0

This is salt 101 I think, but I'm really a salt N00b and need assistance.

I need to disable specific services on all of our servers by default, but I need to create a pillar that allows me to override this, and allow the specific servers mentioned in pillar to have those services running. For the sake of discussion, let's assume the service is httpd.

Currently I have a VERY simple state named "disable_httpd.sls" that says this...

{% from "security/map.jinja" import security with context %}
stop and disable httpd-server:
  service.dead:
    - name: httpd
    - enable: False

Now we do have a few web servers where we need to allow it, and obviously my state, which is called as part of our security items, will break those servers.

I need to figure out how to write a pillar that will exempt specific servers.

Thoughts?


Update: Here's what I have tried so far, but it's not working.

Note that this is being tried in a lab, and the system I'm playing with is named "saltminion1.local".

  1. Changed the state (disable_httpd.sls) to say this...
{% from "security/map.jinja" import security with context %}

{% set allow_httpd = salt['pillar.get']('security:options:allow_httpd', "") %}
{% if "True" in allow_httpd and allow_httpd is string %}
Make sure httpd service is running:
  service.enabled:
    - name: httpd

{% else %}

stop and disable httpd:
  service.dead:
    - name: httpd
    - enable: False

{% endif %}

Then in pillar I created a file named "saltminion1.sls" in the "security" directory.

security:
  options:
    allow_httpd: 'True'

I modified pillar/top.sls to add this section...

prod:
  'saltminion1.local':
    - match: nodegroup
    - security.saltminion1

The thought is that it should pick up the "True" in the saltminion1.sls pillar file, and allow httpd. What it's actually doing is the "else" section of the state, and killing the service.

1

It looks like you are on the right approach here, the issue seems to be one of debugging. I have found this jinja2 live templating engine to be helpful with debugging in the past.

In python (on which jinja is based) "True" is a keyword which is probably getting interpreted as a boolean data type. This would be in contrast to the string, integer, or floating point (decimal) data types which are a C/C++ concept that python inherits since it's interpreter is written in C. Python tries to be agnostic to data type and variables are not strongly typed. This appears to be a situation in which the lack of strong typing may be getting you into some hot water.

In your boolean logic in the "if" block says to only render the section if allow_httpd is a string - but it isn't! It's a boolean! This is likely the error. Instead, you may wish to try simply:

{% if allow_httpd %}
Make sure httpd service is running:
  service.enabled:
    - name: httpd

{% else %}

stop and disable httpd:
  service.dead:
    - name: httpd
    - enable: False

{% endif %}

I'd also recommend you remove your quotes in the pillar data if you use this approach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.