neulab/tldr huggingface dataset:
• When using yumpkg, report stdout when stderr is redirected to stdout. (#57862)
• Fixes an issue on macOS where if you try and restart the macOS using serivce.restart salt-minion it would fail because the service names are different on macOS. (#57878)
• Fixes an issue on macOS where salt would take extra time to run on a service.dead call and the service is missing. (#57907)
• Fixes an issue where a disabled macOS and Windows service would fail to start with service.running. (#57908)
• Use "use_bin_type" to differentiate between bytes and str when writing cache for pillar and grains. (#57918)
• Set the comment to "No minions responded" if salt.function fails to find any minions (#57920)
• Fix issue with __utils__ usage in the __virtual__ functions on a few of the execution modules. (#57948)
• remove encoding kwarg for both pack(b)/unpack(b) in msgpack for versions >=1.0.0 https://github.com/msgpack/msgpack-python/blob/master/ChangeLog.rst#100 (#57965)
• Replace deprecated cgi.escape() with html.escape() after it was removed from Python 3.8. (#57983)
• Fix btrfs state decorator, that produces exceptions when creating subvolumes. (#58012)
• Fix kubeadm token_list when the list of tokens is empty (#58116)
• Add a fix for the mac_service modules where it would fail to load in some new services and crash on Big Sur. (#58143)
• Fix blank tplfile context parameter when loading top level sls files (#58249)
• Do not include init directory in sls context parameters if explicitly specified (#58250)
• Fixing pillar caching when pillar environments are involved. (#58274)
• Make proxy_config read in the proxy specific configuration which is typically found in /etc/salt/proxy.d/minionid/. (#58307)
• Add timeout kwarg docs for service.running and service.dead (#58311)
• Return empty dict on win_pdh.get_counters rather than raising exception when no data are available (#58327)
• Leave boot parameters untouched if boot parameter is set to None in virt.update (#58331)
• Convert disks of volume type to file or block disks on Xen (#58333)
• Apparently Apple is using both "10.16" and "11" for versioning Big Sur, depending on where you look. The mac_softwareupdate module uses a different regex depending on OS version, and the determination was based on the osrelease_info grain. This results in a Big Sur machine not using the correct regex; osrelease_info[1] is 0 for Big Sur.
This change simply adds an additional clause to the if statement to handle osmajorrelease > 10. (#58340)
• Fixed zmq salt-call hang!
Some objects from the 3rd party module zmq fail to deconstruct if left to the GC when Python exits.  This is because the objects get destroyed out of order.  This only happens on some platforms like ubuntu 20.04 and some versions of FreeBSD.  We fixed this hang by deconstructing all zmq objects in the right order before we exit salt-call. (#58364)
• Reactor runner functions will now ensure reactor system is available before attempting to run and error out if it is not available. (#58384)
• Fix enpoint typos (#58416)
• Make sure we repopulate __utils__ on Windows when a job is run from the scheduler. (#58437)
• Adding a check when a source is an HTTP or FTP URL to do a query to ensure the URL is valid before returning, then we know if we need to move onto to the next source in the list or not. (#58441)
• Improved documentation for the LGPO state module (#58521)
• Remove old documented pending reboot key (#58530)
• On macOS, skip GUI dialog for Developer Command Line Tools when importing gitfs util. (#58575)
• Fixing a use case when multiple inotify beacons are defined but when notifications are fired the configuration from the first beacon are used. (#58655)
Added • salt-api will now work on Windows platforms with limited support. You will be able to configure the rest_cherrypy module, without pam external authentication and without ssl support.(#49949)
• Added execution_timeout support to chocolatey.installed state (#50449)
• Add new verify_ssl option to file modules. This allows a user to not validate the server certificate for HTTPS source and source hash's. (#52663)
• Added list target type support to the scan salt-ssh roster. (#52675)
• Added pvresize and lvextend to linux_lvm (#56089)
• Added COPR option to states.pkgrepo (#57258)
• Add "get_return" key for onlyif and unless requisites to parse deep module results (#57470)
• Allow setting VM boot devices order in virt.running and virt.defined states (#57544)
• Added grains to show the LVM Volume Groups and their Logical Volumes. (#57629)
• Memory Tuning Support which allows much greater control of memory allocation (#57639)
• Add output filter to saltcheck to only display test failures (#57788)
• Added an execution module for running idem exec modules
• Added a state module for running idem states (#57969)
• Added the ability for states to return sub_state_run's results frome external state engines (#57993)
• Added salt-cloud support for Linode APIv4 via the api_version provider configuration parameter. (#58093)
• Added support to manage services in Slackware Linux. (#58206)
• Added list_sources to chocolatey module to have an overview of the repositories present on the minions.  Added source_added to chocolatey state in order to add repositories to chocolatey. (#58588)
• Adding tests for changes to virtual function for netmiko module. Adding tests for netmiko proxy minion module. (#58609)
• Added features config option for feature flags. Added a feature flag enable_slsvars_fixes to enable fixes to tpldir, tplfile and sls_path. This flag will be depricated in the Phosphorus release when this functionality becomes the default. (#58652)
Salt 3002.1 Release Notes Version 3002.1 is a CVE fix release for 3002.
Fixed • Prevent shell injections in netapi ssh client (cve-2020-16846)
• Prevent creating world readable private keys with the tls execution module. (cve-2020-17490)
• Properly validate eauth credentials and tokens along with their ACLs. Prior to this change eauth was not properly validated when calling Salt ssh via the salt-api. Any value for 'eauth' or 'token' would allow a user to bypass authentication and make calls to Salt ssh. (CVE-2020-25592)
Salt 3002.2 Release Notes Version 3002.2 is a bugfix release for 3002.
