Updated master and minion default config files
Added parameters new to 2016.03 (or simply missing in the existing config).
This commit is contained in:
Javier Bértoli
parent
03ec0dce2d
commit
edce95f949
@ -1,5 +1,5 @@
|
||||
# This file managed by Salt, do not edit by hand!!
|
||||
# Based on salt version 2015.8.7 default config
|
||||
# Based on salt version 2016.11 default config
|
||||
{% set reserved_keys = ['master', 'minion', 'cloud', 'salt_cloud_certs', 'engines', 'lxc.network_profile', 'lxc.container_profile'] -%}
|
||||
{% set cfg_salt = pillar.get('salt', {}) -%}
|
||||
{% set cfg_master = cfg_salt.get('master', {}) -%}
|
||||
@ -62,9 +62,23 @@
|
||||
# key_logfile, pidfile:
|
||||
{{ get_config('root_dir', '/') }}
|
||||
|
||||
# The path to the master's configuration file.
|
||||
{{ get_config('conf_file', '/etc/salt/master') }}
|
||||
|
||||
# Directory used to store public key data:
|
||||
{{ get_config('pki_dir', '/etc/salt/pki/master') }}
|
||||
|
||||
# Key cache. Increases master speed for large numbers of accepted
|
||||
# keys. Available options: 'sched'. (Updates on a fixed schedule.)
|
||||
# Note that enabling this feature means that minions will not be
|
||||
# available to target for up to the length of the maintanence loop
|
||||
# which by default is 60s.
|
||||
{%- if cfg_minion['key_cache'] in cfg_master %}
|
||||
{{ get_config('key_cache', '') }}
|
||||
{% else %}
|
||||
#key_cache: ''
|
||||
{% endif %}
|
||||
|
||||
# Directory to store job and cache data:
|
||||
# This directory may contain sensitive data and should be protected accordingly.
|
||||
#
|
||||
@ -77,7 +91,7 @@
|
||||
|
||||
# Directory for custom modules. This directory can contain subdirectories for
|
||||
# each of Salt's module types such as "runners", "output", "wheel", "modules",
|
||||
# "states", "returners", etc.
|
||||
# "states", "returners", "engines", etc.
|
||||
# Like 'extension_modules' but can take an array of paths
|
||||
{% if 'module_dirs' in cfg_master -%}
|
||||
{%- do default_keys.append('module_dirs') %}
|
||||
@ -101,6 +115,10 @@ module_dirs:
|
||||
# Set the number of hours to keep old job information in the job cache:
|
||||
{{ get_config('keep_jobs', '24') }}
|
||||
|
||||
# The number of seconds to wait when the client is requesting information
|
||||
# about running jobs.
|
||||
{{ get_config('gather_job_timeout', '10') }}
|
||||
|
||||
# Set the default timeout for the salt command and api. The default is 5
|
||||
# seconds.
|
||||
{{ get_config('timeout', '5') }}
|
||||
@ -113,6 +131,11 @@ module_dirs:
|
||||
# Set the default outputter used by the salt command. The default is "nested".
|
||||
{{ get_config('output', 'nested') }}
|
||||
|
||||
# Set the default output file used by the salt command. Default is to output
|
||||
# to the CLI and not to a file. Functions the same way as the "--out-file"
|
||||
# CLI option, only sets this to a single file for all salt commands.
|
||||
{{ get_config('output_file', 'None') }}
|
||||
|
||||
# Return minions that timeout when running commands like test.ping
|
||||
{{ get_config('show_timeout', 'True') }}
|
||||
|
||||
@ -124,6 +147,12 @@ module_dirs:
|
||||
# (true by default).
|
||||
{{ get_config('strip_colors', 'False') }}
|
||||
|
||||
# To display a summary of the number of minions targeted, the number of
|
||||
# minions returned, and the number of minions that did not return, set the
|
||||
# cli_summary value to True. (False by default.)
|
||||
#
|
||||
{{ get_config('cli_summary', 'False') }}
|
||||
|
||||
# Set the directory used to hold unix sockets:
|
||||
{{ get_config('sock_dir', '/var/run/salt/master') }}
|
||||
|
||||
@ -138,9 +167,21 @@ module_dirs:
|
||||
# the jobs system and is not generally recommended.
|
||||
{{ get_config('job_cache', 'True') }}
|
||||
|
||||
# Cache minion grains and pillar data in the cachedir.
|
||||
# Cache minion grains, pillar and mine data via the cache subsystem in the
|
||||
# cachedir or a database.
|
||||
{{ get_config('minion_data_cache', 'True') }}
|
||||
|
||||
# Cache subsystem module to use for minion data cache.
|
||||
{{ get_config('cache', 'localfs') }}
|
||||
# Enables a fast in-memory cache booster and sets the expiration time.
|
||||
{{ get_config('memcache_expire_seconds', '0') }}
|
||||
# Set a memcache limit in items (bank + key) per cache storage (driver + driver_opts).
|
||||
{{ get_config('memcache_max_items', '1024') }}
|
||||
# Each time a cache storage got full cleanup all the expired items not just the oldest one.
|
||||
{{ get_config('memcache_full_cleanup', 'False') }}
|
||||
# Enable collecting the memcache stats and log it on `debug` log level.
|
||||
{{ get_config('memcache_debug', 'False') }}
|
||||
|
||||
# Store all returns in the given returner.
|
||||
# Setting this option requires that any returner-specific configuration also
|
||||
# be set. See various returners in salt/returners for details on required
|
||||
@ -153,7 +194,7 @@ module_dirs:
|
||||
# By default, events are not queued.
|
||||
{{ get_config('event_return_queue', '0') }}
|
||||
|
||||
# Only events returns matching tags in a whitelist
|
||||
# Only return events matching tags in a whitelist, supports glob matches.
|
||||
{% if 'event_return_whitelist' in cfg_master -%}
|
||||
{%- do default_keys.append('event_return_whitelist') %}
|
||||
event_return_whitelist:
|
||||
@ -166,12 +207,12 @@ event_return_whitelist:
|
||||
- {{ event_return }}
|
||||
{%- endfor -%}
|
||||
{% else -%}
|
||||
# event_return_whitelist:
|
||||
# - salt/master/a_tag
|
||||
# - salt/master/another_tag
|
||||
#event_return_whitelist:
|
||||
# - salt/master/a_tag
|
||||
# - salt/run/*/ret
|
||||
{% endif %}
|
||||
|
||||
# Store all event returns _except_ the tags in a blacklist
|
||||
# Store all event returns **except** the tags in a blacklist supports globs.
|
||||
{% if 'event_return_blacklist' in cfg_master -%}
|
||||
{%- do default_keys.append('event_return_blacklist') %}
|
||||
event_return_blacklist:
|
||||
@ -184,9 +225,9 @@ event_return_blacklist:
|
||||
- {{ event_return }}
|
||||
{%- endfor -%}
|
||||
{% else -%}
|
||||
# event_return_blacklist:
|
||||
# - salt/master/not_this_tag
|
||||
# - salt/master/or_this_one
|
||||
#event_return_blacklist:
|
||||
# - salt/master/not_this_tag
|
||||
# - salt/wheel/*/ret
|
||||
{% endif %}
|
||||
|
||||
# Passing very large events can cause the minion to consume large amounts of
|
||||
@ -270,6 +311,9 @@ event_return_blacklist:
|
||||
# Set the ZeroMQ high water marks
|
||||
# http://api.zeromq.org/3-2:zmq-setsockopt
|
||||
|
||||
# The listen queue size / backlog
|
||||
{{ get_config('zmq_backlog', '1000') }}
|
||||
|
||||
# The publisher interface ZeroMQPubServerChannel
|
||||
{{ get_config('pub_hwm', '1000') }}
|
||||
|
||||
@ -291,6 +335,19 @@ event_return_blacklist:
|
||||
# ZMQ high-water-mark for EventPublisher pub socket
|
||||
{{ get_config('event_publisher_pub_hwm', '10000') }}
|
||||
|
||||
# The master may allocate memory per-event and not
|
||||
# reclaim it.
|
||||
# To set a high-water mark for memory allocation, use
|
||||
# ipc_write_buffer to set a high-water mark for message
|
||||
# buffering.
|
||||
# Value: In bytes. Set to 'dynamic' to have Salt select
|
||||
# a value for you. Default is disabled.
|
||||
{%- if 'ipc_write_buffer' in cfg_master %}
|
||||
{{ get_config('ipc_write_buffer', 'dynamic') }}
|
||||
{%- else %}
|
||||
# ipc_write_buffer: 'dynamic'
|
||||
{%- endif %}
|
||||
|
||||
|
||||
##### Security settings #####
|
||||
##########################################
|
||||
@ -304,7 +361,7 @@ event_return_blacklist:
|
||||
# public keys from the minions. Note that this is insecure.
|
||||
{{ get_config('auto_accept', 'False') }}
|
||||
|
||||
# Time in minutes that a incoming public key with a matching name found in
|
||||
# Time in minutes that an incoming public key with a matching name found in
|
||||
# pki_dir/minion_autosign/keyid is automatically accepted. Expired autosign keys
|
||||
# are removed when the master checks the minion_autosign directory.
|
||||
# 0 equals no timeout
|
||||
@ -371,6 +428,7 @@ publisher_acl:
|
||||
# larry:
|
||||
# - test.ping
|
||||
# - network.*
|
||||
#
|
||||
{%- endif %}
|
||||
|
||||
# Blacklist any of the following users or modules
|
||||
@ -378,6 +436,12 @@ publisher_acl:
|
||||
# This example would blacklist all non sudo users, including root from
|
||||
# running any commands. It would also blacklist any use of the "cmd"
|
||||
# module. This is completely disabled by default.
|
||||
#
|
||||
#
|
||||
# Check the list of configured users in client ACL against users on the
|
||||
# system and throw errors if they do not exist.
|
||||
{{ get_config('client_acl_verify', 'True') }}
|
||||
#
|
||||
{% if 'publisher_acl_blacklist' in cfg_master %}
|
||||
{%- do default_keys.append('publisher_acl_blacklist') %}
|
||||
publisher_acl_blacklist:
|
||||
@ -428,6 +492,10 @@ publisher_acl_blacklist:
|
||||
# modules:
|
||||
# - cmd
|
||||
{% endif %}
|
||||
#
|
||||
# WARNING: client_acl and client_acl_blacklist options are deprecated and will
|
||||
# be removed in the future releases. Use publisher_acl and
|
||||
# publisher_acl_blacklist instead.
|
||||
|
||||
# Enforce publisher_acl & publisher_acl_blacklist when users have sudo
|
||||
# access to the salt command.
|
||||
@ -455,6 +523,18 @@ external_auth:
|
||||
|
||||
# Time (in seconds) for a newly generated token to live. Default: 12 hours
|
||||
{{ get_config('token_expire', '43200') }}
|
||||
#
|
||||
# Allow eauth users to specify the expiry time of the tokens they generate.
|
||||
# A boolean applies to all users or a dictionary of whitelisted eauth backends
|
||||
# and usernames may be given.
|
||||
# token_expire_user_override:
|
||||
# pam:
|
||||
# - fred
|
||||
# - tom
|
||||
# ldap:
|
||||
# - gary
|
||||
#
|
||||
#token_expire_user_override: False
|
||||
|
||||
# Allow minions to push files to the master. This is disabled by default, for
|
||||
# security purposes.
|
||||
@ -479,6 +559,15 @@ external_auth:
|
||||
# will cause minion to throw an exception and drop the message.
|
||||
{{ get_config('sign_pub_message', 'False') }}
|
||||
|
||||
# Use TLS/SSL encrypted connection between master and minion.
|
||||
# Can be set to a dictionary containing keyword arguments corresponding to Python's
|
||||
# 'ssl.wrap_socket' method.
|
||||
# Default is None.
|
||||
#ssl:
|
||||
# keyfile: <path_to_keyfile>
|
||||
# certfile: <path_to_certfile>
|
||||
# ssl_version: PROTOCOL_TLSv1_2
|
||||
|
||||
# Sign the master auth-replies with a cryptographic signature of the masters public key.
|
||||
# Please see the tutorial how to use these settings in the Multimaster-PKI with Failover Tutorial
|
||||
{{ get_config('master_sign_pubkey', 'False') }}
|
||||
@ -570,6 +659,27 @@ external_auth:
|
||||
# Pass in an alternative location for the salt-ssh roster file
|
||||
{{ get_config('roster_file', '/etc/salt/roster') }}
|
||||
|
||||
# Define locations for roster files so they can be chosen when using Salt API.
|
||||
# An administrator can place roster files into these locations. Then when
|
||||
# calling Salt API, parameter 'roster_file' should contain a relative path to
|
||||
# these locations. That is, "roster_file=/foo/roster" will be resolved as
|
||||
# "/etc/salt/roster.d/foo/roster" etc. This feature prevents passing insecure
|
||||
# custom rosters through the Salt API.
|
||||
#
|
||||
{%- if 'rosters' in cfg_master %}
|
||||
rosters:
|
||||
{% for name in cfg_master['rosters'] -%}
|
||||
- {{ name }}
|
||||
{% endfor -%}
|
||||
{%- else %}
|
||||
#rosters:
|
||||
# - /etc/salt/roster.d
|
||||
# - /opt/salt/some/more/rosters
|
||||
{%- endif %}
|
||||
|
||||
# The log file of the salt-ssh command:
|
||||
{{ get_config('ssh_log_file', '/var/log/salt/ssh') }}
|
||||
|
||||
# Pass in minion option overrides that will be inserted into the SHIM for
|
||||
# salt-ssh calls. The local minion config is not used for salt-ssh. Can be
|
||||
# overridden on a per-minion basis in the roster (`minion_opts`)
|
||||
@ -577,6 +687,10 @@ external_auth:
|
||||
# gpg_keydir: /root/gpg
|
||||
{{ get_config('ssh_minion_opts', '{}') }}
|
||||
|
||||
# Set this to True to default to using ~/.ssh/id_rsa for salt-ssh
|
||||
# authentication with minions
|
||||
{{ get_config('ssh_use_home_key', 'False') }}
|
||||
|
||||
##### Master Module Management #####
|
||||
##########################################
|
||||
# Manage how master side modules are loaded.
|
||||
@ -636,7 +750,7 @@ master_tops:
|
||||
# (block, not variable tag!). Defaults to False, corresponds to the Jinja
|
||||
# environment init variable "trim_blocks".
|
||||
{{ get_config('jinja_trim_blocks', 'False') }}
|
||||
|
||||
#
|
||||
# If this is set to True leading spaces and tabs are stripped from the start
|
||||
# of a line to a block. Defaults to False, corresponds to the Jinja
|
||||
# environment init variable "lstrip_blocks".
|
||||
@ -709,6 +823,7 @@ master_tops:
|
||||
#file_roots:
|
||||
# base:
|
||||
# - /srv/salt
|
||||
#
|
||||
{%- endif %}
|
||||
|
||||
# When using multiple environments, each with their own top file, the
|
||||
@ -728,9 +843,12 @@ master_tops:
|
||||
{{ get_config('default_top', 'base') }}
|
||||
|
||||
# The hash_type is the hash to use when discovering the hash of a file on
|
||||
# the master server. The default is md5, but sha1, sha224, sha256, sha384
|
||||
# the master server. The default is md5 but sha1, sha224, sha256, sha384
|
||||
# and sha512 are also supported.
|
||||
#
|
||||
# WARNING: While md5 and sha1 are also supported, do not use it due to the high chance
|
||||
# of possible collisions and thus security breach.
|
||||
#
|
||||
# Prior to changing this value, the master should be stopped and all Salt
|
||||
# caches should be cleared.
|
||||
{{ get_config('hash_type', 'md5') }}
|
||||
@ -870,7 +988,7 @@ fileserver_backend:
|
||||
# and the first repo to have the file will return it.
|
||||
# When using the git backend branches and tags are translated into salt
|
||||
# environments.
|
||||
# Note: file:// repos will be treated as a remote, so refs you want used must
|
||||
# Note: file:// repos will be treated as a remote, so refs you want used must
|
||||
# exist in that repo as *local* refs.
|
||||
{% if 'gitfs_remotes' in cfg_master -%}
|
||||
{%- do default_keys.append('gitfs_remotes') %}
|
||||
@ -1006,6 +1124,7 @@ pillar_roots:
|
||||
#pillar_roots:
|
||||
# base:
|
||||
# - /srv/pillar
|
||||
#
|
||||
{%- endif %}
|
||||
|
||||
{% if 'ext_pillar' in cfg_master %}
|
||||
@ -1048,6 +1167,18 @@ ext_pillar:
