Operations grimoire/Salt: Difference between revisions

From Nasqueron Agora
(→‎Master: Update fingerprint)
No edit summary
Line 4: Line 4:
=== Master ===
=== Master ===
<pre>
<pre>
master.pub: 67:8b:e6:b2:7b:73:5b:f1:50:f4:48:38:9a:4c:1c:31:e1:b7:6e:eb:9f:47:98:40:1f:53:29:9e:86:bb:83:38
master.pub: 67:8b:e6:b2:7b:73:5b:f1:50:f4:48:38:9a:4c:1c:31:e1:b7:6e:eb:9f:47:98:40:1f:53:29:9e:86:bb:83:38
</pre>
</pre>


Line 19: Line 19:
;Possible cause and solutions
;Possible cause and solutions
:The master key has expired on the minion: remove it on the minion with <code>rm /etc/salt/pki/minion/minion_master.pub</code>. If you can repro faithfully a scenario with this issue, add more details at https://github.com/saltstack/salt/issues/46923
:The master key has expired on the minion: remove it on the minion with <code>rm /etc/salt/pki/minion/minion_master.pub</code>. If you can repro faithfully a scenario with this issue, add more details at https://github.com/saltstack/salt/issues/46923
== Lessons learned ==
=== UIDs and GIDs should be unique ===
UIDs and GIDs are created autoincrementally by the OSes, so it's very easy to have two different usernames using the same uid on two machines. To avoid that, every user.present and group.present Salt state should specify the uid explictly. To avoid to reuse one, document it in {{Ops file|UIDs}} and {{Ops file|GIDs}}.

Revision as of 19:04, 11 June 2024

Salt is used for deployment. Configuration can be found in the rOPS repository.

Keys

Master

master.pub: 67:8b:e6:b2:7b:73:5b:f1:50:f4:48:38:9a:4c:1c:31:e1:b7:6e:eb:9f:47:98:40:1f:53:29:9e:86:bb:83:38

This fingerprint should be used by minions in the `master_finger` value in configuration file.

It can be updated running salt-call --local key.finger from Complector.

Troubleshoot

Request timeout

Symptoms on master
The minion doesn't reply with job result
Symptoms on minion
When running through salt-call, output shows SaltReqTimeoutError, retrying. (1/7).
Possible cause and solutions
The master key has expired on the minion: remove it on the minion with rm /etc/salt/pki/minion/minion_master.pub. If you can repro faithfully a scenario with this issue, add more details at https://github.com/saltstack/salt/issues/46923

Lessons learned

UIDs and GIDs should be unique

UIDs and GIDs are created autoincrementally by the OSes, so it's very easy to have two different usernames using the same uid on two machines. To avoid that, every user.present and group.present Salt state should specify the uid explictly. To avoid to reuse one, document it in rOPS: UIDs and rOPS: GIDs.