Fixed • Change dict check to isinstance instead of type() for key_values in file.keyvalue. (#57758)
• Fail when func_ret is False when using the new module.run syntax. (#57768)
• Fix comparison of certificate values (#58296)
• When using ssh_pre_flight if there is a failure, fail on retcode not stderr. (#58439)
• Fix use of unauthd cached vmware service instance (#58691)
• Removing use of undefined varilable in utils/slack.py. (#58753)
• Restored the ability to specify the amount of extents for a Logical Volume as a percentage. (#58759)
• Ensuring that the version check function is run a second time in all the user related functions incase the user being managed is the connection user and the password has been updated. (#58773)
• Allow bytes in gpg renderer (#58794)
• Fix issue where win_wua module fails to load when BITS is set to Manual (#58848)
• Ensure that elasticsearch.index_exists is available before loading the elasticsearch returner. (#58851)
• Log a different object when debugging if we're using disk cache vs memory cache. The disk cache pillar class has the dict object but the cache pillar object which is used with the memory cache does not include a _dict obeject because it is a dict already. (#58861)
• Do not generate grains for every job run on Windows minions. This makes Windows conform more to the way posix OSes work today. (#58904)
• Fixes salt-ssh authentication when using tty (#58922)
• Revert LazyLoader finalizer. Removed the weakref.finalizer code. On some occasions, the finalized would run when trying to load a new module, firing a race condition. (#58947)
Salt 3002.3 Release Notes Version 3002.3 is a CVE fix release for 3002.
Fixed • CVE-2020-28243 - Fix local privilege escalation in the restartcheck module.
• CVE-2020-28972 - Ensure authentication to vcenter, vsphere, and esxi server validates the SSL/TLS certificate by default. If you want to skip SSL verification you can use verify_ssl: False.
• CVE-2020-35662 - Ensure the asam runner, qingcloud, splunk returner, panos proxy, cimc proxy, zenoss module, esxi module, vsphere module, glassfish module, bigip module, and keystone module validate SSL by default. If you want to skip SSL verification you can use verify_ssl: False.
• CVE-2021-3148 - Fix a command injection in the Salt-API when using the Salt-SSH client.
• CVE-2021-3144 - Fix eauth tokens can be used once after expiration
• CVE-2021-25281 - Fix salt-api so it honors eauth credentials for the wheel_async client.
• CVE-2021-25282 - Fix the salt.wheel.pillar_roots.write method so it is not vulnerable to directory traversal.
• CVE-2021-25283 - Fix the jinja render to protect against server side template injection attacks.
• CVE-2021-25284 - Fix cmdmod so it will not log credentials to log levels info and error.
• CVE-2021-3197 - Fix ssh client to remove ProxyCommand from arguments provided by cli and netapi.
Salt 3002.4 Release Notes Version 3002.4 is a bug fix release for 3002.
Fixed • Fix runners that broke when patching for CVE-2021-25281
• Fix issue with runners in SSE
Known Issue When using the Salt-API with the SSH client some of the SSH options are not working currently and will be fixed in an upcoming bug fix release. We are currently testing and fixing which options still need to be fixed, but have confirmed the following ones do not work in this release: extra-filerefs, pre-flight.  This does not impact normal Salt-SSH usage on the cli.
Salt 3002.5 Release Notes Version 3002.5 is a cve fix release for 3002.
Fixed • Tests and fix for CVE-2021-25283
Salt 3002.6 Release Notes Version 3002.6 is a bug fix release for 3002.
Changed • Store git sha in salt/_version.py when installing from a tag so it can be found if needed later. (#59137)
Fixed • Fix argument injection bug in restartcheck.restartcheck. This change hardens the fix for CVE-2020-28243. (#200)
• Allow all ssh kwargs as sanitized kwargs for SSH client. (#59748)
Salt 3002.7 (2021-08-20) Version 3002.7 is a CVE security fix release for 3002.
Fixed • Verify the owner of an existing config before trusting it during install. If the owner cannot be verified, back it up and use defaults. (CVE-2021-22004)
Security • Fix the CVE-2021-31607 vulnerability Additionally, an audit and a tool was put in place, bandit, to address similar issues througout the code base, and prevent them. (CVE-2021-31607)
Salt 3001 Release Notes - Codename Sodium Python 2 Dropped Python 2 support has been dropped in Salt 3001. See https://community.saltstack.com/blog/sunsetting-python-2-support/ for more info.
Salt mine updates Syntax update The syntax for defining salt functions in config or pillar files has changed to also support the syntax used in module.run.  The old syntax for the mine_function - as a dict, or as a list with dicts that contain more than exactly one key - is still supported but discouraged in favor of the more uniform syntax of module.run.
State updates The creates state requisite has been migrated from the docker_container and cmd states to become a global option. This acts similar to an equivalent unless: test -f filename but can also accept a list of filenames. This allows all states to take advantage of the enhanced functionality released in Neon, of allowing salt execution modules for requisite checks.
When using salt functions onlyif or unless requisites, a get_return key can now be used to specify a key to evaluate for truthiness. This can be used for execution modules which return status in a nested key.
test: test.nop: - name: foo - onlyif: - fun: consul.get consul_url: http://127.0.0.1:8500 key:  not-existing get_return: res
State Execution Module The state.test function can be used to test a state on a minion. This works by executing the state.apply function while forcing the test kwarg to True so that the state.apply function is not required to be called by the user directly. This also allows you to add the state.test function to a minion's minion_blackout_whitelist pillar if you wish to be able to test a state while a minion is in blackout.
New Grains systempath This grain provides the same information as the path grain, only formatted as a list of directories.
Salt-SSH updates ssh_pre_flight A new Salt-SSH roster option ssh_pre_flight has been added. This enables you to run a script before Salt-SSH tries to run any commands. You can set this option in the roster for a specific minion or use the roster_defaults to set it for all minions.
Example for setting ssh_pre_flight for specific host in roster file
minion1: host: localhost user: root passwd: P@ssword ssh_pre_flight: /srv/salt/pre_flight.sh
Example for setting ssh_pre_flight using roster_defaults, so all minions run this script.
roster_defaults: ssh_pre_flight: /srv/salt/pre_flight.sh
The ssh_pre_flight script will only run if the thin dir is not currently on the minion. If you want to force the script to run you have the following options:
• Wipe the thin dir on the targeted minion using the -w arg.
