feat: Add support for setting salt-api pass via file
This commit is contained in:
Carlos Álvaro
@@ -4,6 +4,11 @@ This file only reflects the changes that are made in this image.
|
||||
Please refer to the [Salt 3005 Release Notes](https://docs.saltstack.com/en/latest/topics/releases/3005.html)
|
||||
for the list of changes in SaltStack.
|
||||
|
||||
**3005_1**
|
||||
|
||||
- Add support for setting the `salt-api` user's password via docker secrets using the environment
|
||||
variable `SALT_API_USER_PASS_FILE`. Has priority over `SALT_API_USER_PASS`.
|
||||
|
||||
**3005**
|
||||
|
||||
- Upgrade `salt-master` to `3005` *Phosphorus*
|
||||
@@ -111,7 +116,8 @@ Support for the `USERMAP_UID` and `USERMAP_GID` env variables will be removed wi
|
||||
|
||||
- Upgrade `salt-master` to `3002.1` *Magnesium*
|
||||
- Change Docker base image to `ubuntu:focal-20201008`
|
||||
- Fix issue changing _read-only_ directories ownership ([@Kidswiss](https://github.com/Kidswiss) - [#47](https://github.com/cdalvaro/docker-salt-master/pull/47))
|
||||
- Fix issue changing _read-only_ directories ownership
|
||||
([@Kidswiss](https://github.com/Kidswiss) - [#47](https://github.com/cdalvaro/docker-salt-master/pull/47))
|
||||
|
||||
**3002**
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@ ARG VCS_REF
|
||||
|
||||
# https://github.com/saltstack/salt/releases
|
||||
ENV SALT_VERSION="3005"
|
||||
ENV IMAGE_VERSION="${SALT_VERSION}"
|
||||
ENV IMAGE_VERSION="${SALT_VERSION}_1"
|
||||
|
||||
ENV SALT_DOCKER_DIR="/etc/docker-salt" \
|
||||
SALT_ROOT_DIR="/etc/salt" \
|
||||
|
||||
52
README.md
52
README.md
@@ -533,30 +533,31 @@ use docker-compose.
|
||||
Below you can find a list with the available options that can be used to customize your `docker-salt-master`
|
||||
installation.
|
||||
|
||||
| Parameter | Description |
|
||||
|:--------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `DEBUG` | Set this to `True` to enable entrypoint debugging. |
|
||||
| `TIMEZONE` / `TZ` | Set the container timezone. Defaults to `UTC`. Values are expected to be in Canonical format. Example: `Europe/Madrid`. See the list of [acceptable values](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). |
|
||||
| `PUID` | Sets the uid for user `salt` to the specified uid. Default: `1000`. |
|
||||
| `PGID` | Sets the gid for user `salt` to the specified gid. Default: `1000`. |
|
||||
| `SALT_RESTART_MASTER_ON_CONFIG_CHANGE` | Set this to `True` to restart `salt-master` service when configuration files change. Default: `False` |
|
||||
| [`SALT_LOG_LEVEL`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#log-level) | The level of messages to send to the console. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: `warning` |
|
||||
| `SALT_LOG_ROTATE_FREQUENCY` | Logrotate frequency for salt logs. Available options are 'daily', 'weekly', 'monthly', and 'yearly'. Default: `weekly` |
|
||||
| `SALT_LOG_ROTATE_RETENTION` | Keep x files before deleting old log files. Defaults: `52` |
|
||||
| [`SALT_LEVEL_LOGFILE`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#log-level-logfile) | The level of messages to send to the log file. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: `warning` |
|
||||
| [`SALT_API_SERVICE_ENABLED`](https://docs.saltproject.io/en/latest/ref/cli/salt-api.html) | Enable `salt-api` service. Default: `False` |
|
||||
| `SALT_API_USER` | Set username for `salt-api` service. Default: `salt_api` |
|
||||
| `SALT_API_USER_PASS` | `SALT_API_USER` password. Required if `SALT_API_SERVICE_ENBALED` is `True` and `SALT_API_USER` is not empty. _Unset_ by default |
|
||||
| `SALT_API_CERT_CN` | Common name in the request. Default: `localhost` |
|
||||
| [`SALT_MASTER_SIGN_PUBKEY`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-sign-pubkey) | Sign the master auth-replies with a cryptographic signature of the master's public key. Possible values: 'True' or 'False'. Default: `False` |
|
||||
| [`SALT_MASTER_USE_PUBKEY_SIGNATURE`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-use-pubkey-signature) | Instead of computing the signature for each auth-reply, use a pre-calculated signature. This option requires `SALT_MASTER_SIGN_PUBKEY` set to 'True'. Possible values: 'True' or 'False'. Default: `True` |
|
||||
| [`SALT_MASTER_SIGN_KEY_NAME`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-sign-key-name) | The customizable name of the signing-key-pair without suffix. Default: `master_sign` |
|
||||
| [`SALT_MASTER_PUBKEY_SIGNATURE`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-pubkey-signature) | The name of the file in the master's pki-directory that holds the pre-calculated signature of the master's public-key. Default: `master_pubkey_signature` |
|
||||
| `SALT_MASTER_ROOT_USER` | Forces `salt-master` to be runned as `root` instead of `salt`. Default: `False` |
|
||||
| `SALT_GITFS_SSH_PRIVATE_KEY` | The name of the ssh private key for gitfs. Default: `gitfs_ssh` |
|
||||
| `SALT_GITFS_SSH_PUBLIC_KEY` | The name of the ssh public key for gitfs. Default: `gitfs_ssh`.pub` |
|
||||
| [`SALT_REACTOR_WORKER_THREADS`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#reactor-worker-threads) | The number of workers for the runner/wheel in the reactor. Default: `10`. |
|
||||
| [`SALT_WORKER_THREADS`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#worker-threads) | The number of threads to start for receiving commands and replies from minions. Default: `5`. |
