neulab/tldr huggingface dataset:
name   The name of the login to manage
password Creates a SQL Server authentication login Since hashed passwords are varbinary values, if the new_login_password is 'long', it will be considered to be HASHED.
domain Creates a Windows authentication login.  Needs to be NetBIOS domain or hostname
server_roles Add this login to all the server roles in the list
salt.states.mssql_role Management of Microsoft SQLServer Databases The mssql_role module is used to create and manage SQL Server Roles
yolo: mssql_role.present
salt.states.mssql_role.absent(name, **kwargs) Ensure that the named database is absent
salt.states.mssql_role.present(name, owner=None, grants=None, **kwargs) Ensure that the named database is present with the specified options
owner  Adds owner using AUTHORIZATION option
Grants Can only be a list of strings
salt.states.mssql_user Management of Microsoft SQLServer Users The mssql_user module is used to create and manage SQL Server Users
frank: mssql_user.present: - database: yolo
salt.states.mssql_user.absent(name, **kwargs) Ensure that the named user is absent
name   The username of the user to remove
salt.states.mssql_user.present(name, login=None, domain=None, database=None, roles=None, options=None, **kwargs) Checks existence of the named user.  If not present, creates the user with the specified roles and options.
login  If not specified, will be created WITHOUT LOGIN
domain Creates a Windows authentication user.  Needs to be NetBIOS domain or hostname
database The database of the user (not the login)
roles  Add this user to all the roles in the list
salt.states.msteams Send a message card to Microsoft Teams This state is useful for sending messages to Teams during state runs.
teams-message: msteams.post_card: - message: 'This state was executed successfully.' - hook_url:  https://outlook.office.com/webhook/837
The hook_url can be specified in the master or minion configuration like below:
salt.states.msteams.post_card(name, message, hook_url=None, title=None, theme_color=None) Send a message to a Microsft Teams channel
send-msteams-message: msteams.post_card: - message: 'This state was executed successfully.' - hook_url: https://outlook.office.com/webhook/837
message The message that is to be sent to the MS Teams channel.
hook_url The webhook URL given configured in Teams interface, if not specified in the configuration options of master or minion.
title  The title for the card posted to the channel
theme_color A hex code for the desired highlight color
salt.states.mysql_database Management of MySQL databases (schemas) depends
configuration See salt.modules.mysql for setup instructions.
The mysql_database module is used to create and manage MySQL databases. Databases can be set as either absent or present.
frank: mysql_database.present
salt.states.mysql_database.absent(name, **connection_args) Ensure that the named database is absent
salt.states.mysql_database.present(name, character_set=None, collate=None, **connection_args) Ensure that the named database is present with the specified properties
salt.states.mysql_grants Management of MySQL grants (user permissions) depends
The mysql_grants module is used to grant and revoke MySQL permissions.
The name you pass in purely symbolic and does not have anything to do with the grant itself.
The database parameter needs to specify a 'priv_level' in the same specification as defined in the MySQL documentation:
• *.*
• db_name.*
• db_name.tbl_name
• etc...
This state is not able to set password for the permission from the specified host. See salt.states.mysql_user for further instructions.
frank_exampledb: mysql_grants.present: - grant: select,insert,update - database: exampledb.* - user: frank - host: localhost
frank_otherdb: mysql_grants.present: - grant: all privileges - database: otherdb.* - user: frank
restricted_singletable: mysql_grants.present: - grant: select - database: somedb.sometable - user: joe
salt.states.mysql_grants.absent(name, grant=None, database=None, user=None, host='localhost', grant_option=False, escape=True, **connection_args) Ensure that the grant is absent
name   The name (key) of the grant to add
grant  The grant priv_type (i.e. select,insert,update OR all privileges)
database The database priv_level (i.e. db.tbl OR db.*)
user   The user to apply the grant to
host   The network/host that the grant should apply to
salt.states.mysql_grants.present(name, grant=None, database=None, user=None, host='localhost', grant_option=False, escape=True, revoke_first=False, ssl_option=False, **connection_args) Ensure that the grant is present with the specified properties
grant_option Adds the WITH GRANT OPTION to the defined grant. Default is False
escape Defines if the database value gets escaped or not. Default is True
revoke_first By default, MySQL will not do anything if you issue a command to grant privileges that are more restrictive than what's already in place. This effectively means that you cannot downgrade permissions without first revoking permissions applied to a db.table/user pair first.
To have Salt forcibly revoke perms before applying a new grant, enable the 'revoke_first options.
WARNING: This will remove permissions for a database before attempting to apply new permissions. There is no guarantee that new permissions will be applied correctly which can leave your database security in an unknown and potentially dangerous state.  Use with caution!
ssl_option Adds the specified ssl options for the connecting user as requirements for this grant. Value is a list of single-element dicts corresponding to the list of ssl options to use.
Possible key/value pairings for the dicts in the value:
- SSL: True - X509: True - SUBJECT: <subject> - ISSUER: <issuer> - CIPHER: <cipher>
The non-boolean ssl options take a string as their values, which should be an appropriate value as specified by the MySQL documentation for these options.
Default is False (no ssl options will be used)
salt.states.mysql_query Execution of MySQL queries New in version 2014.7.0.
The mysql_query module is used to execute queries on MySQL databases. Its output may be stored in a file or in a grain.
query_id: mysql_query.run - database: my_database - query:    "SELECT * FROM table;" - output:   "/tmp/query_id.txt"
salt.states.mysql_query.run(name, database, query, output=None, grain=None, key=None, overwrite=True, check_db_exists=True, client_flags=None, **connection_args) Execute an arbitrary query on the specified database
name   Used only as an ID
database The name of the database to execute the query on
query  The query to execute
check_db_exists: The state run will check that the specified database exists (default=True) before running any queries
client_flags: A list of client flags to pass to the MySQL connection. https://dev.mysql.com/doc/internals/en/capability-flags.html
salt.states.mysql_query.run_file(name, database, query_file=None, output=None, grain=None, key=None, overwrite=True, saltenv=None, check_db_exists=True, client_flags=None, **connection_args) Execute an arbitrary query on the specified database
database The name of the database to execute the query_file on
query_file The file of mysql commands to run
saltenv: The saltenv to pull the query_file from
salt.states.mysql_user Management of MySQL users depends
frank: mysql_user.present: - host: localhost - password: bobcat
New in version 0.16.2: Authentication overrides have been added.