• Set ssh_run_pre_flight to True in the config.
set_path A new salt-ssh roster option set_path has been added. This allows you to set the path environment variable used to run the salt-ssh command on the target minion.  You can set this setting in your roster file like so:
minion1: host: localhost user: root passwd: P@ssword set_path: '$PATH:/usr/local/bin/'
auto_detect You can now auto detect the dependencies to be packed into the salt thin when using the ssh_ext_alternatives feature.
This new auto_detect option needs to be set to True in your ssh_ext_alternatives configuration.  Salt-ssh will attempt to auto detect the file paths required for the default dependencies to include in the thin. If you have a dependency already set in your configuration, it will not attempt to auto detect for that dependency.
You can also set the py_bin option to set the python binary to be used to auto detect the dependencies. If py_bin is not set, it will attempt to use the major Python version set in py-version. For example, if you set py-version to be [2, 7] it will attempt to find and use the python2 binary.
State Changes • Adding a new option for the State compiler, disabled_requisites will allow requisites to be disabled during State runs.
Salt Renderer updates A new renderer for toml files has been added.
#!jinja|toml
{% set myvar = "sometext" %}
[["some id"."test.nop"]] name = "{{ myvar }}" [["some id"."test.nop"]] txt = "hello" [["some id"."test.nop"]] "somekey" = "somevalue"
Execution Module updates Vault Module The vault module has been updated with the ability to cache generated tokens. By specifying uses and optionally ttl, the token generated on behalf of the minion will be allowed to persist and function for the defined time period or number of uses. Setting uses: 0 creates an unlimited use token, that is only constrained by the ttl.
vault: auth: uses: 25
This functionality is configured by default on the master and is thus shared behavior for all minion token generation.  To delegate use count to individual minions, specify allow_minion_override: True in the master config, and define uses and ttl in the minion config as directed above.
vault: auth: method: token allow_minion_override: True
Additionally, the vault module now supports Vault secrets backend version 2. The approperate secrets backend will be automatically detected, and cached in the same credentials file as long lived vault tokens mentioned above. For any configurations that worked around KV v2 handling by adding a manual data key to the end of vault lookups, salt['vault'].read_secret('secret/my/secret')['data'], these are automatically detected and will continue to function, but will generate a debug log message and can be removed.
The long lived token and secret metadata cache file can be cleared with the new vault.clear_token_cache execution function.
Salt 3001.1 Release Notes Version 3001.1 is a bugfix release for 3001.
Changed • Change the enable_fqdns_grains setting to default to False on Windows to address some issues with slowness. (#56296, #57529)
• Handle the UCRT libraries the same way they are handled in the Python 3 installer (#57594)
• Changes the 'SSDs' grain name to 'ssds' as all grains needs to be resolved in lowered case. (#57612)
Fixed • When running scheduled jobs from a proxy minion with multiprocessing turned off (default) a recursive error occurs as __pub_fun_args is repeated over and over again in the kwargs element in the data dictionary.  Now we make a copy of data['kwargs'] instead of using a reference. (#57941)
• The x509.certificate_managed state no longer triggers a change because of sorting issues if the certificate being evaluated was previously generated under Python 2. (#56556)
• Added support to lo ip alias in network.managed state by checking if lo inet data from network.interfaces contains label with the name of managed interface.  Return status True if match found. (#56901)
• Redact passwords in the return when setting credentials using win_iis.container_setting (#57285)
• Fixes issue with cmd.powershell. Some powershell commands do not return anything in stdout. This causes the JSON parser to fail because an empty string is not valid JSON. This changes an empty string to {} which is valid JSON and will not cause the JSON loader to stacktrace. (#57493)
• Improves performance. Profiling test.ping on Windows shows that 13 of 17 seconds are wasted when the esxi grain loads vsphere before noting that the OS is not a esxi host. (#57529)
• Fixed permissions issue with certain pip/virtualenv states/modules when configured for non-root user. (#57550)
• Allow running nox sessions either using our nox-py2 fork or upstream nox. (#57583)
• Fixes issue with lgpo.get when there are unicode characters in the hostname (#57591)
• Fixes issue with virtual block devices, like loopbacks and LVMs, wrongly populating the "disks" or "ssds" grains. (#57612)
• Due to some optimization the virtual grain was never updated on illumos. Move the fallback in prtdiag output parsing outside the loop that now gets skipped due to the command exiting non-zero. (#57714)
• Grains module delkey and delval methods now support the force option. This is needed for deleting grains with complex (nested) values. (#57718)
• Moving import salt.modules.vsphere into __virtual__ so we have access to test proxytype in opts, previously this was causing a traceback when run on proxy minion as __opts__ does not exist outside of any functions. Introducing a new utils function, is_proxytype, to check that the device is a proxy minion and also that the proxy type matches. (#57743)
• Fixed fail_with_changes in the test state to use the comment argument when passed. (#57766)
• Adds a fix so salt can run on the latest macOS version Big Sur. (#57787)
• Fixes UnpackValueError when using GPG cache by using atomic open. (#57798)
• The gid_from_name argument was removed from the user.present state in version 3001, with no deprecation path. It has been restored and put on a proper deprecation path. (#57843)
• Fixes dictionary being changed during iteration. (#57845)
Added • Added docs demonstrating how to apply an MSI patch with winrepo (#32780)
Salt 3001.2 Release Notes Version 3001.2 is a CVE fix release for 3001.
Salt 3001.3 Release Notes Version 3001.3 is a CVE fix release for 3001.