|
||||
| Parameter | Description |
|
||||
|:--------------------------------------------------------------------------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `DEBUG` | Set this to `True` to enable entrypoint debugging. |
|
||||
| `TIMEZONE` / `TZ` | Set the container timezone. Defaults to `UTC`. Values are expected to be in Canonical format. Example: `Europe/Madrid`. See the list of [acceptable values](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). |
|
||||
| `PUID` | Sets the uid for user `salt` to the specified uid. Default: `1000`. |
|
||||
| `PGID` | Sets the gid for user `salt` to the specified gid. Default: `1000`. |
|
||||
| `SALT_RESTART_MASTER_ON_CONFIG_CHANGE` | Set this to `True` to restart `salt-master` service when configuration files change. Default: `False` |
|
||||
| [`SALT_LOG_LEVEL`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#log-level) | The level of messages to send to the console. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: `warning` |
|
||||
| `SALT_LOG_ROTATE_FREQUENCY` | Logrotate frequency for salt logs. Available options are 'daily', 'weekly', 'monthly', and 'yearly'. Default: `weekly` |
|
||||
| `SALT_LOG_ROTATE_RETENTION` | Keep x files before deleting old log files. Defaults: `52` |
|
||||
| [`SALT_LEVEL_LOGFILE`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#log-level-logfile) | The level of messages to send to the log file. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: `warning` |
|
||||
| [`SALT_API_SERVICE_ENABLED`](https://docs.saltproject.io/en/latest/ref/cli/salt-api.html) | Enable `salt-api` service. Default: `False` |
|
||||
| `SALT_API_USER` | Set username for `salt-api` service. Default: `salt_api` |
|
||||
| `SALT_API_USER_PASS_FILE` | `SALT_API_USER` password file path. Use this variable to set the path of a file containing the password for the `SALT_API_USER`. Useful to load the password from secrets. Has priority over `SALT_API_USER_PASS`. _Unset_ by default |
|
||||
| `SALT_API_USER_PASS` | `SALT_API_USER` password. Required if `SALT_API_SERVICE_ENBALED` is `True`, `SALT_API_USER` is not empty and `SALT_API_USER_PASS_FILE` is unset. _Unset_ by default |
|
||||
| `SALT_API_CERT_CN` | Common name in the request. Default: `localhost` |
|
||||
| [`SALT_MASTER_SIGN_PUBKEY`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-sign-pubkey) | Sign the master auth-replies with a cryptographic signature of the master's public key. Possible values: 'True' or 'False'. Default: `False` |
|
||||
| [`SALT_MASTER_USE_PUBKEY_SIGNATURE`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-use-pubkey-signature) | Instead of computing the signature for each auth-reply, use a pre-calculated signature. This option requires `SALT_MASTER_SIGN_PUBKEY` set to 'True'. Possible values: 'True' or 'False'. Default: `True` |
|
||||
| [`SALT_MASTER_SIGN_KEY_NAME`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-sign-key-name) | The customizable name of the signing-key-pair without suffix. Default: `master_sign` |
|
||||
| [`SALT_MASTER_PUBKEY_SIGNATURE`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#master-pubkey-signature) | The name of the file in the master's pki-directory that holds the pre-calculated signature of the master's public-key. Default: `master_pubkey_signature` |
|
||||
| `SALT_MASTER_ROOT_USER` | Forces `salt-master` to be runned as `root` instead of `salt`. Default: `False` |
|
||||
| `SALT_GITFS_SSH_PRIVATE_KEY` | The name of the ssh private key for gitfs. Default: `gitfs_ssh` |
|
||||
| `SALT_GITFS_SSH_PUBLIC_KEY` | The name of the ssh public key for gitfs. Default: `gitfs_ssh`.pub` |
|
||||
| [`SALT_REACTOR_WORKER_THREADS`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#reactor-worker-threads) | The number of workers for the runner/wheel in the reactor. Default: `10`. |
|
||||
| [`SALT_WORKER_THREADS`](https://docs.saltproject.io/en/latest/ref/configuration/master.html#worker-threads) | The number of threads to start for receiving commands and replies from minions. Default: `5`. |
|
||||
|
||||
Any parameter not listed in the above table and available in the
|
||||
following [link](https://docs.saltproject.io/en/latest/ref/configuration/examples.html#configuration-examples-master),
|
||||
@@ -619,7 +620,8 @@ Many thanks to:
|
||||
|
||||
* [The SaltProject](https://saltproject.io) team for the excellent [salt](https://github.com/saltstack/salt) project
|
||||
* [JetBrains](https://www.jetbrains.com) for their free [OpenSource](https://jb.gg/OpenSourceSupport) license
|
||||
* [The Contributors](https://github.com/cdalvaro/docker-salt-master/graphs/contributors) for all the smart code and suggestions merged in the project
|
||||
* [The Contributors](https://github.com/cdalvaro/docker-salt-master/graphs/contributors) for all the smart code and
|
||||
suggestions merged in the project
|
||||
* [The Stargazers](https://github.com/cdalvaro/docker-salt-master/stargazers) for showing their support
|
||||
|
||||
<div style="display: flex; align-items: center; justify-content: space-around;">
|
||||
|
||||
@@ -251,12 +251,22 @@ function configure_salt_api()
|
||||
if [[ -n "${SALT_API_USER}" ]]; then
|
||||
|
||||
if [[ ${SALT_API_USER} == "${SALT_USER}" ]]; then
|
||||
log_error "SALT_API_USER cannot be the same as '${SALT_USER}'"
|
||||
log_error "SALT_API_USER cannot be the same as '${SALT_USER}'."