The MySQL authentication information specified in the minion config file can be overridden in states using the following arguments: connection_host, connection_port, connection_user, connection_pass, connection_db, connection_unix_socket, connection_default_file and connection_charset.
frank: mysql_user.present: - host: localhost - password: "bob@cat" - connection_user: someuser - connection_pass: somepass - connection_charset: utf8 - saltenv: - LC_ALL: "en_US.utf8"
This state is not able to grant permissions for the user. See salt.states.mysql_grants for further instructions.
salt.states.mysql_user.absent(name, host='localhost', **connection_args) Ensure that the named user is absent
salt.states.mysql_user.present(name, host='localhost', password=None, password_hash=None, allow_passwordless=False, unix_socket=False, password_column=None, auth_plugin='mysql_native_password', **connection_args) Ensure that the named user is present with the specified properties. A passwordless user can be configured by omitting password and password_hash, and setting allow_passwordless to True.
password The password to use for this user. Will take precedence over the password_hash option if both are specified.
allow_passwordless If True, then password and password_hash can be omitted to permit a passwordless login.
New in version 0.16.2.
unix_socket If True and allow_passwordless is True, the unix_socket auth plugin will be used.
salt.states.net_napalm_yang NAPALM YANG state Manage the configuration of network devices according to the YANG models (OpenConfig/IETF).
Dependencies • napalm-yang
• pyangbing > 0.5.11
salt.states.net_napalm_yang.configured(name, data, **kwargs) Configure the network device, given the input data strucuted according to the YANG models.
NOTE: The main difference between this function and managed is that the later generates and loads the configuration only when there are differences between the existing configuration on the device and the expected configuration. Depending on the platform and hardware capabilities, one could be more optimal than the other.  Additionally, the output of the managed is different, in such a way that the pchange field in the output contains structured data, rather than text.
data   YANG structured data.
State SLS example:
{%- set expected_config =  pillar.get('openconfig_interfaces_cfg') -%} interfaces_config: napalm_yang.configured: - data: {{ expected_config | json }} - models: - models.openconfig_interfaces - debug: true
openconfig_interfaces_cfg: _kwargs: filter: true interfaces: interface: Et1: config: mtu: 9000 Et2: config: description: "description example"
salt.states.net_napalm_yang.managed(name, data, **kwargs) Manage the device configuration given the input data structured according to the YANG models.
compliance_report: False Return the compliance report in the comment.
{%- set expected_config =  pillar.get('openconfig_interfaces_cfg') -%} interfaces_config: napalm_yang.managed: - data: {{ expected_config | json }} - models: - models.openconfig_interfaces - debug: true
salt.states.netacl Network ACL Manage the firewall configuration on the network device managed through NAPALM.  The firewall configuration is generated by Capirca.
Dependencies Capirca To install Capirca, execute: pip install capirca.
NAPALM To be able to load configuration on network devices, it requires NAPALM library to be installed:  pip install napalm.  Please check Installation for complete details.
salt.states.netacl.filter(name, filter_name, filter_options=None, terms=None, prepend=True, pillar_key='acl', pillarenv=None, saltenv=None, merge_pillar=False, only_lower_merge=False, revision_id=None, revision_no=None, revision_date=True, revision_date_format='%Y/%m/%d', test=False, commit=True, debug=False) Generate and load the configuration of a policy filter.
terms  Dictionary of terms for this policy filter.  If not specified or empty, will try to load the configuration from the pillar, unless merge_pillar is set as False.
merge_pillar: False Merge terms with the corresponding value from the pillar. Default: False.
NOTE: By default this state does not merge, to avoid any unexpected behaviours.
The merge logic depends on the prepend argument.
The terms specified through the terms argument have higher priority than the pillar.
salt 'edge01.flw01' state.sls router.acl test=True
edge01.flw01: ---------- ID: my-filter Function: netacl.filter Result: None Comment: Testing mode: Configuration discarded. Started: 12:24:40.598232 Duration: 2437.139 ms Changes: ---------- diff: --- +++ @@ -1228,9 +1228,24 @@ ! +ipv4 access-list my-filter + 10 remark $Id: my-filter_state $ + 20 remark $Revision: 5 $ + 30 remark my-other-term + 40 permit tcp any range 5678 5680 any +! +! loaded: ! $Id: my-filter_state $ ! $Revision: 5 $ no ipv6 access-list my-filter ipv6 access-list my-filter remark $Id: my-filter_state $ remark $Revision: 5 $ remark my-other-term permit tcp any range 5678 5680 any exit
Summary for edge01.flw01 ------------ Succeeded: 1 (unchanged=1, changed=1) Failed:    0 ------------ Total states run:     1 Total run time:   2.437 s
acl: - my-filter: options: - inet6 terms: - my-term: source_port: [1234, 1235] protocol: - tcp - udp source_address: 1.2.3.4 action: reject - my-other-term: source_port: - [5678, 5680] protocol: tcp action: accept
State SLS Example:
{%- set filter_name = 'my-filter' -%} {%- set my_filter_cfg = salt.netacl.get_filter_pillar(filter_name, pillar_key='firewall') -%} my_first_filter_state: netacl.filter: - filter_name: {{ filter_name }} - options: {{ my_filter_cfg['options'] | json }} - terms: {{ my_filter_cfg['terms'] | json }} - revision_date: false - revision_no: 5 - debug: true
my_first_filter_state: netacl.filter: - filter_name: my-filter - merge_pillar: true - pillar_key: firewall - revision_date: false - revision_no: 5 - debug: true
In the example above, as inet6 has been specified in the filter_options, the configuration chunk referring to my-term has been ignored as it referred to IPv4 only (from source_address field).
NOTE: The first method allows the user to eventually apply complex manipulation and / or retrieve the data from external services before passing the data to the state. The second one is more straightforward, for less complex cases when loading the data directly from the pillar is sufficient.