Fixed • Properly validate eauth credentials and tokens along with their ACLs. Prior to this change eauth was not properly validated when calling Salt ssh via the salt-api. Any value for 'eauth' or 'token' would allow a user to bypass authentication and make calls to Salt ssh. (CVE-2020-25592)
Salt 3001.4 Release Notes Version 3001.4 is a bugfix release for 3001.
Fixed • Fixes salt-ssh authentication when using tty (#58922)
Salt 3001.5 Release Notes Version 3001.5 is a CVE fix release for 3001.
Salt 3001.6 Release Notes Version 3001.6 is a bug fix release for 3001.
Salt 3001.7 Release Notes Version 3001.7 is a bug fix release for 3001.
Fixed • Allow "extra_filerefs" as sanitized kwargs for SSH client.  Fix regression on "cmd.run" when passing tuples as cmd. (#59664)
• Fix argument injection bug in restartcheck.restartcheck. This change hardens the fix for CVE-2020-28243.
Salt 3001.8 (2021-08-20) Version 3001.8 is a CVE security fix release for 3001.
Salt 3000 Release Notes - Codename Neon Security Advisory For historical reasons, Salt requires PyCrypto as a "lowest common denominator". However, PyCrypto is unmaintained and best practice is to manually upgrade to use a more maintained library such as PyCryptodome. See Issue #52674 and Issue #54115 for more info
New Versioning The neon release has removed the date versioning. Going forward we will use a non-date based version schema beginning at 3000. The version will be MAJOR.PATCH. For a planned release containing features and/or bug fixes the MAJOR version will be incremented. Please review the approved SEP for further details.
The new versioning scheme is PEP 440 compliant, but distutils.StrictVersion will result in an error invalid version number. If using StrictVersion to compare Salt's versions, please use LooseVersion. There is also the packaging library you can use to compare versions. Another alternative is using the salt version module
Python 3.8 Not Supported Please note that running Salt with Python 3.8 is currently not supported. It is recommended to not use a version higher than 3.7.
Vendored Tornado Code Base The Tornado code base has been included as salt.ext.tornado. This was done to provide a consistent version of Tornado across all operating systems while we continue to work on upgrading Tornado to a recent version. New code that uses Tornado should import the module from salt.ext.tornado instead of importing the system version of Tornado.
Msgpack 1.0.0rc1 Incompatibility Salt is currently incompatible with msgpack 1.0.0rc1. We recommend using versions < 1.0.0 . This impacts the Salt Master's ability to run commands against minions. Please see Issue 56007 for more details and updates.
Pip Installing Salt On Windows This release will not install correctly on windows when using pip to install salt.  This issue is addressed in PR 56099.  The workaround for this issue is:
pip install "pywin32==224" "WMI==1.4.9"
Those using the Salt Windows Installer are not affected by this issue.
Saltcheck Updates Available since 2018.3, the saltcheck module has been enhanced to:
• Support saltenv environments
• Associate tests with states by naming convention
• Adds report_highstate_tests function
• Adds empty and notempty assertions
• Adds skip keyword
• Adds print_result keyword
• Adds assertion_section keyword
• Use saltcheck.state_apply to run state.apply for test setup or teardown
• Changes output to display test time
• Works with salt-ssh
Usage Example file system layout:
Example Tests {# will run the common salt state before further testing #} setup_test_environment: module_and_function: saltcheck.state_apply args: - common pillar-data: data: value
{% for package in ["apache2", "openssh"] %} {# or another example #} {# for package in salt['pillar.get']("packages") #} jinja_test_{{ package }}_latest: module_and_function: pkg.upgrade_available args: - {{ package }} assertion: assertFalse {% endfor %}
validate_user_present_and_shell: module_and_function: user.info args: - root assertion: assertEqual expected-return: /bin/bash assertion_section: shell print_result: False
skip_test: module_and_function: pkg.upgrade_available args: - apache2 assertion: assertFalse skip: True
Output Format Changes Saltcheck output has been enhanced to display the time taken per test. This results in a change to the output format.
Previous Output:
local: |_ ---------- ntp: ---------- ntp-client-installed: Pass ntp-service-status: Pass |_ ---------- TEST RESULTS: ---------- Failed: 0 Missing Tests: 0 Passed: 2
New output:
local: |_ ---------- ntp: ---------- ntp-client-installed: ---------- duration: 1.0408 status: Pass ntp-service-status: ---------- duration: 1.464 status: Pass |_ ---------- TEST RESULTS: ---------- Execution Time: 2.5048 Failed: 0 Missing Tests: 0 Passed: 2 Skipped: 0
Unless and onlyif Enhancements The unless and onlyif requisites can now be operated with salt modules. The dictionary must contain an argument fun which is the module that is being run, and everything else must be passed in under the args key or will be passed as individual kwargs to the module function.
NOTE: Certain states have an unless/onlyif implementation that predates this feature, and may not work as expected:
• states.git
• states.cmd
• states.macpackage
• states.file
• states.docker_container
check external ip address: http.query: - name: https://icanhazip.com - status: 200 - onlyif: - fun: file.file_exists path: /usr/local/bin/whatever
check another ip address: http.query: - name: https://icanhazip.com - status: 200 - onlyif: - test -f /tmp/fnord.txt
Keystore State and Module A new state and execution module for manaing Java Keystore files is now included. It allows for adding/removing/listing as well as managing keystore files.
# salt-call keystore.list /path/to/keystore.jks changeit local: |_ ---------- alias: hostname1 expired: True sha1: CB:5E:DE:50:57:99:51:87:8E:2E:67:13:C5:3B:E9:38:EB:23:7E:40 type: TrustedCertEntry valid_start: August 22 2012 valid_until: August 21 2017
define_keystore: keystore.managed: - name: /tmp/statestore.jks - passphrase: changeit - force_remove: True - entries: - alias: hostname1 certificate: /tmp/testcert.crt - alias: remotehost certificate: /tmp/512.cert private_key: /tmp/512.key - alias: stringhost certificate: | -----BEGIN CERTIFICATE----- MIICEjCCAX Hn+GmxZA -----END CERTIFICATE-----
XML Module A new state and execution module for editing XML files is now included. Currently it allows for editing values from an xpath query, or editing XML IDs.