|
||||
# ext_pillar.
|
||||
{{ get_config('ext_pillar_first', 'False') }}
|
||||
|
||||
# The external pillars permitted to be used on-demand using pillar.ext
|
||||
{%- if 'on_demand_ext_pillar' in cfg_master %}
|
||||
on_demand_ext_pillar:
|
||||
{% for name in cfg_master['on_demand_ext_pillar'] -%}
|
||||
- {{ name }}
|
||||
{% endfor -%}
|
||||
{%- else %}
|
||||
#on_demand_ext_pillar:
|
||||
# - libvirt
|
||||
# - virtkey
|
||||
{%- endif %}
|
||||
|
||||
# The pillar_gitfs_ssl_verify option specifies whether to ignore ssl certificate
|
||||
# errors when contacting the pillar gitfs backend. You might want to set this to
|
||||
# false if you're using a git backend that uses a self-signed certificate but
|
||||
@ -1068,16 +1199,21 @@ ext_pillar:
|
||||
{{ get_config('pillar_safe_render_error', 'True') }}
|
||||
|
||||
# The pillar_source_merging_strategy option allows you to configure merging strategy
|
||||
# between different sources. It accepts four values: recurse, aggregate, overwrite,
|
||||
# or smart. Recurse will merge recursively mapping of data. Aggregate instructs
|
||||
# aggregation of elements between sources that use the #!yamlex renderer. Overwrite
|
||||
# will verwrite elements according the order in which they are processed. This is
|
||||
# between different sources. It accepts five values: none, recurse, aggregate, overwrite,
|
||||
# or smart. None will not do any merging at all. Recurse will merge recursively mapping of data.
|
||||
# Aggregate instructs aggregation of elements between sources that use the #!yamlex renderer. Overwrite
|
||||
# will overwrite elements according the order in which they are processed. This is
|
||||
# behavior of the 2014.1 branch and earlier. Smart guesses the best strategy based
|
||||
# on the "renderer" setting and is the default value.
|
||||
{{ get_config('pillar_source_merging_strategy', 'smart') }}
|
||||
|
||||
# Recursively merge lists by aggregating them instead of replacing them.
|
||||
{{ get_config('pillar_merge_lists', False) }}
|
||||
{{ get_config('pillar_merge_lists', 'False') }}
|
||||
|
||||
# Set this option to 'True' to force a 'KeyError' to be raised whenever an
|
||||
# attempt to retrieve a named value from pillar fails. When this option is set
|
||||
# to 'False', the failed attempt returns an empty string. Default is 'False'.
|
||||
{{ get_config('pillar_raise_on_missing', 'False') }}
|
||||
|
||||
# Git External Pillar (git_pillar) Configuration Options
|
||||
#
|
||||
@ -1139,6 +1275,43 @@ ext_pillar:
|
||||
# to authenticate is protected by a passphrase.
|
||||
{{ get_config('git_pillar_passphrase', '') }}
|
||||
|
||||
# A master can cache pillars locally to bypass the expense of having to render them
|
||||
# for each minion on every request. This feature should only be enabled in cases
|
||||
# where pillar rendering time is known to be unsatisfactory and any attendant security
|
||||
# concerns about storing pillars in a master cache have been addressed.
|
||||
#
|
||||
# When enabling this feature, be certain to read through the additional ``pillar_cache_*``
|
||||
# configuration options to fully understand the tunable parameters and their implications.
|
||||
#
|
||||
# Note: setting ``pillar_cache: True`` has no effect on targeting Minions with Pillars.
|
||||
# See https://docs.saltstack.com/en/latest/topics/targeting/pillar.html
|
||||
{{ get_config('pillar_cache', 'False') }}
|
||||
|
||||
# If and only if a master has set ``pillar_cache: True``, the cache TTL controls the amount
|
||||
# of time, in seconds, before the cache is considered invalid by a master and a fresh
|
||||
# pillar is recompiled and stored.
|
||||
{{ get_config('pillar_cache_ttl', '3600') }}
|
||||
|
||||
# If and only if a master has set `pillar_cache: True`, one of several storage providers
|
||||
# can be utililzed.
|
||||
#
|
||||
# `disk`: The default storage backend. This caches rendered pillars to the master cache.
|
||||
# Rendered pillars are serialized and deserialized as msgpack structures for speed.
|
||||
# Note that pillars are stored UNENCRYPTED. Ensure that the master cache
|
||||
# has permissions set appropriately. (Same defaults are provided.)
|
||||
#
|
||||
# memory: [EXPERIMENTAL] An optional backend for pillar caches which uses a pure-Python
|
||||
# in-memory data structure for maximal performance. There are several caveats,
|
||||
# however. First, because each master worker contains its own in-memory cache,
|
||||
# there is no guarantee of cache consistency between minion requests. This
|
||||
# works best in situations where the pillar rarely if ever changes. Secondly,
|
||||
# and perhaps more importantly, this means that unencrypted pillars will
|
||||
# be accessible to any process which can examine the memory of the ``salt-master``!
|
||||
# This may represent a substantial security risk.
|
||||
#
|
||||
{{ get_config('pillar_cache_backend', 'disk') }}
|
||||
|
||||
|
||||
##### Syndic settings #####
|
||||
##########################################
|
||||
# The Salt syndic is used to pass commands through a master from a higher
|
||||
@ -1155,7 +1328,7 @@ ext_pillar:
|
||||
|
||||
# If this master will be running a salt syndic daemon, syndic_master tells
|
||||
# this master where to receive commands from.
|
||||
{{ get_config('syndic_master', 'masterofmaster') }}
|
||||
{{ get_config('syndic_master', 'masterofmasters') }}
|
||||
|
||||
# This is the 'ret_port' of the MasterOfMaster:
|
||||
{{ get_config('syndic_master_port', '4506') }}
|
||||
@ -1164,11 +1337,22 @@ ext_pillar:
|
||||
{{ get_config('syndic_pidfile', '/var/run/salt-syndic.pid') }}
|
||||
|
||||
# LOG file of the syndic daemon:
|
||||
{{ get_config('syndic_log_file', 'syndic.log') }}
|
||||
{{ get_config('syndic_log_file', '/var/log/salt/syndic') }}
|
||||
|
||||
# The user under which the salt syndic will run.
|
||||
{{ get_config('syndic_user', 'root') }}
|
||||
|
||||
# The behaviour of the multi-syndic when connection to a master of masters failed.
|
||||
# Can specify ``random`` (default) or ``ordered``. If set to ``random``, masters
|
||||
# will be iterated in random order. If ``ordered`` is specified, the configured
|
||||
# order will be used.
|
||||
{{ get_config('syndic_failover', 'random') }}
|
||||
|
||||
# The number of seconds for the salt client to wait for additional syndics to
|
||||
# check in with their lists of expected minions before giving up.
|
||||
{{ get_config('syndic_wait', '5') }}
|
||||
|
||||
|
||||
##### Peer Publish settings #####
|
||||
##########################################
|
||||
# Salt minions can send commands to other minions, but only if the minion is
|
||||
@ -1358,11 +1542,18 @@ log_granular_levels:
|
||||
|
||||
##### Node Groups ######
|
||||
##########################################
|
||||
# Node groups allow for logical groupings of minion nodes. A group consists of a group
|
||||
# name and a compound target.
|
||||
# Node groups allow for logical groupings of minion nodes. A group consists of
|
||||
# a group name and a compound target. Nodgroups can reference other nodegroups
|
||||
# with 'N@' classifier. Ensure that you do not have circular references.
|
||||
#
|
||||
#nodegroups:
|
||||
# group1: 'L@foo.domain.com,bar.domain.com,baz.domain.com and bl*.domain.com'
|
||||
# group1: 'L@foo.domain.com,bar.domain.com,baz.domain.com or bl*.domain.com'
|
||||
# group2: 'G@os:Debian and foo.domain.com'
|
||||
# group3: 'G@os:Debian and N@group1'
|
||||
# group4:
|
||||
# - 'G@foo:bar'
|
||||
# - 'or'
|
||||
# - 'G@foo:baz'
|
||||
{%- if 'nodegroups' in cfg_master %}
|
||||
{%- do default_keys.append('nodegroups') %}
|
||||
nodegroups:
|
||||
@ -1473,11 +1664,24 @@ win_gitrepos:
|
||||
{{ get_config('return', '')}}
|
||||
|
||||
|
||||
###### Miscellaneous settings ######
|
||||
###### Miscellaneous settings ######
|
||||
############################################
|
||||
# Default match type for filtering events tags: startswith, endswith, find, regex, fnmatch
|
||||
{{ get_config('event_match_type', 'startswith') }}
|
||||
|
||||
# Save runner returns to the job cache
|
||||
{{ get_config('runner_returns', 'True') }}
|
||||
|
||||
# Permanently include any available Python 3rd party modules into Salt Thin
|
||||
# when they are generated for Salt-SSH or other purposes.
|
||||
# The modules should be named by the names they are actually imported inside the Python.
|
||||
# The value of the parameters can be either one module or a comma separated list of them.
|
||||
{%- if 'thin_extra_mods' in cfg_master %}
|
||||
{{ get_config('thin_extra_mods', '') }}
|
||||
{%- else %}
|
||||
#thin_extra_mods: foo,bar
|
||||
{%- endif %}
|
||||
|
||||
{%- if 'halite' in cfg_master %}
|
||||
{%- do default_keys.append('halite') %}
|
||||
##### Halite #####
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
# This file managed by Salt, do not edit by hand!!
|
||||
# Based on salt version 2015.8.7 default config
|
||||
# Based on salt version 2016.11 default config
|
||||
#
|
||||
{% set reserved_keys = ['master', 'minion', 'cloud', 'salt_cloud_certs', 'engines', 'beacons'] -%}