NOTE: When passing retrieved pillar data into the state file, it is strongly recommended to use the json serializer explicitly (`` | json``), instead of relying on the default Python serializer.
salt.states.netacl.managed(name, filters=None, prepend=True, pillar_key='acl', pillarenv=None, saltenv=None, merge_pillar=False, only_lower_merge=False, revision_id=None, revision_no=None, revision_date=True, revision_date_format='%Y/%m/%d', test=False, commit=True, debug=False) Manage the whole firewall configuration.
filters Dictionary of filters for this policy.  If not specified or empty, will try to load the configuration from the pillar, unless merge_pillar is set as False.
merge_pillar: False Merge the filters will the corresponding values from the pillar. Default: False.
The filters specified through the filters argument have higher priority than the pillar.
salt 'edge01.bjm01' state.sls router.acl test=True
edge01.bjm01: ------------- ID: netacl_example Function: netacl.managed Result: None Comment: Testing mode: Configuration discarded. Started: 12:03:24.807023 Duration: 5569.453 ms Changes: ---------- diff: [edit firewall] +    family inet { +        /* +         ** $Id: netacl_example $ +         ** $Date: 2017/07/03 $ +         ** $Revision: 2 $ +         ** +         */ +        filter my-filter { +            interface-specific; +            term my-term { +                from { +                    source-address { +                        1.2.3.4/32; +                    } +                    protocol [ tcp udp ]; +                    source-port [ 1234 1235 ]; +                } +                then { +                    reject; +                } +            } +            term my-other-term { +                from { +                    protocol tcp; +                    source-port 5678-5680; +                } +                then accept; +            } +        } +        /* +         ** $Id: netacl_example $ +         ** $Date: 2017/07/03 $ +         ** $Revision: 2 $ +         ** +         */ +        filter block-icmp { +            interface-specific; +            term first-term { +                from { +                    protocol icmp; +                } +                then { +                    reject; +                } +            } +        } +    } loaded: firewall { family inet { replace: /* ** $Id: netacl_example $ ** $Date: 2017/07/03 $ ** $Revision: 2 $ ** */ filter my-filter { interface-specific; term my-term { from { source-address { 1.2.3.4/32; } protocol [ tcp udp ]; source-port [ 1234 1235 ]; } then { reject; } } term my-other-term { from { protocol tcp; source-port 5678-5680; } then accept; } } } } firewall { family inet { replace: /* ** $Id: netacl_example $ ** $Date: 2017/07/03 $ ** $Revision: 2 $ ** */ filter block-icmp { interface-specific; term first-term { from { protocol icmp; } then { reject; } } } } }
Summary for edge01.bjm01 ------------ Succeeded: 1 (unchanged=1, changed=1) Failed:    0 ------------ Total states run:     1 Total run time:   5.569 s
firewall: - my-filter: terms: - my-term: source_port: [1234, 1235] protocol: - tcp - udp source_address: 1.2.3.4 action: reject - my-other-term: source_port: - [5678, 5680] protocol: tcp action: accept - block-icmp: terms: - first-term: protocol: - icmp action: reject
Example SLS file:
{%- set fw_filters = pillar.get('firewall', {}) -%} netacl_example: netacl.managed: - filters: {{ fw_filters | json }} - revision_no: 2 - debug: true
netacl_example: netacl.managed: - pillar_key: firewall - merge_pillar: true - revision_no: 2 - debug: true
salt.states.netacl.term(name, filter_name, term_name, filter_options=None, pillar_key='acl', pillarenv=None, saltenv=None, merge_pillar=False, revision_id=None, revision_no=None, revision_date=True, revision_date_format='%Y/%m/%d', test=False, commit=True, debug=False, source_service=None, destination_service=None, **term_fields) Manage the configuration of a specific policy term.
merge_pillar: False Merge the CLI variables with the pillar. Default: False.
The properties specified through the state arguments have higher priority than the pillar.
term_fields Term attributes. To see what fields are supported, please consult the list of supported keywords. Some platforms have few other optional keywords.
salt 'edge01.bjm01' state.sls router.acl
edge01.bjm01: ---------- ID: update_icmp_first_term Function: netacl.term Result: None Comment: Testing mode: Configuration discarded. Started: 12:49:09.174179 Duration: 5751.882 ms Changes: ---------- diff: [edit firewall] +    family inet { +        /* +         ** $Id: update_icmp_first_term $ +         ** $Date: 2017/02/30 $ +         ** +         */ +        filter block-icmp { +            term first-term { +                from { +                    protocol icmp; +                } +                then { +                    reject; +                } +            } +        } +    }
Summary for edge01.bjm01 ------------ Succeeded: 1 (unchanged=1, changed=1) Failed:    0 ------------ Total states run:     1 Total run time:   5.752 s
firewall: - block-icmp: terms: - first-term: protocol: - icmp action: reject
{%- set filter_name = 'block-icmp' -%} {%- set term_name = 'first-term' -%} {%- set my_term_cfg = salt.netacl.get_term_pillar(filter_name, term_name) -%}
update_icmp_first_term: netacl.term: - filter_name: {{ filter_name }} - filter_options: - not-interface-specific - term_name: {{ term_name }} - {{ my_term_cfg | json }}
Or directly referencing the pillar keys:
update_icmp_first_term: netacl.term: - filter_name: block-icmp - filter_options: - not-interface-specific - term_name: first-term - merge_pillar: true
salt.states.netconfig Network Config Manage the configuration on a network device given a specific static config or template.
• Network-related basic features execution module
salt.states.netconfig.commit_cancelled(name) New in version 2019.2.0.
'20180726083540640360': netconfig.commit_cancelled
salt.states.netconfig.commit_confirmed(name) New in version 2019.2.0.
Confirm a commit scheduled to be reverted via the revert_in and revert_at arguments from the net.load_template or net.load_config execution functions. The commit ID is displayed when the commit confirmed is scheduled via the functions named above.
'20180726083540640360': netconfig.commit_confirmed
salt.states.netconfig.managed(name, template_name=None, template_source=None, template_hash=None, template_hash_name=None, saltenv='base', template_engine='jinja', skip_verify=False, context=None, defaults=None, test=False, commit=True, debug=False, replace=False, commit_in=None, commit_at=None, revert_in=None, revert_at=None, **template_vars) Manages the configuration on network devices.
