redo salt setup

2026-04-03 20:04:32 +01:00
parent b36d658ba1
commit 17a2d4413b
12 changed files with 167 additions and 295 deletions
--- a/salt/configs.sls
+++ b/salt/configs.sls
@@ -1,11 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-
-{% for daemon in salt_daemons %}
-/etc/salt/{{ daemon }}:
-  file.managed:
-    - source: salt://salt/files/{{ daemon }}.jinja
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: 644
-{% endfor %}
--- a/salt/deb_install/init.sls
+++ b/salt/deb_install/init.sls
@@ -1,46 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-{% from "salt/deb_install/map.jinja" import osrelease, oscodename with context %}
-
-/etc/apt/keyrings/salt-archive-keyring-2023.pgp:
-  file.managed:
-    - source: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
-    - source_hash: 36decef986477acb8ba2a1fc4041bcf9f22229ef6c939d0317c9e36a9d142b34
-
-/etc/apt/sources.list.d/salt.list:
-  file.managed:
-    - contents: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=amd64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main
-
-salt-common:
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}'
-    - refresh: true
-    - require:
-      - file: /etc/apt/keyrings/salt-archive-keyring-2023.pgp
-      - file: /etc/apt/sources.list.d/salt.list
-
-salt {{ salt.pillar.get("salt:version") }}:
-  pkg.held:
-    - pkgs:
-      - salt-common
-{% for daemon in salt_daemons %}
-      - salt-{{ daemon }}
-{% endfor %}
-    - require:
-      - pkg: salt-common
-{% for daemon in salt_daemons %}
-      - pkg: salt-{{ daemon }}
-{% endfor %}
-  
-{% for daemon in salt_daemons %}
-salt-{{ daemon }}:
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}'
-    - require:
-      - pkg: salt-common
-  service.running:
-    - enable: true
-    - require:
-      - pkg: salt-{{ daemon }}
-    - listen:
-      - file: /etc/salt/{{ daemon }}
-{% endfor %}
--- a/salt/deb_install/map.jinja
+++ b/salt/deb_install/map.jinja
@@ -1,7 +0,0 @@
-{% if grains['os'] == 'Debian' and grains['osrelease']|int > 11 %}
-  {% set osrelease = 11 %}
-  {% set oscodename = 'bullseye' %}
-{% else %}
-  {% set osrelease = grains['osrelease'] %}
-  {% set oscodename = grains['oscodename'] %}
-{% endif %}
--- a/salt/files/SALT-PROJECT-GPG-PUBKEY-2023.pub
+++ b/salt/files/SALT-PROJECT-GPG-PUBKEY-2023.pub
@@ -1,41 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGNBGPazmABDAC6qc2st6/Uh/5AL325OB5+Z1XMFM2HhQNjB/VcYbLvcCx9AXsU
-eaEmNPm6OY3p5+j8omjpXPYSU7DUQ0lIutuAtwkDMROH7uH/r9IY7iu88S6w3q89
-bgbnqhu4mrSik2RNH2NqEiJkylz5rwj4F387y+UGH3aXIGryr+Lux9WxfqoRRX7J
-WCf6KOaduLSp9lF4qdpAb4/Z5yExXtQRA9HULSJZqNVhfhWInTkVPw+vUo/P9AYv
-mJVv6HRNlTb4HCnl6AZGcAYv66J7iWukavmYKxuIbdn4gBJwE0shU9SaP70dh/LT
-WqIUuGRZBVH/LCuVGzglGYDh2iiOvR7YRMKf26/9xlR0SpeU/B1g6tRu3p+7OgjA
-vJFws+bGSPed07asam3mRZ0Y9QLCXMouWhQZQpx7Or1pUl5Wljhe2W84MfW+Ph6T
-yUm/j0yRlZJ750rGfDKA5gKIlTUXr+nTvsK3nnRiHGH2zwrC1BkPG8K6MLRluU/J