# salt-call xml.set_attribute /tmp/test.xml ".//actor[@id='3']" editedby "Jane Doe" local: True # salt-call xml.get_attribute /tmp/test.xml ".//actor[@id='3']" local: ---------- editedby: Jane Doe id: 3 # salt-call xml.get_value /tmp/test.xml ".//actor[@id='2']" local: Liam Neeson # salt-call xml.set_value /tmp/test.xml ".//actor[@id='2']" "Patrick Stewart" local: True # salt-call xml.get_value /tmp/test.xml ".//actor[@id='2']" local: Patrick Stewart
ensure_value_true: xml.value_present: - name: /tmp/test.xml - xpath: .//actor[@id='1'] - value: William Shatner
LGPO Execution Module Multiple fixes were made to the win_lgpo to expand support for additional policies and improve performance. Issues with encoding and unsupported characters (smart-quotes, em-dash, etc) found in the ADML files as well as whitespace in some policies have been addressed.
Speed enhancements include:
• Caching the compiled xml from ADMX/ADML files in __context__
• Lowercasing all keys before compiling XML to remove an expensive XPath lookup
Additional functionality:
• Adds the lgpo.get_policy function that allows you to get the current settings for a single policy.
• Changes some policy names that were overly long
LGPO State Module Multiple changes were made to the win_lgpo state to improve performance.
It now uses the lgpo.get_policy function instead of the lgpo.get to avoid reloading all settings on the machine at the beginning and end of each state run.
Supports the new shorter policy names but also attempts to resolve the older, longer policy names.
Win_network Salt Util Now uses .NET libraries to obtain Interface information on Windows systems that support it. Unsupported systems fall back to the more expensive WMI calls. This is important as this data is gathered for grains and occurs each time a process is forked.
Jinja enhancements Troubleshooting Jinja map files A new execution module for map.jinja troubleshooting has been added.
Assuming the map is loaded in your formula SLS as follows:
{% from "myformula/map.jinja" import myformula with context %}
The following command can be used to load the map and check the results:
salt myminion jinja.load_map myformula/map.jinja myformula
The module can be also used to test json and yaml maps:
salt myminion jinja.import_yaml myformula/defaults.yaml
salt myminion jinja.import_json myformula/defaults.json
json_query filter A port of Ansible json_query Jinja filter has been added. It allows making queries against JSON data using JMESPath language. Could be used to filter pillar data, yaml maps, and also useful with http_query.
Depends on the jmespath Python module.
Slot Syntax Updates The slot syntax has been updated to support parsing dictionary responses and to append text.
demo dict parsing and append: test.configurable_test_state: - name: slot example - changes: False - comment: __slot__:salt:test.arg(shell="/bin/bash").kwargs.shell ~ /appended
local: ---------- ID: demo dict parsing and append Function: test.configurable_test_state Name: slot example Result: True Comment: /bin/bash/appended Started: 09:59:58.623575 Duration: 1.229 ms Changes:
Also, slot parsing is now supported inside of nested state data structures (dicts, lists, unless/onlyif args):
demo slot parsing for nested elements: file.managed: - name: /tmp/slot.txt - source: salt://slot.j2 - template: jinja - context: # Slot inside of the nested context dictionary variable: __slot__:salt:test.echo(a_value) - unless: - fun: file.search args: # Slot as unless argument - __slot__:salt:test.echo(/tmp/slot.txt) - "DO NOT OVERRIDE" ignore_if_missing: True
State Changes • The file.symlink state was fixed to remove existing file system entries other than files, directories and symbolic links properly.
• The onchanges and prereq requisites now behave properly in test mode, due to removing pchanges.
• Added new ssh_auth.manage state to ensure only the specified ssh keys are present for the specified user.
• Added new saltutil state to use instead of module.run to more easily handle change.
Module Changes • Added new boto_ssm module to set and query secrets in AWS SSM parameters.
• Added new flatpak module to work with flatpak packages.
• The file.remove module was fixed to remove file system entries other than files, directories and symbolic links properly.
• The debian_ip module used by the network.managed state has been heavily refactored. The order that options appear in inet/inet6 blocks may produce cosmetic changes. Many options without an 'ipvX' prefix will now be shared between inet and inet6 blocks. The options enable_ipv4 and enabled_ipv6 will now fully remove relevant inet/inet6 blocks. Overriding options by prefixing them with 'ipvX' will now work with most options (i.e.  dns can be overridden by ipv4dns or ipv6dns). The proto option is now required.
Enhancements to Engines Multiple copies of a particular Salt engine can be configured by including the engine_module parameter in the engine configuration.
• A new fluent engine has been added to export Salt events to fluentd.
engines: - fluent host: localhost port: 24224
<source> @type forward port 24224 </source> <match saltstack.**> @type file path /var/log/td-agent/saltstack </match>
Enhancements to Beacons Multiple copies of a particular Salt beacon can be configured by including the beacon_module parameter in the beacon configuration.
beacons: watch_importand_file: - files: /etc/important_file: {} - beacon_module: inotify watch_another_file: - files: /etc/another_file: {} - beacon_module: inotify
Enhancements to chroot • New functions added to chroot apply, sls, and highstate that allow executing states in sls files or running apply/highstate inside of a chroot.
Minion-side ACL Salt has had master-side ACL for the salt mine for some time, where the master configuration contained mine_get that specified which minions could request which functions. However, now you can specify which minions can access a function in the salt mine function definition itself (or when calling mine.send).  This targeting works the same as the generic minion targeting as specified here. The parameters used are allow_tgt and allow_tgt_type.  See also the documentation of the Salt Mine. Please note that if you want to use this new feature both your minion and masters will need to be on atleast version 3000.
Deprecations Raet Deprecated • The Raet transport has been deprecated. Please use the supported transport protocols tcp or zeromq.