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [[ -n "${SALT_API_USER_PASS_FILE}" ]]; then
|
||||
if [[ ! -f "${SALT_API_USER_PASS_FILE}" ]]; then
|
||||
log_error "SALT_API_USER_PASS_FILE '${SALT_API_USER_PASS_FILE}' does not exist."
|
||||
return 1
|
||||
elif [[ -n "${SALT_API_USER_PASS}" ]]; then
|
||||
log_warn "SALT_API_USER_PASS_FILE and SALT_API_USER_PASS cannot be set at the same time. The first one will be used."
|
||||
fi
|
||||
SALT_API_USER_PASS="$(cat "${SALT_API_USER_PASS_FILE}")"
|
||||
fi
|
||||
|
||||
if [[ -z "${SALT_API_USER_PASS}" ]]; then
|
||||
log_error "SALT_API_USER_PASS env variable must be set to create '${SALT_API_USER}' user"
|
||||
log_error "SALT_API_USER_PASS env variable must be set to create '${SALT_API_USER}' user."
|
||||
return 2
|
||||
fi
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
version: '3'
|
||||
version: '3.9'
|
||||
|
||||
services:
|
||||
master:
|
||||
|
||||
@@ -73,3 +73,40 @@ ok "pepper installed"
|
||||
echo "==> Testing salt-pepper ..."
|
||||
pepper --client runner test.stream || error "pepper test.stream"
|
||||
ok "pepper test.stream"
|
||||
|
||||
# Stop and start with salt-api pass via file
|
||||
echo "==> Stopping previous container ..."
|
||||
cleanup
|
||||
|
||||
echo "==> Starting docker-salt-master (${PLATFORM}) with salt-api config and password via file ..."
|
||||
export SALT_API_USER_PASS_FILE=salt_api_user_pass
|
||||
echo -n "${SALTAPI_PASS}" > "./${SALT_API_USER_PASS_FILE}"
|
||||
start_container_and_wait \
|
||||
--publish 8000:8000 \
|
||||
--env SALT_API_SERVICE_ENABLED=True \
|
||||
--env SALT_API_USER_PASS_FILE="/run/secrets/${SALT_API_USER_PASS_FILE}" \
|
||||
--volume "${SALTAPI_TMP_DIR}/config":/home/salt/data/config:ro \
|
||||
--volume "$(pwd)/${SALT_API_USER_PASS_FILE}":/run/secrets/${SALT_API_USER_PASS_FILE}:ro \
|
||||
|| error "container started"
|
||||
ok "container started"
|
||||
|
||||
# Test salt-api authentication
|
||||
echo "==> Getting salt-api token (pass via file) ..."
|
||||
SALTAPI_TOKEN=$(curl -sSk "${SALTAPI_URL%/}/login" \
|
||||
-H "Accept: application/x-yaml" \
|
||||
-d username="${SALTAPI_USER}" \
|
||||
-d password="${SALTAPI_PASS}" \
|
||||
-d eauth="${SALTAPI_EAUTH}" | grep 'token:' | cut -d' ' -f 4)
|
||||
[ -n "${SALTAPI_TOKEN}" ] || error "salt-api token"
|
||||
ok "salt-api token"
|
||||
|
||||
# Test salt-api command
|
||||
echo "==> Testing curl command (pass via file) ..."
|
||||
curl -sSk "${SALTAPI_URL}" \
|
||||
-H "Accept: application/x-yaml" \
|
||||
-H "X-Auth-Token: ${SALTAPI_TOKEN}" \
|
||||
-d client=runner \
|
||||
-d tgt='*' \
|
||||
-d fun=test.stream \
|
||||
| grep -i true || error "curl command"
|
||||
ok "curl command"
|
||||
|
||||
Reference in New Issue
Block a user