-ChgZo72AOpVNq9MAEQEAAbQ5U2FsdCBQcm9qZWN0IFBhY2thZ2luZyA8c2FsdHBy
-b2plY3QtcGFja2FnaW5nQHZtd2FyZS5jb20+iQHSBBMBCAA8FiEEEIV//dP5Hq5X
-eiHWZMu8gXPXaz8FAmPazmACGwMFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheA
-AAoJEGTLvIFz12s/yf0L/jyP/LfduA4DwpjKX9Vpk26tgis9Q0I54UerpD5ibpTA
-krzZxK1yFOPddcOjo+Xqg+I8aA+0nJkf+vsfnRgcpLs2qHZkikwZbPduZwkNUHX7
-6YPSXTwyFlzhaRycwPtvBPLFjfmjjjTi/aH4V/frfxfjH/wFvH/xiaiFsYbP3aAP
-sJNTLh3im480ugQ7P54ukdte2QHKsjJ3z4tkjnu1ogc1+ZLCSZVDxfR4gLfE6GsN
-YFNd+LF7+NtAeJRuJceXIisj8mTQYg+esTF9QtWovdg7vHVPz8mmcsrG9shGr+G9
-iwwtCig+hAGtXFAuODRMur9QfPlP6FhJw0FX/36iJ2p6APZB0EGqn7LJ91EyOnWv
-iRimLLvlGFiVB9Xxw1TxnQMNj9jmB1CA4oNqlromO/AA0ryh13TpcIo5gbn6Jcdc
-fD4Rbj5k+2HhJTkQ78GpZ0q95P08XD2dlaM2QxxKQGqADJOdV2VgjB2NDXURkInq
-6pdkcaRgAKme8b+xjCcVjLkBjQRj2s5gAQwAxmgflHInM8oKQnsXezG5etLmaUsS
-EkV5jjQFCShNn9zJEF/PWJk5Df/mbODj02wyc749dSJbRlTY3LgGz1AeywOsM1oQ
-XkhfRZZqMwqvfx8IkEPjMvGIv/UI9pqqg/TY7OiYLEDahYXHJDKmlnmCBlnU96cL
-yh7a/xY3ZC20/JwbFVAFzD4biWOrAm1YPpdKbqCPclpvRP9N6nb6hxvKKmDo7MqS
-uANZMaoqhvnGazt9n435GQkYRvtqmqmOvt8I4oCzV0Y39HfbCHhhy64HSIowKYE7
-YWIujJcfoIDQqq2378T631BxLEUPaoSOV4B8gk/Jbf3KVu4LNqJive7chR8F1C2k
-eeAKpaf2CSAe7OrbAfWysHRZ060bSJzRk3COEACk/UURY+RlIwh+LQxEKb1YQueS
-YGjxIjV1X7ScyOvam5CmqOd4do9psOS7MHcQNeUbhnjm0TyGT9DF8ELoE0NSYa+J
-PvDGHo51M33s31RUO4TtJnU5xSRb2sOKzIuBABEBAAGJAbYEGAEIACAWIQQQhX/9
-0/kerld6IdZky7yBc9drPwUCY9rOYAIbDAAKCRBky7yBc9drP8ctC/9wGi01cBAW
-BPEKEnfrKdvlsaLeRxotriupDqGSWxqVxBVd+n0Xs0zPB/kuZFTkHOHpbAWkhPr+
-hP+RJemxCKMCo7kT2FXVR1OYej8Vh+aYWZ5lw6dJGtgo3Ebib2VSKdasmIOI2CY/
-03G46jv05qK3fP6phz+RaX+9hHgh1XW9kKbdkX5lM9RQSZOof3/67IN8w+euy61O
-UhNcrsDKrp0kZxw3S+b/02oP1qADXHz2BUerkCZa4RVK1pM0UfRUooOHiEdUxKKM
-DE501hwQsMH7WuvlIR8Oc2UGkEtzgukhmhpQPSsVPg54y9US+LkpztM+yq+zRu33
-gAfssli0MvSmkbcTDD22PGbgPMseyYxfw7vuwmjdqvi9Z4jdln2gyZ6sSZdgUMYW
-PGEjZDoMzsZx9Zx6SO9XCS7XgYHVc8/B2LGSxj+rpZ6lBbywH88lNnrm/SpQB74U
-4QVLffuw76FanTH6advqdWIqtlWPoAQcEkKf5CdmfT2ei2wX1QLatTs=
-=ZKPF
-----END PGP PUBLIC KEY BLOCK-----
--- a/salt/files/logrotate
+++ b/salt/files/logrotate
@@ -0,0 +1,50 @@
+/var/log/salt/master {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+	create 0640 salt salt
+}
+
+/var/log/salt/minion {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+}
+
+/var/log/salt/key {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+	create 0640 salt salt
+}
+
+/var/log/salt/api {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+	create 0640 salt salt
+}
+
+/var/log/salt/syndic {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+}
+
+/var/log/salt/proxy {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+}
--- a/salt/files/update_salt.sh
+++ b/salt/files/update_salt.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+set -e
+set -x
+SALT_VERSION='{{ salt.pillar.get("salt:version") }}'
+/usr/bin/salt-pip install "salt==$SALT_VERSION"