Module Deprecations • The hipchat module has been removed due to the service being retired. Google Chat, MS Teams, or Slack may be suitable replacements.
• The dockermod module has been changed as follows:
• Support for the tags kwarg has been removed from the dockermod.resolve_tag function.
• Support for the network_id kwarg has been removed from the dockermod.connect_container_to_network function. Please use net_id instead.
• Support for the name kwarg has been removed from the dockermod.sls_build function. Please use repository and tag instead.
• Support for the image kwarg has been removed from the following functions. In all cases, please use both the repository and tag options instead:
• dockermod.build
• dockermod.commit
• dockermod.import
• dockermod.load
• dockermod.tag
• The heat module has removed the enviroment kwarg from the heat.create_stack and heat.update_stack functions due to a spelling error. Please use environment instead.
• The ssh execution module has been changed as follows:
• Support for the ssh.get_known_host function has been removed. Please use the ssh.get_known_host_entries function instead.
• Support for the ssh.recv_known_host function has been removed. Please use the ssh.recv_known_host_entries function instead.
• The :py:mod`firewalld <salt.modules.firewalld>` module has been changed as follows:
• The default setting for the force_masquerade option in the firewalld.add_port <salt.module.firewalld.add_port() function has changed from True to False.
• Support for the force_masquerade option in the firewalld.add_port_fwd <salt.module.firewalld.add_port_fwd() function has been changed from True to False.
State Deprecations • The hipchat state has been removed due to the service being retired. MS Teams or Slack may be suitable replacements.
• The cmd state module has removed the quiet kwarg from the cmd.run function. Please set output_loglevel to quiet instead.
• The heat state module has removed the enviroment kwarg from the heat.deployed function due to a spelling error. Please use environment instead.
• The :py:mod`firewalld <salt.states.firewalld>` state has been changed as follows:
• The default setting for the prune_services option in the firewalld.present function has changed from True to False.
Fileserver Deprecations • The hgfs fileserver had the following config options removed:
• The hgfs_env_whitelist config option has been removed in favor of hgfs_saltenv_whitelist.
• The hgfs_env_blacklist config option has been removed in favor of hgfs_saltenv_blacklist.
• The svnfs fileserver had the following config options removed:
• The svnfs_env_whitelist config option has been removed in favor of svnfs_saltenv_whitelist.
• The svnfs_env_blacklist config option has been removed in favor of svnfs_saltenv_blacklist.
• The gitfs fileserver had the following config options removed:
• The gitfs_env_whitelist config option has been removed in favor of gitfs_saltenv_whitelist.
• The gitfs_env_blacklist config option has been removed in favor of gitfs_saltenv_blacklist.
Engine Removal • The hipchat engine has been removed due to the service being retired. For users migrating to Slack, the slack engine may be a suitable replacement.
Returner Removal • The hipchat returner has been removed due to the service being retired. For users migrating to Slack, the slack returner may be a suitable replacement.
Grain Deprecations For smartos some grains have been deprecated. These grains have been removed.
• The hypervisor_uuid has been replaced with mdata:sdc:server_uuid grain.
• The datacenter has been replaced with mdata:sdc:datacenter_name grain.
Cloud Deprecations • The nova cloud driver has been removed in favor of the openstack cloud driver.
Jinja Filter Deprecations • The following jinja filters are set to be removed in the 3003 release:
• json_decode_dict in favor of tojson
• json_decode_list in favor of tojson
Utils Deprecations • All of the functions in salt.utils.__init__.py have been removed. These include:
• salt.utils.option
• salt.utils.required_module_list
• salt.utils.required_modules_error
• salt.utils.get_accumulator_dir. Please use salt.state.get_accumulator_dir() instead.
• salt.utils.fnmatch_multiple. Please use salt.utils.itertools.fnmatch_multiple() instead.
• salt.utils.appendproctitle. Please use salt.utils.process.appendproctitle() instead.
• salt.utils.daemonize. Please use salt.utils.process.daemonize() instead.
• salt.utils.daemonize_if. Please use salt.utils.process.daemonize_if() instead.
• salt.utils.reinit_crypto. Please use salt.utils.crypt.reinit_crypto() instead.
• salt.utils.pem_finger. Please use salt.utils.crypt.pem_finger() instead.
• salt.utils.to_bytes. Please use salt.utils.stringutils.to_bytes() instead.
• salt.utils.to_str. Please use salt.utils.stringutils.to_str() instead.
• salt.utils.to_unicode. Please use salt.utils.stringutils.to_unicode() instead.
• salt.utils.str_to_num. Please use salt.utils.stringutils.to_num() instead.
• salt.utils.is_quoted. Please use salt.utils.stringutils.is_quoted() instead.
• salt.utils.dequote. Please use salt.utils.stringutils.dequote() instead.
• salt.utils.is_hex. Please use salt.utils.stringutils.is_hex() instead.
• salt.utils.is_bin_str. Please use salt.utils.stringutils.is_binary() instead.
• salt.utils.rand_string. Please use salt.utils.stringutils.random() instead.
• salt.utils.contains_whitespace. Please use salt.utils.stringutils.contains_whitespace() instead.
• salt.utils.build_whitespace_split_regex. Please use salt.utils.stringutils.build_whitespace_split_regex() instead.
• salt.utils.expr_match. Please use salt.utils.stringutils.expr_match() instead.
• salt.utils.check_whitelist_blacklist. Please use salt.utils.stringutils.check_whitelist_blacklist() instead.
• salt.utils.check_include_exclude.Please use salt.utils.stringutils.check_include_exclude() instead.
• salt.utils.print_cli.Please use salt.utils.stringutils.print_cli() instead.
• salt.utils.clean_kwargs.Please use salt.utils.args.clean_kwargs() instead.
• salt.utils.invalid_kwargs.Please use salt.utils.args.invalid_kwargs() instead.