By default this state will commit the changes on the device. If there are no changes required, it does not commit and the field already_configured from the output dictionary will be set as True to notify that.
To avoid committing the configuration, set the argument test to True (or via the CLI argument test=True) and will discard (dry run).
To preserve the changes, set commit to False (either as CLI argument, either as state parameter).  However, this is recommended to be used only in exceptional cases when there are applied few consecutive states and/or configuration changes. Otherwise the user might forget that the config DB is locked and the candidate config buffer is not cleared/merged in the running config.
To replace the config, set replace to True. This option is recommended to be used with caution!
template_name Identifies path to the template source. The template can be either stored on the local machine, either remotely.  The recommended location is under the file_roots as specified in the master config file.  For example, let's suppose the file_roots is configured as:
saltenv: base Specifies the template environment. This will influence the relative imports inside the templates.
Changed in version 2017.7.1.
test: False Dry run? If set to True, will apply the config, discard and return the changes. Default: False (will commit the changes on the device).
NOTE: This argument cannot be used directly on the command line. Instead, it can be passed through the pillar variable when executing either of the state.sls or state.apply (see below for an example).
replace: False Load and replace the configuration. Default: False (will apply load merge).
template_vars Dictionary with the arguments/context to be used when the template is rendered. Do not explicitly specify this argument. This represents any other variable that will be sent to the template rendering system. Please see an example below! In both ntp_peers_example_using_pillar and ntp_peers_example, peers is sent as template variable.
NOTE: It is more recommended to use the context argument instead, to avoid any conflicts with other arguments.
SLS Example (e.g.: under salt://router/config.sls) :
whole_config_example: netconfig.managed: - template_name: salt://path/to/complete_config.jinja - debug: True - replace: True bgp_config_example: netconfig.managed: - template_name: /absolute/path/to/bgp_neighbors.mako - template_engine: mako prefix_lists_example: netconfig.managed: - template_name: prefix_lists.cheetah - debug: True - template_engine: cheetah ntp_peers_example: netconfig.managed: - template_name: http://bit.ly/2gKOj20 - skip_verify: False - debug: True - peers: - 192.168.0.1 - 192.168.0.1 ntp_peers_example_using_pillar: netconfig.managed: - template_name: http://bit.ly/2gKOj20 - peers: {{ pillar.get('ntp.peers', []) }}
Multi template example:
hostname_and_ntp: netconfig.managed: - template_name: - https://bit.ly/2OhSgqP - https://bit.ly/2M6C4Lx - https://bit.ly/2OIWVTs - debug: true - context: hostname: {{ opts.id }} servers: - 172.17.17.1 - 172.17.17.2 peers: - 192.168.0.1 - 192.168.0.2
$ sudo salt 'juniper.device' state.sls router.config test=True
$ sudo salt -N all-routers state.sls router.config pillar="{'debug': True}"
router.config depends on the location of the SLS file (see above). Running this command, will be executed all five steps from above. These examples above are not meant to be used in a production environment, their sole purpose is to provide usage examples.
$ sudo salt 'juniper.device' state.sls router.config test=True juniper.device: ---------- ID: ntp_peers_example_using_pillar Function: netconfig.managed Result: None Comment: Testing mode: Configuration discarded. Started: 12:01:40.744535 Duration: 8755.788 ms Changes: ---------- diff: [edit system ntp] peer 192.168.0.1 { ... } +    peer 172.17.17.1; +    peer 172.17.17.3;
Summary for juniper.device ------------ Succeeded: 1 (unchanged=1, changed=1) Failed:    0 ------------ Total states run:     1 Total run time:   8.756 s
Raw output example (useful when the output is reused in other states/execution modules):
$ sudo salt --out=pprint 'juniper.device' state.sls router.config test=True debug=True
{ 'juniper.device': { 'netconfig_|-ntp_peers_example_using_pillar_|-ntp_peers_example_using_pillar_|-managed': { '__id__': 'ntp_peers_example_using_pillar', '__run_num__': 0, 'already_configured': False, 'changes': { 'diff': '[edit system ntp]   peer 192.168.0.1 { ... }+   peer 172.17.17.1;+   peer 172.17.17.3;' }, 'comment': 'Testing mode: Configuration discarded.', 'duration': 7400.759, 'loaded_config': 'system {  ntp {  peer 172.17.17.1;  peer 172.17.17.3; } }', 'name': 'ntp_peers_example_using_pillar', 'result': None, 'start_time': '12:09:09.811445' } } }
salt.states.netconfig.replace_pattern(name, pattern, repl, count=0, flags=8, bufsize=1, append_if_not_found=False, prepend_if_not_found=False, not_found_content=None, search_only=False, show_changes=True, backslash_literal=False, source='running', path=None, test=False, replace=True, debug=False, commit=True) New in version 2019.2.0.
update_policy_name: netconfig.replace_pattern: - pattern: OLD-POLICY-NAME - repl: new-policy-name - debug: true
salt.states.netconfig.saved(name, source='running', user=None, group=None, mode=None, attrs=None, makedirs=False, dir_mode=None, replace=True, backup='', show_changes=True, create=True, tmp_dir='', tmp_ext='', encoding=None, encoding_errors='strict', allow_empty=False, follow_symlinks=True, check_cmd=None, win_owner=None, win_perms=None, win_deny_perms=None, win_inheritance=True, win_perms_reset=False, **kwargs) New in version 2019.2.0.
name   Absolute path to file where to save the configuration.  To push the files to the Master, use cp.push Execution function.
mode   The permissions to set on this file, e.g. 644, 0775, or 4664.  The default mode for new files and directories corresponds to the umask of the salt process. The mode of existing files and directories will only be changed if mode is specified.
makedirs: False If set to True, then the parent directories will be created to facilitate the creation of the named file. If False, and the parent directory of the destination file doesn't exist, the state will fail.
replace: True If set to False and the file already exists, the file will not be modified even if changes would otherwise be made. Permissions and ownership will still be enforced, however.
show_changes: True Output a unified diff of the old file and the new file. If False return a boolean if any changes were made.
create: True If set to False, then the file will only be managed if the file already exists on the system.
encoding_errors: 'strict' Error encoding scheme. Default is `'strict'`.  See https://docs.python.org/2/library/codecs.html#codec-base-classes for the list of available schemes.
