cb6e48feaa
We pass the pillars via the template engine context, this avoid the need to load `map.jinja` from the templates themselves and recude the number of `pillar.get` calls. * openssh/config.sls (sshd_config): pass `sshd_config` in the context. (ssh_config): pass `ssh_config` in the context. * openssh/files/default/ssh_config: remove `map.jinja` import since it's now in the context. * openssh/files/default/sshd_config: ditoo. * openssh/known_hosts.sls: pass `known_hosts` in the context. * openssh/files/default/ssh_known_hosts: use `known_hosts` from the context instead of calling `pillar.get` several times. BREAKING CHANGE: Minimum Salt version support is now `2019.2` in line with official upstream support; also use of the `traverse` Jinja filter.
104 lines
4.3 KiB
Django/Jinja
104 lines
4.3 KiB
Django/Jinja
{#
|
|
# vi:syntax=jinja
|
|
#}
|
|
|
|
{#- Generates one known_hosts entry per given key #}
|
|
{%- macro known_host_entry(host, host_names, keys, include_localhost, omit_ip_address) %}
|
|
|
|
{#- Get IPv4 and IPv6 addresses from the DNS #}
|
|
{%- if not (omit_ip_address is sameas true or host in omit_ip_address) %}
|
|
{%- set ip4 = salt['dig.A'](host) -%}
|
|
{%- set ip6 = salt['dig.AAAA'](host) -%}
|
|
{%- else %}
|
|
{%- set ip4 = [] -%}
|
|
{%- set ip6 = [] -%}
|
|
{%- endif %}
|
|
|
|
{#- The host names to use are to be found within the dict 'host_names'. #}
|
|
{#- If there are none, the host is used directly. #}
|
|
{%- set names = host_names.get(host, host) -%}
|
|
{%- set names = [names] if names is string else names %}
|
|
{%- if include_localhost and host == grains['id'] %}
|
|
{%- do names.append('localhost') %}
|
|
{%- do names.append('127.0.0.1') %}
|
|
{%- do names.append('::1') %}
|
|
{%- endif -%}
|
|
|
|
{#- Extract the hostname from the FQDN and add it to the names. #}
|
|
{%- if use_hostnames is iterable -%}
|
|
{%- for name in names | sort -%}
|
|
{%- if salt["match.{}".format(hostnames_tgt_type)](hostnames_target, minion_id=name) -%}
|
|
{%- set hostname = name.split('.')|first -%}
|
|
{%- if hostname not in names -%}
|
|
{%- do names.append(hostname) -%}
|
|
{%- endif -%}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
{%- endif -%}
|
|
|
|
{#- Append IP addresses and aliases (if they are not already present) #}
|
|
{%- for ip in (ip4 + ip6)|sort -%}
|
|
{%- do names.append(ip) -%}
|
|
{%- for alias in aliases_ips.get(ip, []) -%}
|
|
{%- if alias not in names -%}
|
|
{%- do names.append(alias) -%}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
{%- endfor -%}
|
|
|
|
{#- Write one line per key; join the names together #}
|
|
{%- for line in keys.split('\n') -%}
|
|
{%- if line -%}
|
|
{{ ','.join(names) }} {{ line }}
|
|
{% endif -%}
|
|
{%- endfor -%}
|
|
{%- endmacro -%}
|
|
|
|
{#- Pre-fetch pillar data #}
|
|
{%- set target = known_hosts | traverse('target', "*.{}".format(grains['domain'])) -%}
|
|
{%- set tgt_type = known_hosts | traverse('tgt_type', 'glob') -%}
|
|
{%- set keys_function = known_hosts | traverse('mine_keys_function', 'public_ssh_host_keys') -%}
|
|
{%- set hostname_function = known_hosts | traverse('mine_hostname_function', 'public_ssh_hostname') -%}
|
|
{%- set use_hostnames = known_hosts | traverse('hostnames', False) -%}
|
|
{%- set hostnames_target_default = '*' if grains['domain'] == '' else "*.{}".format(grains['domain']) -%}
|
|
{%- set hostnames_target = known_hosts | traverse('hostnames:target', hostnames_target_default) -%}
|
|
{%- set hostnames_tgt_type = known_hosts | traverse('hostnames:tgt_type', 'glob') -%}
|
|
{%- set include_localhost = known_hosts | traverse('include_localhost', False) -%}
|
|
{%- set omit_ip_address = known_hosts | traverse('omit_ip_address', []) -%}
|
|
|
|
{#- Lookup IP of all aliases so that when we have a matching IP, we inject the alias name
|
|
in the SSH known_hosts entry -#}
|
|
{%- set aliases = known_hosts | traverse('aliases', []) -%}
|
|
{%- set aliases_ips = {} -%}
|
|
{%- for alias in aliases -%}
|
|
{%- for ip in salt['dig.A'](alias) + salt['dig.AAAA'](alias) -%}
|
|
{%- do aliases_ips.setdefault(ip, []).append(alias) -%}
|
|
{%- endfor -%}
|
|
{%- endfor -%}
|
|
|
|
{#- Salt Mine #}
|
|
{%- set host_keys = salt['mine.get'](target, keys_function, tgt_type=tgt_type) -%}
|
|
{%- set host_names = salt['mine.get'](target, hostname_function, tgt_type=tgt_type) -%}
|
|
|
|
{#- Salt SSH (if any) #}
|
|
{%- set public_ssh_host_keys = known_hosts | traverse('salt_ssh:public_ssh_host_keys', {}) %}
|
|
{%- for minion_id, minion_host_keys in public_ssh_host_keys.items() -%}
|
|
{%- if salt["match.{}".format(tgt_type)](target, minion_id=minion_id) -%}
|
|
{% do host_keys.update({minion_id: minion_host_keys}) %}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
{%- set public_ssh_host_names = known_hosts | traverse('salt_ssh:public_ssh_host_names', {}) %}
|
|
{%- for minion_id, minion_host_names in public_ssh_host_names.items() -%}
|
|
{%- if salt["match.{}".format(tgt_type)](target, minion_id=minion_id) -%}
|
|
{% do host_names.update({minion_id: minion_host_names}) %}
|
|
{%- endif -%}
|
|
{%- endfor %}
|
|
|
|
{#- Static Pillar data #}
|
|
{%- do host_keys.update(known_hosts | traverse('static', {})) -%}
|
|
|
|
{#- Loop over targetted minions -#}
|
|
{%- for host, keys in host_keys| dictsort -%}
|
|
{{ known_host_entry(host, host_names, keys, include_localhost, omit_ip_address) }}
|
|
{%- endfor -%}
|