• salt.utils.shlex_split.Please use salt.utils.args.shlex_split() instead.
• salt.utils.arg_lookup.Please use salt.utils.args.arg_lookup() instead.
• salt.utils.argspec_report.Please use salt.utils.args.argspec_report() instead.
• salt.utils.split_input.Please use salt.utils.args.split_input() instead.
• salt.utils.test_mode.Please use salt.utils.args.test_mode() instead.
• salt.utils.format_call.Please use salt.utils.args.format_call() instead.
• salt.utils.which.Please use salt.utils.path.which() instead.
• salt.utils.which_bin.Please use salt.utils.path.which_bin() instead.
• salt.utils.path_join.Please use salt.utils.path.join() instead.
• salt.utils.check_or_die.Please use salt.utils.path.check_or_die() instead.
• salt.utils.sanitize_win_path_string.Please use salt.utils.path.sanitize_win_path() instead.
• salt.utils.rand_str.Please use salt.utils.hashutils.random_hash() instead.
• salt.utils.get_hash.Please use salt.utils.hashutils.get_hash() instead.
• salt.utils.is_windows.Please use salt.utils.platform.is_windows() instead.
• salt.utils.is_proxy.Please use salt.utils.platform.is_proxy() instead.
• salt.utils.is_linux.Please use salt.utils.platform.is_linux() instead.
• salt.utils.is_darwin.Please use salt.utils.platform.is_darwin() instead.
• salt.utils.is_sunos.Please use salt.utils.platform.is_sunos() instead.
• salt.utils.is_smartos.Please use salt.utils.platform.is_smartos() instead.
• salt.utils.is_smartos_globalzone.Please use salt.utils.platform.is_smartos_globalzone() instead.
• salt.utils.is_smartos_zone.Please use salt.utils.platform.is_smartos_zone() instead.
• salt.utils.is_freebsd.Please use salt.utils.platform.is_freebsd() instead.
• salt.utils.is_netbsd.Please use salt.utils.platform.is_netbsd() instead.
• salt.utils.is_openbsd.Please use salt.utils.platform.is_openbsd() instead.
• salt.utils.is_aix.Please use salt.utils.platform.is_aix() instead.
• salt.utils.safe_rm.Please use salt.utils.files.safe_rm() instead.
• salt.utils.is_empty.Please use salt.utils.files.is_empty() instead.
• salt.utils.fopen.Please use salt.utils.files.fopen() instead.
• salt.utils.flopen.Please use salt.utils.files.flopen() instead.
• salt.utils.fpopen.Please use salt.utils.files.fpopen() instead.
• salt.utils.rm_rf.Please use salt.utils.files.rm_rf() instead.
• salt.utils.mkstemp.Please use salt.utils.files.mkstemp() instead.
• salt.utils.istextfile.Please use salt.utils.files.is_text_file() instead.
• salt.utils.is_bin_file.Please use salt.utils.files.is_binary() instead.
• salt.utils.list_files.Please use salt.utils.files.list_files() instead.
• salt.utils.safe_walk.Please use salt.utils.files.safe_walk() instead.
• salt.utils.st_mode_to_octal.Please use salt.utils.files.st_mode_to_octal() instead.
• salt.utils.normalize_mode.Please use salt.utils.files.normalize_mode() instead.
• salt.utils.human_size_to_bytes.Please use salt.utils.files.human_size_to_bytes() instead.
• salt.utils.backup_minion.Please use salt.utils.files.backup_minion() instead.
• salt.utils.str_version_to_evr.Please use salt.utils.pkg.rpm.version_to_evr() instead.
• salt.utils.parse_docstring.Please use salt.utils.doc.parse_docstring() instead.
• salt.utils.compare_versions.Please use salt.utils.versions.compare() instead.
• salt.utils.version_cmp.Please use salt.utils.versions.version_cmp() instead.
• salt.utils.warn_until.Please use salt.utils.versions.warn_until() instead.
• salt.utils.kwargs_warn_until.Please use salt.utils.versions.kwargs_warn_until() instead.
• salt.utils.get_color_theme.Please use salt.utils.color.get_color_theme() instead.
• salt.utils.get_colors.Please use salt.utils.color.get_colors() instead.
• salt.utils.gen_state_tag.Please use salt.utils.state.gen_tag() instead.
• salt.utils.search_onfail_requisites.Please use salt.utils.state.search_onfail_requisites() instead.
• salt.utils.check_onfail_requisites.Please use salt.utils.state.check_onfail_requisites() instead.
• salt.utils.check_state_result.Please use salt.utils.state.check_result() instead.
• salt.utils.get_user.Please use salt.utils.user.get_user() instead.
• salt.utils.get_uid.Please use salt.utils.user.get_uid() instead.
• salt.utils.get_specific_user.Please use salt.utils.user.get_specific_user() instead.
• salt.utils.chugid.Please use salt.utils.user.chugid() instead.
• salt.utils.chugid_and_umask.Please use salt.utils.user.chugid_and_umask() instead.
• salt.utils.get_default_group.Please use salt.utils.user.get_default_group() instead.
• salt.utils.get_group_list.Please use salt.utils.user.get_group_list() instead.
• salt.utils.get_group_dict.Please use salt.utils.user.get_group_dict() instead.
• salt.utils.get_gid_list.Please use salt.utils.user.get_gid_list() instead.
• salt.utils.get_gid.Please use salt.utils.user.get_gid() instead.
• salt.utils.enable_ctrl_logoff_handler.Please use salt.utils.win_functions.enable_ctrl_logoff_handler() instead.
• salt.utils.traverse_dict.Please use salt.utils.data.traverse_dict() instead.
• salt.utils.traverse_dict_and_list.Please use salt.utils.data.traverse_dict_and_list() instead.
• salt.utils.filter_by.Please use salt.utils.data.filter_by() instead.
• salt.utils.subdict_match.Please use salt.utils.data.subdict_match() instead.