allow_empty: True If set to False, then the state will fail if the contents specified by contents_pillar or contents_grains are empty.
follow_symlinks: True If the desired path is a symlink follow it and make changes to the file to which the symlink points.
check_cmd The specified command will be run with an appended argument of a temporary file containing the new managed contents. If the command exits with a zero status the new managed contents will be written to the managed destination. If the command exits with a nonzero exit code, the state will fail and no changes will be made to the file.
win_owner: None The owner of the directory. If this is not passed, user will be used. If user is not passed, the account under which Salt is running will be used.
win_perms: None A dictionary containing permissions to grant and their propagation. For example: {'Administrators': {'perms': 'full_control'}} Can be a single basic perm or a list of advanced perms. perms must be specified. applies_to does not apply to file objects.
win_deny_perms: None A dictionary containing permissions to deny and their propagation. For example: {'Administrators': {'perms': 'full_control'}} Can be a single basic perm or a list of advanced perms. perms must be specified. applies_to does not apply to file objects.
win_inheritance: True True to inherit permissions from the parent directory, False not to inherit permission.
win_perms_reset: False If True the existing DACL will be cleared and replaced with the settings defined in this function. If False, new entries will be appended to the existing DACL. Default is False.
/var/backups/{{ opts.id }}/{{ salt.status.time('%s') }}.cfg: netconfig.saved: - source: running - makedirs: true
The state SLS  above would create a backup config grouping the files by the Minion ID, in chronological files. For example, if the state is executed at on the 3rd of August 2018, at 5:15PM, on the Minion core1.lon01, the configuration would saved in the file: /var/backups/core01.lon01/1533316558.cfg
salt.states.netntp Network NTP New in version 2016.11.0.
Manage the configuration of NTP peers and servers on the network devices through the NAPALM proxy.
Dependencies • Requires netaddr to be installed: pip install netaddr to check if IP Addresses are correctly specified
• Requires dnspython to be installed: pip install dnspython to resolve the nameserver entities (in case the user does not configure the peers/servers using their IP addresses)
• NAPALM proxy minion
salt.states.netntp.managed(name, peers=None, servers=None) Manages the configuration of NTP peers and servers on the device, as specified in the state SLS file.  NTP entities not specified in these lists will be removed whilst entities not configured on the device will be set.
netntp_example: netntp.managed: - peers: - 192.168.0.1 - 172.17.17.1 - servers: - 24.124.0.251 - 138.236.128.36
{ 'edge01.nrt04': { 'netntp_|-netntp_example_|-netntp_example_|-managed': { 'comment': 'NTP servers already configured as needed.', 'name': 'netntp_example', 'start_time': '12:45:24.056659', 'duration': 2938.857, 'changes': { 'peers': { 'removed': [ '192.168.0.2', '192.168.0.3' ], 'added': [ '192.168.0.1', '172.17.17.1' ] } }, 'result': None } } }
salt.states.netsnmp Network SNMP Manage the SNMP configuration on network devices.
Dependencies • napalm snmp management module (salt.modules.napalm_snmp)
salt.states.netsnmp.managed(name, config=None, defaults=None) Configures the SNMP on the device as specified in the SLS file.
snmp_example: netsnmp.managed: - config: location: Honolulu, HI, US - defaults: contact: noc@cloudflare.com
Output example (for the SLS above, e.g. called snmp.sls under /router/):
$ sudo salt edge01.hnl01 state.sls router.snmp test=True edge01.hnl01: ---------- ID: snmp_example Function: snmp.managed Result: None Comment: Testing mode: configuration was not changed! Started: 13:29:06.872363 Duration: 920.466 ms Changes: ---------- added: ---------- chassis_id: None contact: noc@cloudflare.com location: Honolulu, HI, US
Summary for edge01.hnl01 ------------ Succeeded: 1 (unchanged=1, changed=1) Failed:    0 ------------ Total states run:     1 Total run time: 920.466 ms
salt.states.netusers Network Users Manage the users configuration on network devices via the NAPALM proxy.
• Users configuration management module
salt.states.netusers.managed(name, users=None, defaults=None) Manages the configuration of the users on the device, as specified in the state SLS file. Users not defined in that file will be removed whilst users not configured on the device, will be added.
