reverse = True) %}
get total # of elements in list
{{ myList|length }}

If statement with AND & OR
{% if var is None and var2 == 'blah' % or val3 == 'shmaa' %}

convert variable uppercase / lowercase
{{ somevar | upper }}

set a default value if value doesnt exist
{{ somevar or 'default message here' }}

match by regex
{% if grains.id | regex_match('nyc(.*)', ignorecase=True) %}

will match any grain in regex pattern

Jinja Tricks

difference
{{ [1, 2, 3] | difference([2, 3, 4]) | join(', ') }}
>> 1

avg, min, max, is_list,
{{ [1, 2, 3] | avg }}

generate random UID
{{ 'random' | uuid }}

date format
{{ 1457456400 | date_format }}
{{ 1457456400 | date_format('%d.%m.%Y %H:%M') }}
2017-03-08
08.03.2017 17:00
string to number
{{ '5' | to_num }}

run Salt execution module
{{ salt.cmd.run('whoami') }}
{{ salt.group.add('newgroup1') }}
regex match
{{ 'abcd' | regex_match('BC(.*)', ignorecase=True) }}

regex search
{{ 'muppet baby' | regex_search('pet(.*)', ignorecase=True) }}
>> baby

compare_lists, compare_dicts
{{ [1,2,3] | compare_lists([1,2,4]) }}
>> {'new': 4, 'old': 3}

list files in a directory
{{ '/etc/salt/' | list_files | join('\n') }}

escape Jinja syntax
{% raw %}
some text that contains jinja {% characters that need to be escaped
{% endraw %}

iterate a dictionary
parent_dict = [{'A':'val1','B':'val2'}]
{% for item in parent_dict %}
{% for key,val in item.items() %}
{{ key }} {{ val }}

ETC

generate random password hash
python -c "import crypt; print(crypt.crypt('password', crypt.mksalt(crypt.METHOD_SHA512)))"

```

Salt Cheat Sheet - Revision history

Busk: Created page with "- Shameless rip from - https://sites.google.com/site/mrxpalmeiras/saltstack/salt-cheat-sheet ``` Contents 1 BOOTSTRAP 2 SERVICES 3 TARGETING 4 KEY MANAGEMENT 5 SERVER DIAGN..."