• salt.utils.substr_in_list.Please use salt.utils.data.substr_in_list() instead.
• salt.utils.is_dictlist.Please use salt.utils.data.is_dictlist() instead.
• salt.utils.repack_dictlist.Please use salt.utils.data.repack_dictlist() instead.
• salt.utils.compare_dicts.Please use salt.utils.data.compare_dicts() instead.
• salt.utils.compare_lists.Please use salt.utils.data.compare_lists() instead.
• salt.utils.decode_dict.Please use salt.utils.data.encode_dict() instead.
• salt.utils.decode_list.Please use salt.utils.data.encode_list() instead.
• salt.utils.exactly_n.Please use salt.utils.data.exactly_n() instead.
• salt.utils.exactly_one.Please use salt.utils.data.exactly_one() instead.
• salt.utils.is_list.Please use salt.utils.data.is_list() instead.
• salt.utils.is_iter.Please use salt.utils.data.is_iter() instead.
• salt.utils.isorted.Please use salt.utils.data.sorted_ignorecase() instead.
• salt.utils.is_true.Please use salt.utils.data.is_true() instead.
• salt.utils.mysql_to_dict.Please use salt.utils.data.mysql_to_dict() instead.
• salt.utils.simple_types_filter.Please use salt.utils.data.simple_types_filter() instead.
• salt.utils.ip_bracket.Please use salt.utils.zeromq.ip_bracket() instead.
• salt.utils.gen_mac.Please use salt.utils.network.gen_mac() instead.
• salt.utils.mac_str_to_bytes.Please use salt.utils.network.mac_str_to_bytes() instead.
• salt.utils.refresh_dns.Please use salt.utils.network.refresh_dns() instead.
• salt.utils.dns_check.Please use salt.utils.network.dns_check() instead.
• salt.utils.get_context.Please use salt.utils.stringutils.get_context() instead.
• salt.utils.get_master_key.Please use salt.utils.master.get_master_key() instead.
• salt.utils.get_values_of_matching_keys.Please use salt.utils.master.get_values_of_matching_keys() instead.
• salt.utils.date_cast.Please use salt.utils.dateutils.date_cast() instead.
• salt.utils.date_format.Please use salt.utils.dateutils.strftime() instead.
• salt.utils.total_seconds.Please use salt.utils.dateutils.total_seconds() instead.
• salt.utils.find_json.Please use salt.utils.json.find_json() instead.
• salt.utils.import_json.Please use salt.utils.json.import_json() instead.
• salt.utils.namespaced_function.Please use salt.utils.functools.namespaced_function() instead.
• salt.utils.alias_function.Please use salt.utils.functools.alias_function() instead.
• salt.utils.profile_func.Please use salt.utils.profile.profile_func() instead.
• salt.utils.activate_profile.Please use salt.utils.profile.activate_profile() instead.
• salt.utils.output_profile.Please use salt.utils.profile.output_profile() instead.
salt.auth.Authorize Class Removal • The salt.auth.Authorize Class inside of the salt/auth/__init__.py file has been removed and the any_auth method inside of the file salt/utils/minions.py. These method and classes were not being used inside of the salt code base.
Salt 3000.1 Release Notes Version 3000.1 is a bugfix release for 3000.
Statistics • Total Merges: 53
• Total Issue References: 15
• Total PR References: 54
• Contributors: 16 (Ch3LL, UtahDave, bryceml, cmcmarrow, dwoz, frogunder, garethgreenaway, lorengordon, mchugh19, oeuftete, raddessi, s0undt3ch, sjorge, terminalmage, twangboy, waynew)
Changelog for v3000..v3000.1 Generated at: 2020-03-27 16:48:41 UTC
• PR #56455: (s0undt3ch) Fix gitpython windows requirement @ 2020-03-27 16:31:57 UTC
• c5a700e01e Merge pull request #56455 from s0undt3ch/hotfix/gitpython
• d9791c393f Revert and fix windows requirements
• 4b573c1c94 Revert "Fix win deps"
• PR #56446: (frogunder) 3000.1 releasenotes updates @ 2020-03-24 20:28:23 UTC
• 7ba36325d9 Merge pull request #56446 from frogunder/releasenotes_3000.1_updates
• 6b47f474af 3000.1 releasenotes updates
• PR #56435: (twangboy) Update mac build scripts @ 2020-03-24 19:47:40 UTC
• 4d2bc7004d Merge pull request #56435 from twangboy/update_mac_build_scripts
• 5d244b0aa6 Merge branch 'master' into update_mac_build_scripts
• 8fdf52a243 Update gitpython to 2.1.15
• afcedc5232 Remove --ignore-installed
• e6cc2a6192 Separate pyobjc requirements
• 262ad2e98a Compile static requirements
• 224f72d0f2 Update noxfile and .precommit
• 68a36f2e37 Add req_ext.txt
• 5851a5c2cd Roll back changes, fix dependencies
• ISSUE #56433: (Ch3LL) integration.states.test_pip_state.PipStateTest.test_pip_installed_specific_env failing on MAC (refs: #56436)
• PR #56436: (Ch3LL) Fix #56433 - test_pip_installed_specific_env @ 2020-03-24 19:47:20 UTC
• 8a8ae8ebe4 Merge pull request #56436 from Ch3LL/pip_custom_pypi
• 55655ff96c Merge branch 'master' into pip_custom_pypi
• PR #56423: (Ch3LL) Update changelog with package fixes @ 2020-03-24 16:42:17 UTC
• 3a993d73a9 Merge pull request #56423 from Ch3LL/changelog_again
• 963c16e1a7 update pr number for mac build changes in changelog
• 83e22b77c7 Update changelog with package fixes
• PR #56417: (twangboy) Update mac build scripts @ 2020-03-23 18:45:34 UTC
• d2a5bd8add Merge pull request #56417 from twangboy/update_mac_build_scripts
• 3bda8ddb82 Update noxfile and pre-commit