netusers_example: netusers.managed: - users: admin: level: 15 password: $1$knmhgPPv$g8745biu4rb.Zf.IT.F/U1 sshkeys: [] restricted: level: 1 password: $1$j34j5k4b$4d5SVjTiz1l.Zf.IT.F/K7 martin: level: 15 password: '' sshkeys: - ssh-dss AAAAB3NzaC1kc3MAAACBAK9dP3KariMlM/JmFW9rTSm5cXs4nR0+o6fTHP9o+bOLXMBTP8R4vwWHh0w JPjQmJYafAqZTnlgi0srGjyifFwPtODppDWLCgLe2M4LXnu3OMqknr54w344zPHP3iFwWxHrBrZKtCjO8LhbWCa+ X528+i87t6r5e4ersdfxgchvjbknlio87t6r5drcfhgjhbknio8976tycv7t86ftyiu87Oz1nKsKuNzm2csoUQlJ trmRfpjsOPNookmOz5wG0YxhwDmKeo6fWK+ATk1OiP+QT39fn4G77j8o+e4WAwxM570s35Of/vV0zoOccj753sXn pvJenvwpM2H6o3a9ALvehAJKWodAgZT7X8+iu786r5drtycghvjbiu78t+wAAAIBURwSPZVElXe+9a43sF6M4ysT 7Xv+6wTsa8q86E3+RYyu8O2ObI2kwNLC3/HTgFniE/YqRG+WJac81/VHWQNP822gns8RVrWKjqBktmQoEm7z5yy0 bkjui78675dytcghvjkoi9y7t867ftcuvhbuu9t78gy/v+zvMmv8KvQgHg jonathan: level: 15 password: '' sshkeys: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcgxE6HZF/xjFtIt0thEDKPjFJxW9BpZtTVstYbDgGR9zPkHG ZJT/j345jk345jk453jk43545j35nl3kln34n5kl4ghv3/JzWt/0Js5KZp/51KRNCs9O4t07qaoqwpLB15GwLfEX Bx9dW26zc4O+hi6754trxcfghvjbo98765drt/LYIEg0KSQPWyJEK1g31gacbxN7Ab006xeHh7rv7HtXF6zH3WId Uhq9rtdUag6kYnv6qvjG7sbCyHGYu5vZB7GytnNuVNbZuI+RdFvmHSnErV9HCu9xZBq6DBb+sESMS4s7nFcsruMo edb+BAc3aww0naeWpogjSt+We7y2N
salt 'edge01.kix01' state.sls router.users
Output example (raw python - can be reused in other modules):
{ 'netusers_|-netusers_example_|-netusers_example_|-managed': { 'comment': 'Configuration updated!', 'name': 'netusers_example', 'start_time': '10:57:08.678811', '__id__': 'netusers_example', 'duration': 1620.982, '__run_num__': 0, 'changes': { 'updated': { 'admin': { 'level': 15 }, 'restricted': { 'level': 1 }, 'martin': { 'sshkeys': [ 'ssh-dss AAAAB3NzaC1kc3MAAACBAK9dP3KariMlM/JmFW9rTSm5cXs4nR0+o6fTHP9o+bOLXMBTP8R4vwWHh0w JPjQmJYafAqZTnlgi0srGjyifFwPtODppDWLCgLe2M4LXnu3OMqknr54w344zPHP3iFwWxHrBrZKtCjO8LhbWCa+ X528+i87t6r5e4ersdfxgchvjbknlio87t6r5drcfhgjhbknio8976tycv7t86ftyiu87Oz1nKsKuNzm2csoUQlJ trmRfpjsOPNookmOz5wG0YxhwDmKeo6fWK+ATk1OiP+QT39fn4G77j8o+e4WAwxM570s35Of/vV0zoOccj753sXn pvJenvwpM2H6o3a9ALvehAJKWodAgZT7X8+iu786r5drtycghvjbiu78t+wAAAIBURwSPZVElXe+9a43sF6M4ysT 7Xv+6wTsa8q86E3+RYyu8O2ObI2kwNLC3/HTgFniE/YqRG+WJac81/VHWQNP822gns8RVrWKjqBktmQoEm7z5yy0 bkjui78675dytcghvjkoi9y7t867ftcuvhbuu9t78gy/v+zvMmv8KvQgHg' ] } }, 'added': { 'jonathan': { 'password': '', 'sshkeys': [ 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcgxE6HZF/xjFtIt0thEDKPjFJxW9BpZtTVstYbDgGR9zPkHG ZJT/j345jk345jk453jk43545j35nl3kln34n5kl4ghv3/JzWt/0Js5KZp/51KRNCs9O4t07qaoqwpLB15GwLfEX Bx9dW26zc4O+hi6754trxcfghvjbo98765drt/LYIEg0KSQPWyJEK1g31gacbxN7Ab006xeHh7rv7HtXF6zH3WId Uhq9rtdUag6kYnv6qvjG7sbCyHGYu5vZB7GytnNuVNbZuI+RdFvmHSnErV9HCu9xZBq6DBb+sESMS4s7nFcsruMo edb+BAc3aww0naeWpogjSt+We7y2N' ], 'level': 15 } }, 'removed': { } }, 'result': True } }
CLI Output:
edge01.kix01: ---------- ID: netusers_example Function: netusers.managed Result: True Comment: Configuration updated! Started: 11:03:31.957725 Duration: 1220.435 ms Changes: ---------- added: ---------- jonathan: ---------- level: 15 password: sshkeys: - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcgxE6HZF/xjFtIt0thEDKPjFJxW9BpZtTVstYbDgG R9zPkHGZJT/j345jk345jk453jk43545j35nl3kln34n5kl4ghv3/JzWt/0Js5KZp/51KRNCs9O4t07qao qwpLB15GwLfEXBx9dW26zc4O+hi6754trxcfghvjbo98765drt/LYIEg0KSQPWyJEK1g31gacbxN7Ab006 xeHh7rv7HtXF6zH3WIdUhq9rtdUag6kYnv6qvjG7sbCyHGYu5vZB7GytnNuVNbZuI+RdFvmHSnErV9HCu9 xZBq6DBb+sESMS4s7nFcsruMoedb+BAc3aww0naeWpogjSt+We7y2N removed: ---------- updated: ---------- martin: ---------- sshkeys: - ssh-dss AAAAB3NzaC1kc3MAAACBAK9dP3KariMlM/JmFW9rTSm5cXs4nR0+o6fTHP9o+bOLXMBTP8R4 vwWHh0wJPjQmJYafAqZTnlgi0srGjyifFwPtODppDWLCgLe2M4LXnu3OMqknr54w344zPHP3iFwWxHrBrZ KtCjO8LhbWCa+X528+i87t6r5e4ersdfxgchvjbknlio87t6r5drcfhgjhbknio8976tycv7t86ftyiu87 Oz1nKsKuNzm2csoUQlJtrmRfpjsOPNookmOz5wG0YxhwDmKeo6fWK+ATk1OiP+QT39fn4G77j8o+e4WAwx M570s35Of/vV0zoOccj753sXnpvJenvwpM2H6o3a9ALvehAJKWodAgZT7X8+iu786r5drtycghvjbiu78t +wAAAIBURwSPZVElXe+9a43sF6M4ysT7Xv+6wTsa8q86E3+RYyu8O2ObI2kwNLC3/HTgFniE/YqRG+WJac 81/VHWQNP822gns8RVrWKjqBktmQoEm7z5yy0bkjui78675dytcghvjkoi9y7t867ftcuvhbuu9t78gy/v +zvMmv8KvQgHg admin: ---------- level: 15 restricted: ---------- level: 1 Summary for edge01.kix01 ------------ Succeeded: 1 (changed=1) Failed:    0 ------------ Total states run:     1 Total run time:   1.220 s
salt.states.network Configuration of network interfaces The network module is used to create and manage network settings, interfaces can be set as either managed or ignored. By default all interfaces are ignored unless specified.
NOTE: RedHat-based systems (RHEL, CentOS, Scientific, etc.)  have been supported since version 2014.1.0.
Debian-based systems (Debian, Ubuntu, etc.) have been supported since version 2017.7.0. The following options are not supported: ipaddr_start, and ipaddr_end.