+/usr/bin/salt-pip install -r "https://raw.githubusercontent.com/saltstack/salt/refs/tags/v$SALT_VERSION/requirements/zeromq.txt"
--- a/salt/init.sls
+++ b/salt/init.sls
@@ -1,12 +1,74 @@
-include:
-  - salt.configs
-{% if grains['osarch'].lower().startswith('arm') or grains['os'] == 'Fedora' %}
-  - salt.pypi_install
-{% elif grains['os_family'] == 'Debian' %}
-  - salt.deb_install
-{% elif grains['os_family'] == 'RedHat' %}
-  - salt.rhel_install
-{% else %}
-  {{ raise("Unsupported grains.os") }}
+{% macro salt_daemon(daemon) %}
+salt-{{ daemon }}:
+  service.running:
+    - enable: true
+    - listen:
+      - file: /etc/salt/{{ daemon }}
+    - watch:
+      - cmd: update salt
+    - require:
+      - file: /lib/systemd/system/salt-{{ daemon }}.service
+      - module: systemd reload for salt
+/etc/salt/{{ daemon }}:
+  file.managed:
+    - source: salt://{{ slspath }}/files/{{ daemon }}.jinja
+    - template: jinja
+    - user: root
+    - group: root
+    - mode: 640
+/lib/systemd/system/salt-{{ daemon }}.service:
+  file.managed:
+    - source: salt://{{ slspath }}/files/salt-{{ daemon }}.service
+    - user: root
+    - group: root
+    - mode: 644
+{% endmacro %}
+
+/etc/logrotate.d/salt:
+  file.managed:
+    - source: salt://{{ slspath }}/files/logrotate
+    - user: root
+    - group: root
+    - mode: 644
+
+{{ salt_daemon("minion" ) }}
+
+{% if salt.pillar.get('salt:master', false) %}
+{{ salt_daemon("master" ) }}
 {% endif %}
-  - salt.modules
+
+systemd reload for salt:
+  module.run:
+    - name: service.systemctl_reload
+    - onchanges:
+      - file: /lib/systemd/system/salt-minion.service
+{% if salt.pillar.get('salt:master', false) %}
+      - file: /lib/systemd/system/salt-master.service
+{% endif %}
+
+saltutil.sync_all:
+  saltutil.sync_all:
+    - refresh: True
+
+salt dependencies:
+  pkg.installed:
+    - pkgs:
+      - usbutils  # for the lsusb grain
+      - dmidecode
+
+{% for link in ('salt', 'salt-call', 'salt-minion', 'salt-proxy', 'salt-run', 'salt-key') %}
+/usr/bin/{{ link }}:
+  file.symlink:
+    - target: /opt/saltstack/salt/bin/{{ link }}
+{% endfor %}
+/usr/bin/salt-pip:
+  file.symlink:
+    - target: /opt/saltstack/salt/bin/pip
+
+update salt:
+  cmd.script:
+    - source: salt://{{ slspath }}/files/update_salt.sh
+    - template: jinja
+    - unless: /usr/bin/salt-pip freeze | grep -q 'salt=={{ salt.pillar.get("salt:version") }}'
+    - require:
+      - file: /usr/bin/salt-pip
--- a/salt/map.jinja
+++ b/salt/map.jinja
@@ -1,5 +0,0 @@
-{% if salt.pillar.get('salt:master', false) %}
-{%   set salt_daemons = ['master', 'minion'] %}
-{% else %}
-{%   set salt_daemons = ['minion'] %}
-{% endif %}
--- a/salt/modules.sls
+++ b/salt/modules.sls
@@ -1,7 +0,0 @@
-saltutil.sync_all:
-  saltutil.sync_all:
-    - refresh: True
-
-{# required for the lsusb grain #}
-usbutils:
-  pkg.installed: []
--- a/salt/pypi_install.sls
+++ b/salt/pypi_install.sls