|
||||
{% set cfg_salt = pillar.get('salt', {}) -%}
|
||||
@ -84,6 +84,8 @@ proxy_password: {{ cfg_minion['proxy_password'] }}
|
||||
# value to "str". Failover masters can be requested by setting
|
||||
# to "failover". MAKE SURE TO SET master_alive_interval if you are
|
||||
# using failover.
|
||||
# Setting master_type to 'disable' let's you have a running minion (with engines and
|
||||
# beacons) without a master connection
|
||||
{{ get_config('master_type', 'str') }}
|
||||
|
||||
# verify_master_pubkey_sign
|
||||
@ -95,6 +97,16 @@ proxy_password: {{ cfg_minion['proxy_password'] }}
|
||||
# of TCP connections, such as load balancers.)
|
||||
{{ get_config('master_alive_interval', '30') }}
|
||||
|
||||
# If the minion is in multi-master mode and the master_type configuration option
|
||||
# is set to "failover", this setting can be set to "True" to force the minion
|
||||
# to fail back to the first master in the list if the first master is back online.
|
||||
{{ get_config('master_fallback', 'False') }}
|
||||
|
||||
# If the minion is in multi-master mode, the "master_type" configuration is set to
|
||||
# "failover", and the "master_failback" option is enabled, the master failback
|
||||
# interval can be set to ping the top master with this interval, in seconds.
|
||||
{{ get_config('master_fallback_interval', '0') }}
|
||||
|
||||
# Set whether the minion should connect to the master via IPv6:
|
||||
{{ get_config('ipv6', 'False') }}
|
||||
|
||||
@ -109,10 +121,14 @@ proxy_password: {{ cfg_minion['proxy_password'] }}
|
||||
# The user to run salt.
|
||||
{{ get_config('user', 'root') }}
|
||||
|
||||
# Setting sudo_user will cause salt to run all execution modules under an sudo
|
||||
# to the user given in sudo_user. The user under which the salt minion process
|
||||
# itself runs will still be that provided in the user config above, but all
|
||||
# execution modules run by the minion will be rerouted through sudo.
|
||||
# The user to run salt remote execution commands as via sudo. If this option is
|
||||
# enabled then sudo will be used to change the active user executing the remote
|
||||
# command. If enabled the user will need to be allowed access via the sudoers
|
||||
# file for the user that the salt minion is configured to run as. The most
|
||||
# common option would be to use the root user. If this option is set the user
|
||||
# option should also be set to a non-root user. If migrating from a root minion
|
||||
# to a non root minion the minion cache should be cleared and the minion pki
|
||||
# directory will need to be changed to the ownership of the new user.
|
||||
{{ get_config('sudo_user', 'saltdev') }}
|
||||
|
||||
# Specify the location of the daemon process ID file.
|
||||
@ -122,6 +138,9 @@ proxy_password: {{ cfg_minion['proxy_password'] }}
|
||||
# sock_dir, pidfile.
|
||||
{{ get_config('root_dir', '/') }}
|
||||
|
||||
# The path to the minion's configuration file.
|
||||
{{ get_config('conf_file', '/etc/salt/minion') }}
|
||||
|
||||
# The directory to store the pki information in
|
||||
{{ get_config('pki_dir', '/etc/salt/pki/minion') }}
|
||||
|
||||
@ -137,6 +156,13 @@ id: {{ cfg_minion['id'] }}
|
||||
#id:
|
||||
{%- endif %}
|
||||
|
||||
# Cache the minion id to a file when the minion's id is not statically defined
|
||||
# in the minion config. Defaults to "True". This setting prevents potential
|
||||
# problems when automatic minion id resolution changes, which can cause the
|
||||
# minion to lose connection with the master. To turn off minion id caching,
|
||||
# set this config to ``False``.
|
||||
{{ get_config('minion_id_caching', 'True') }}
|
||||
|
||||
# Append a domain to a hostname in the event that it does not exist. This is
|
||||
# useful for systems where socket.getfqdn() does not actually result in a
|
||||
# FQDN (for instance, Solaris).
|
||||
@ -158,6 +184,20 @@ id: {{ cfg_minion['id'] }}
|
||||
# This data may contain sensitive data and should be protected accordingly.
|
||||
{{ get_config('cachedir', '/var/cache/salt/minion') }}
|
||||
|
||||
# Append minion_id to these directories. Helps with
|
||||
# multiple proxies and minions running on the same machine.
|
||||
# Allowed elements in the list: pki_dir, cachedir, extension_modules
|
||||
# Normally not needed unless running several proxies and/or minions on the same machine
|
||||
# Defaults to ['cachedir'] for proxies, [] (empty list) for regular minions
|
||||
{% if 'append_minionid_config_dirs' in cfg_minion -%}
|
||||
append_minionid_config_dirs:
|
||||
{% for dir in cfg_minion['append_minionid_config_dirs'] -%}
|
||||
- {{ dir }}
|
||||
{% endfor -%}
|
||||
{%- else %}
|
||||
#append_minionid_config_dirs:
|
||||
{%- endif %}
|
||||
|
||||
# Verify and set permissions on configuration directories at startup.
|
||||
{{ get_config('verify_env', 'True') }}
|
||||
|
||||
@ -226,6 +266,20 @@ id: {{ cfg_minion['id'] }}
|
||||
# authenticate.
|
||||
{{ get_config('auth_tries', '7') }}
|
||||
|
||||
# The number of attempts to connect to a master before giving up.
|
||||
# Set this to -1 for unlimited attempts. This allows for a master to have
|
||||
# downtime and the minion to reconnect to it later when it comes back up.
|
||||
# In 'failover' mode, it is the number of attempts for each set of masters.
|
||||
# In this mode, it will cycle through the list of masters for each attempt.
|
||||
#
|
||||
# This is different than auth_tries because auth_tries attempts to
|
||||
# retry auth attempts with a single master. auth_tries is under the
|
||||
# assumption that you can connect to the master but not gain
|
||||
# authorization from it. master_tries will still cycle through all
|
||||
# the masters in a given try, so it is appropriate if you expect
|
||||
# occasional downtime from the master(s).
|
||||
{{ get_config('master_tries', '1') }}
|
||||
|
||||
# If authentication fails due to SaltReqTimeoutError during a ping_interval,
|
||||
# cause sub minion process to restart.
|
||||
{{ get_config('auth_safemode', 'False') }}
|
||||
@ -312,10 +366,23 @@ mine_functions:
|
||||
{{ get_config('recon_randomize', 'False') }}
|
||||
|
||||
# The loop_interval sets how long in seconds the minion will wait between
|
||||
# evaluating the scheduler and running cleanup tasks. This defaults to a
|
||||
# sane 60 seconds, but if the minion scheduler needs to be evaluated more
|
||||
# often lower this value
|
||||
{{ get_config('loop_interval', '60') }}
|
||||
# evaluating the scheduler and running cleanup tasks. This defaults to 1
|
||||
# second on the minion scheduler.
|
||||
{{ get_config('loop_interval', '1') }}
|
||||
|
||||
# Some installations choose to start all job returns in a cache or a returner
|
||||
# and forgo sending the results back to a master. In this workflow, jobs
|
||||
# are most often executed with --async from the Salt CLI and then results
|
||||
# are evaluated by examining job caches on the minions or any configured returners.
|
||||
# WARNING: Setting this to False will **disable** returns back to the master.
|
||||
{{ get_config('pub_ret', 'True') }}
|
||||
|
||||
|
||||
# The grains can be merged, instead of overridden, using this option.
|
||||
# This allows custom grains to defined different subvalues of a dictionary
|
||||
# grain. By default this feature is disabled, to enable set grains_deep_merge
|
||||
# to ``True``.
|
||||
{{ get_config('grains_deep_merge', 'False') }}
|
||||
|
||||
# The grains_refresh_every setting allows for a minion to periodically check
|
||||
# its grains to see if they have changed and, if so, to inform the master
|
||||
@ -332,12 +399,37 @@ mine_functions:
|
||||
# Cache grains on the minion. Default is False.
|
||||
{{ get_config('grains_cache', 'False') }}
|
||||
|
||||
# Cache rendered pillar data on the minion. Default is False.
|
||||
# This may cause 'cachedir'/pillar to contain sensitive data that should be
|
||||
# protected accordingly.
|
||||
{{ get_config('minion_pillar_cache', 'False') }}
|
||||
|
||||
# Grains cache expiration, in seconds. If the cache file is older than this
|
||||
# number of seconds then the grains cache will be dumped and fully re-populated
|
||||
# with fresh data. Defaults to 5 minutes. Will have no effect if 'grains_cache'
|
||||
# is not enabled.
|
||||
{{ get_config('grains_cache_expiration', '300') }}
|
||||
|
||||
# Determines whether or not the salt minion should run scheduled mine updates.
|
||||
# Defaults to "True". Set to "False" to disable the scheduled mine updates
|
||||
# (this essentially just does not add the mine update function to the minion's
|
||||
# scheduler).
|
||||
{{ get_config('mine_enabled', 'True') }}
|
||||
|
||||
# Determines whether or not scheduled mine updates should be accompanied by a job
|
||||
# return for the job cache. Defaults to "False". Set to "True" to include job
|
||||
# returns in the job cache for mine updates.
|
||||
{{ get_config('mine_return_job', 'False') }}
|
||||
|
||||
# Example functions that can be run via the mine facility
|
||||
# NO mine functions are established by default.
|
||||
# Note these can be defined in the minion's pillar as well.
|
||||
#mine_functions:
|
||||
# test.ping: []
|
||||
# network.ip_addrs:
|
||||
# interface: eth0
|
||||
# cidr: '10.0.0.0/8'
|
||||
|
||||
# Windows platforms lack posix IPC and must rely on slower TCP based inter-
|
||||
# process communications. Set ipc_mode to 'tcp' on such systems
|
||||
{{ get_config('ipc_mode', 'ipc') }}
|
||||
@ -386,13 +478,34 @@ mine_functions:
|
||||
{%- endif -%}
|
||||
{% endif %}
|
||||
|
||||
# The syndic minion can verify that it is talking to the correct master via the
|
||||
# key fingerprint of the higher-level master with the "syndic_finger" config.
|
||||
{{ get_config('syndic_finger', '') }}
|
||||
|
||||
|
||||
##### Minion module management #####
|
||||
##########################################
|
||||
# Disable specific modules. This allows the admin to limit the level of
|
||||
# access the master has to the minion.
|
||||
{{ get_config('disable_modules', '[cmd,test]') }}
|
||||
# access the master has to the minion. The default here is the empty list,
|
||||
# below is an example of how this needs to be formatted in the config file
|
||||
#disable_modules:
|
||||
# - cmdmod
|
||||
# - test
|
||||
#disable_returners: []
|
||||
{{ get_config('disable_modules', '[]') }}
|
||||
{{ get_config('disable_returners', '[]') }}
|
||||
|
||||
# This is the reverse of disable_modules. The default, like disable_modules, is the empty list,
|
||||
# but if this option is set to *anything* then *only* those modules will load.
|
||||
# Note that this is a very large hammer and it can be quite difficult to keep the minion working
|
||||
# the way you think it should since Salt uses many modules internally itself. At a bare minimum
|
||||
# you need the following enabled or else the minion won't start.
|
||||
#whitelist_modules:
|
||||
# - cmdmod
|
||||
# - test
|
||||
# - config
|
||||
{{ get_config('whitelist_modules', '[]') }}
|
||||
|
||||
# Modules can be loaded from arbitrary paths. This enables the easy deployment
|
||||
# of third party modules. Modules for returners and minions can be loaded.
|
||||
# Specify a list of extra directories to search for minion modules and
|
||||
@ -452,7 +565,16 @@ mine_functions:
|
||||
# by statically setting it. Remember that the recommended way to manage
|
||||
# environments is to isolate via the top file.
|
||||
{{ get_config('environment', 'None') }}
|
||||
|
||||
#
|
||||
# Isolates the pillar environment on the minion side. This functions the same
|
||||
# as the environment setting, but for pillar instead of states.
|
||||
{{ get_config('pillarenv', 'None') }}
|
||||
#
|
||||
# Set this option to 'True' to force a 'KeyError' to be raised whenever an
|
||||
# attempt to retrieve a named value from pillar fails. When this option is set
|
||||
# to 'False', the failed attempt returns an empty string. Default is 'False'.
|
||||
{{ get_config('pillar_raise_on_missing', 'False') }}
|
||||
#
|
||||
# If using the local file directory, then the state top file name needs to be
|
||||
# defined, by default this is top.sls.
|
||||
{{ get_config('state_top', 'top.sls') }}
|
||||
@ -526,17 +648,17 @@ file_client: local
|
||||
# - /srv/salt
|
||||
{%- endif %}
|
||||
|
||||
|
||||
# File Server Backend
|
||||
# Uncomment the line below if you do not want the file_server to follow
|
||||
# symlinks when walking the filesystem tree. This is set to True
|
||||
# by default. Currently this only applies to the default roots
|
||||
# fileserver_backend.
|
||||
{{ get_config('fileserver_followsymlinks', 'True') }}
|
||||
#
|
||||
# Salt supports a modular fileserver backend system, this system allows
|
||||
# the salt minion to link directly to third party systems to gather and
|
||||
# manage the files available to minions. Multiple backends can be
|
||||
# configured and will be searched for the requested file in the order in which
|
||||
# they are defined here. The default setting only enables the standard backend
|
||||
# "roots" which uses the "file_roots" option.
|
||||
#fileserver_backend:
|
||||
# - roots
|
||||
# Uncomment the line below if you do not want symlinks to be
|
||||
# treated as the files they are pointing to. By default this is set to
|
||||
# False. By uncommenting the line below, any detected symlink while listing
|
||||
# files on the Master will not be returned to the Minion.
|
||||
{{ get_config('fileserver_ignoresymlinks', 'False') }}
|
||||
#
|
||||
# To use multiple backends list them in the order they are searched:
|
||||
#fileserver_backend:
|
||||
@ -558,10 +680,13 @@ fileserver_backend:
|
||||
# is False.
|
||||
{{ get_config('fileserver_limit_traversal', 'False') }}
|
||||
|
||||
# The hash_type is the hash to use when discovering the hash of a file in
|
||||
# The hash_type is the hash to use when discovering the hash of a file on
|
||||
# the local fileserver. The default is md5, but sha1, sha224, sha256, sha384
|
||||
# and sha512 are also supported.
|
||||
#
|
||||
# WARNING: While md5 and sha1 are also supported, do not use it due to the high chance
|
||||
# of possible collisions and thus security breach.
|
||||
#
|
||||
# Warning: Prior to changing this value, the minion should be stopped and all
|
||||
# Salt caches should be cleared.
|
||||
{{ get_config('hash_type', 'md5') }}
|
||||
@ -687,6 +812,10 @@ pillar_roots:
|
||||
# - /srv/pillar
|
||||
{%- endif %}
|
||||
|
||||
# Set a hard-limit on the size of the files that can be pushed to the master.
|
||||
# It will be interpreted as megabytes. Default: 100
|
||||
{{ get_config('file_recv_max_size', '100') }}
|
||||
|
||||
{% if 'ext_pillar' in cfg_minion %}
|
||||
{%- do default_keys.append('ext_pillar') %}
|
||||
ext_pillar:
|
||||
@ -858,11 +987,24 @@ ext_pillar:
|
||||
# "salt-key -F master" on the Salt master.
|
||||
{{ get_config('master_finger', "''") }}
|
||||
|
||||
# Use TLS/SSL encrypted connection between master and minion.
|
||||
# Can be set to a dictionary containing keyword arguments corresponding to Python's
|
||||
# 'ssl.wrap_socket' method.
|
||||
# Default is None.
|
||||
#ssl:
|
||||
# keyfile: <path_to_keyfile>
|
||||
# certfile: <path_to_certfile>
|
||||
# ssl_version: PROTOCOL_TLSv1_2
|
||||
|
||||
|
||||
###### Thread settings #####
|
||||
###########################################
|
||||
# Disable multiprocessing support, by default when a minion receives a
|
||||
# publication a new process is spawned and the command is executed therein.
|
||||
#
|
||||
# WARNING: Disabling multiprocessing may result in substantial slowdowns
|
||||
# when processing large pillars. See https://github.com/saltstack/salt/issues/38758
|
||||
# for a full explanation.
|
||||
{{ get_config('multiprocessing', 'True') }}
|
||||
|
||||
|
||||
@ -1024,8 +1166,24 @@ ext_pillar:
|
||||
|
||||
###### Returner settings ######
|
||||
############################################
|
||||
# Which returner(s) will be used for minion's result:
|
||||
# Default Minion returners. Can be a comma delimited string or a list:
|
||||
#
|
||||
#return: mysql
|
||||
#
|
||||
#return: mysql,slack,redis
|
||||
#
|
||||
#return:
|
||||
# - mysql
|
||||
# - hipchat
|
||||
# - slack
|
||||
{%- if 'return' in cfg_minion and cfg_minion['return'] is not string %}
|
||||
return:
|
||||
{% for name in cfg_minion['return'] -%}
|
||||
- {{ name }}
|
||||
{% endfor -%}
|
||||
{%- else %}
|
||||
{{ get_config('return', '') }}
|
||||
{%- endif %}
|
||||
|
||||
###### Miscellaneous settings ######
|
||||
############################################
|
||||
|
||||
Loading…
Reference in New Issue
Block a user