Other platforms are not yet supported.
NOTE: On Debian-based systems, networking configuration can be specified in /etc/network/interfaces or via included files such as (by default) /etc/network/interfaces.d/*. This can be problematic for configuration management. It is recommended to use either file.managed or network.managed.
If using network.managed, it can be useful to ensure interfaces.d/ is empty. This can be done using the following state
/etc/network/interfaces.d: file.directory: - clean: True
Configuring Global Network Settings Use the network.system state to set global network settings:
system: network.system: - enabled: True - hostname: server1.example.com - gateway: 192.168.0.1 - gatewaydev: eth0 - nozeroconf: True - nisdomain: example.com - require_reboot: True - apply_hostname: True
NOTE: The use of apply_hostname above will apply changes to the hostname immediately.
Changed in version 2015.5.0: apply_hostname added
retain_settings New in version 2016.11.0.
Use retain_settings to retain current network settings that are not otherwise specified in the state. Particularly useful if only setting the hostname.  Default behavior is to delete unspecified network settings.
system: network.system: - hostname: server2.example.com - apply_hostname: True - retain_settings: True
Configuring Network Routes Use the network.routes state to set network routes.
routes: network.routes: - name: eth0 - routes: - name: secure_network ipaddr: 10.2.0.0 netmask: 255.255.255.0 gateway: 10.1.0.3 - name: HQ_network ipaddr: 10.100.0.0 netmask: 255.255.0.0 gateway: 10.1.0.10
Managing Network Interfaces The network.managed state is used to configure network interfaces. Here are several examples:
Ethernet Interface eth0: network.managed: - enabled: True - type: eth - proto: static - ipaddr: 10.1.0.7 - netmask: 255.255.255.0 - gateway: 10.1.0.1 - enable_ipv6: true - ipv6proto: static - ipv6addrs: - 2001:db8:dead:beef::3/64 - 2001:db8:dead:beef::7/64 - ipv6gateway: 2001:db8:dead:beef::1 - ipv6netmask: 64 - dns: - 8.8.8.8 - 8.8.4.4 - channels: rx: 4 tx: 4 other: 4 combined: 4
Ranged Interfaces (RHEL/CentOS Only) New in version 2015.8.0.
Ranged interfaces can be created by including the word range in the interface name.
IMPORTANT: The interface type must be eth.
eth0-range0: network.managed: - type: eth - ipaddr_start: 192.168.1.1 - ipaddr_end: 192.168.1.10 - clonenum_start: 10 - mtu: 9000
bond0-range0: network.managed: - type: eth - ipaddr_start: 192.168.1.1 - ipaddr_end: 192.168.1.10 - clonenum_start: 10 - mtu: 9000
eth1.0-range0: network.managed: - type: eth - ipaddr_start: 192.168.1.1 - ipaddr_end: 192.168.1.10 - clonenum_start: 10 - vlan: True - mtu: 9000
bond0.1-range0: network.managed: - type: eth - ipaddr_start: 192.168.1.1 - ipaddr_end: 192.168.1.10 - clonenum_start: 10 - vlan: True - mtu: 9000
Bond Interfaces To configure a bond, you must do the following:
• Configure the bond slaves with a type of slave, and a master option set to the name of the bond interface.
• Configure the bond interface with a type of bond, and a slaves option defining the bond slaves for the bond interface.
eth2: network.managed: - enabled: True - type: slave - master: bond0
eth3: network.managed: - enabled: True - type: slave - master: bond0
bond0: network.managed: - type: bond - ipaddr: 10.1.0.1 - netmask: 255.255.255.0 - mode: gre - proto: static - dns: - 8.8.8.8 - 8.8.4.4 - enabled: False - slaves: eth2 eth3 - require: - network: eth2 - network: eth3 - miimon: 100 - arp_interval: 250 - downdelay: 200 - lacp_rate: fast - max_bonds: 1 - updelay: 0 - use_carrier: on - hashing-algorithm: layer2 - mtu: 9000 - autoneg: on - speed: 1000 - duplex: full - rx: on - tx: off - sg: on - tso: off - ufo: off - gso: off - gro: off - lro: off
VLANs Set type to vlan to configure a VLANs. These VLANs are configured on the bond interface defined above.
bond0.2: network.managed: - type: vlan - ipaddr: 10.1.0.2 - use: - network: bond0 - require: - network: bond0
bond0.3: network.managed: - type: vlan - ipaddr: 10.1.0.3 - use: - network: bond0 - require: - network: bond0
bond0.10: network.managed: - type: vlan - ipaddr: 10.1.0.4 - use: - network: bond0 - require: - network: bond0
bond0.12: network.managed: - type: vlan - ipaddr: 10.1.0.5 - use: - network: bond0 - require: - network: bond0
Bridge Interfaces eth4: network.managed: - enabled: True - type: eth - proto: dhcp - bridge: br0
br0: network.managed: - enabled: True - type: bridge - proto: dhcp - bridge: br0 - delay: 0 - ports: eth4 - bypassfirewall: True - use: - network: eth4 - require: - network: eth4
NOTE: When managing bridged interfaces on a Debian/Ubuntu based system, the ports argument is required. RedHat-based systems will ignore the argument.
Network Teaming (RHEL/CentOS 7 and later) New in version 3002.
• Configure the members of the team interface with a type of teamport, and a team_master option set to the name of the bond interface.
• master also works, but will be ignored if both team_master and master are present.
• If applicable, include a team_port_config option. This should be formatted as a dictionary. Keep in mind that due to a quirk of PyYAML, dictionaries nested under a list item must be double-indented (see example below for interface eth5).
• Configure the team interface with a type of team. The team configuration should be passed via the team_config option. As with team_port_config, the dictionary should be double-indented.
eth5: network.managed: - type: teamport - team_master: team0 - team_port_config: prio: 100
eth6: network.managed: - type: teamport - team_master: team0
team0: network.managed: - type: team - ipaddr: 172.24.90.42 - netmask: 255.255.255.128 - enable_ipv6: True - ipv6addr: 'fee1:dead:beef:af43::' - team_config: runner: hwaddr_policy: by_active name: activebackup link_watch: name: ethtool
NOTE: While teamd must be installed to manage a team interface, it is not required to configure a separate pkg.installed state for it, as it will be silently installed if needed.