@@ -1,49 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-
-'make salt venv':
-  cmd.run:
-    - name: /usr/bin/python3 -m venv /opt/saltstack/salt
-    - creates: /opt/saltstack/salt
-
-pip install salt:
-  cmd.run:
-    - name: /opt/saltstack/salt/bin/pip3 install 'salt=={{ salt.pillar.get("salt:version") }}'
-    - unless: /opt/saltstack/salt/bin/pip3 freeze | grep -q 'salt=={{ salt.pillar.get("salt:version") }}'
-    - require:
-      - cmd: 'make salt venv'
-
-{%   for link in ('salt', 'salt-call', 'salt-minion', 'salt-proxy', 'salt-run', 'salt-key') %}
-/usr/bin/{{ link }}:
-  file.symlink:
-    - target: /opt/saltstack/salt/bin/{{ link }}
-{%   endfor %}
-/usr/bin/salt-pip:
-  file.symlink:
-    - target: /opt/saltstack/salt/bin/pip3
-
-systemd reload for salt:
-  module.run:
-    - name: service.systemctl_reload
-    - onchanges:
-{%   for daemon in salt_daemons %}
-      - file: /lib/systemd/system/salt-{{ daemon }}.service
-{%   endfor %}
-
-{%   for daemon in salt_daemons %}
-/lib/systemd/system/salt-{{ daemon }}.service:
-  file.managed:
-    - source: salt://salt/files/salt-{{ daemon }}.service
-    - user: root
-    - group: root
-    - mode: 644
-salt-{{ daemon }}:
-  service.running:
-    - enable: true
-    - require:
-      - file: /lib/systemd/system/salt-{{ daemon }}.service
-      - module: systemd reload for salt
-    - watch:
-      - cmd: pip install salt
-    - listen:
-      - file: /etc/salt/{{ daemon }}
-{%   endfor %}
--- a/salt/rhel_install.sls
+++ b/salt/rhel_install.sls
@@ -1,42 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-
-{% if grains['os'] not in ('CentOS', 'AlmaLinux') %}
-  {{ raise("Unsupported distro") }}
-{% endif %}
-
-/etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023:
-  file.managed:
-    - source: salt://salt/files/SALT-PROJECT-GPG-PUBKEY-2023.pub
-salt:
-  pkgrepo.managed:
-    - baseurl: "https://repo.saltproject.io/salt/py3/redhat/{{ grains['osmajorrelease'] }}/x86_64/minor/{{ salt.pillar.get("salt:version") }}"
-    - humanname: Salt repo for RHEL/CentOS/AlmaLinux {{ grains['osmajorrelease'] }} PY3
-    - gpgkey: file:///etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023
-    - skip_if_unavailable: true
-    - failovermethod: priority
-    - priority: 10
-    - enabled: 1
-    - enabled_metadata: 1
-    - gpgcheck: 1
-    - gpgkey: file:///etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023
-    - require:
-      - file: /etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}-*'
-    - refresh: true
-    - require:
-      - pkgrepo: salt
-
-{% for daemon in salt_daemons %}
-salt-{{ daemon }}:
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}-*'
-    - require:
-      - pkg: salt
-  service.running:
-    - enable: true
-    - require:
-      - pkg: salt-{{ daemon }}
-    - listen:
-      - file: /etc/salt/{{ daemon }}
-{% endfor %}