Configuring the Loopback Interface Use network.managed with a type of eth and a proto of loopback.
lo: network.managed: - name: lo - type: eth - proto: loopback - onboot: yes - userctl: no - ipv6_autoconf: no - enable_ipv6: true
Other Useful Options noifupdown The noifupdown option, if set to True, will keep Salt from restart the interface if changes are made, requiring them to be restarted manually. Here are a couple examples:
eth7: network.managed: - enabled: True - type: eth # Automatic IP/DNS - proto: dhcp - noifupdown: True
eth8: network.managed: - type: eth - noifupdown: True
# IPv4 - proto: static - ipaddr: 192.168.4.9 - netmask: 255.255.255.0 - gateway: 192.168.4.1 - enable_ipv6: True
# IPv6 - ipv6proto: static - ipv6addr: 2001:db8:dead:c0::3 - ipv6netmask: 64 - ipv6gateway: 2001:db8:dead:c0::1 # override shared; makes those options v4-only - ipv6ttl: 15
# Shared - mtu: 1480 - ttl: 18 - dns: - 8.8.8.8 - 8.8.4.4
salt.states.network.managed(name, enabled=True, **kwargs) Ensure that the named interface is configured properly.
name   The name of the interface to manage
type   eth Type of interface and configuration
enabled Designates the state of this interface.
salt.states.network.routes(name, **kwargs) Manage network interface static routes.
name   Interface name to apply the route to.
kwargs Named routes
salt.states.network.system(name, **kwargs) Ensure that global network settings are configured properly.
name   Custom name to represent this configuration change.
kwargs The global parameters for the system.
salt.states.neutron_network Management of OpenStack Neutron Networks New in version 2018.3.0.
configuration see salt.modules.neutronng for setup instructions
create network: neutron_network.present: - name: network1
delete network: neutron_network.absent: - name: network1
create network with optional params: neutron_network.present: - name: network1 - vlan: 200 - shared: False - external: False - project: project1
salt.states.neutron_network.absent(name, auth=None, **kwargs) Ensure a network does not exists
salt.states.neutron_network.present(name, auth=None, **kwargs) Ensure a network exists and is up-to-date
provider A dict of network provider options.
shared Set the network as shared.
external Whether this network is externally accessible.
admin_state_up Set the network administrative state to up.
vlan   Vlan ID. Alias for provider
• physical_network: provider
• network_type: vlan
• segmentation_id: (vlan id)
salt.states.neutron_secgroup Management of OpenStack Neutron Security Groups New in version 2018.3.0.
create security group; neutron_secgroup.present: - name: security_group1 - description: "Very Secure Security Group"
delete security group: neutron_secgroup.absent: - name_or_id: security_group1 - project_name: Project1
create security group with optional params: neutron_secgroup.present: - name: security_group1 - description: "Very Secure Security Group" - project_id: 1dcac318a83b4610b7a7f7ba01465548
create security group with optional params: neutron_secgroup.present: - name: security_group1 - description: "Very Secure Security Group" - project_name: Project1
salt.states.neutron_secgroup.absent(name, auth=None, **kwargs) Ensure a security group does not exist
name   Name of the security group
salt.states.neutron_secgroup.present(name, auth=None, **kwargs) Ensure a security group exists.
You can supply either project_name or project_id.
Creating a default security group will not show up as a change; it gets created through the lookup process.
description Description of the security group
project_name Name of Project
project_id ID of Project
salt.states.neutron_secgroup_rule Management of OpenStack Neutron Security Group Rules New in version 2018.3.0.
create security group rule: neutron_secgroup_rule.present: - name: security_group1 - project_name: Project1 - protocol: icmp
delete security group: neutron_secgroup_rule.absent: - name_or_id: security_group1
create security group with optional params: neutron_secgroup_rule.present: - name: security_group1 - description: "Very Secure Security Group" - project_id: 1dcac318a83b4610b7a7f7ba01465548
salt.states.neutron_secgroup_rule.absent(name, auth=None, **kwargs) Ensure a security group rule does not exist
name   name or id of the security group rule to delete
rule_id uuid of the rule to delete
project_id id of project to delete rule from
salt.states.neutron_secgroup_rule.present(name, auth=None, **kwargs) Ensure a security group rule exists
defaults: port_range_min=None, port_range_max=None, protocol=None, remote_ip_prefix=None, remote_group_id=None, direction='ingress', ethertype='IPv4', project_id=None
name   Name of the security group to associate with this rule
project_name Name of the project associated with the security group
salt.states.neutron_subnet Management of OpenStack Neutron Subnets New in version 2018.3.0.
create subnet: neutron_subnet.present: - name: subnet1 - network_name_or_id: network1 - cidr: 192.168.199.0/24
delete subnet: neutron_subnet.absent: - name: subnet2
create subnet with optional params: neutron_subnet.present: - name: subnet1 - network_name_or_id: network1 - enable_dhcp: True - cidr: 192.168.199.0/24 - allocation_pools: - start: 192.168.199.5 end: 192.168.199.250 - host_routes: - destination: 192.168..0.0/24 nexthop: 192.168.0.1 - gateway_ip: 192.168.199.1 - dns_nameservers: - 8.8.8.8 - 8.8.8.7
create ipv6 subnet: neutron_subnet.present: - name: v6subnet1 - network_name_or_id: network1 - ip_version: 6
salt.states.neutron_subnet.absent(name, auth=None) Ensure a subnet does not exists
name   Name of the subnet
salt.states.neutron_subnet.present(name, auth=None, **kwargs) Ensure a subnet exists and is up-to-date
network_name_or_id The unique name or ID of the attached network.  If a non-unique name is supplied, an exception is raised.
allocation_pools A list of dictionaries of the start and end addresses for the allocation pools
gateway_ip The gateway IP address.
dns_nameservers A list of DNS name servers for the subnet.
host_routes A list of host route dictionaries for the subnet.
ipv6_ra_mode IPv6 Router Advertisement mode.  Valid values are: ‘dhcpv6-stateful’, ‘dhcpv6-stateless’, or ‘slaac’.