neulab/tldr huggingface dataset:
ipv6_address_mode IPv6 address mode.  Valid values are: ‘dhcpv6-stateful’, ‘dhcpv6-stateless’, or ‘slaac’.
salt.states.nexus This state downloads artifacts from Nexus 3.x.
salt.states.nexus.downloaded(name, artifact, target_dir='/tmp', target_file=None) Ensures that the artifact from nexus exists at given location. If it doesn't exist, then it will be downloaded. If it already exists then the checksum of existing file is checked against checksum in nexus. If it is different then the step will fail.
artifact Details of the artifact to be downloaded from nexus. Various options are:
• nexus_url: URL of the nexus instance
• repository: Repository in nexus
• classifier: Classifier
• username: nexus username
• password: nexus password
target_file Target file to download artifact to. By default file name is resolved by nexus.
jboss_module_downloaded: nexus.downloaded: - artifact: nexus_url: http://nexus.intranet.example.com/repository repository: 'libs-release-local' artifact_id: 'module' group_id: 'com.company.module' packaging: 'jar' classifier: 'sources' version: '1.0' - target_file: /opt/jboss7/modules/com/company/lib/module.jar
maven_artifact_downloaded: nexus.downloaded: - artifact: nexus_url: http://nexus.intranet.example.com/repository repository: 'maven-releases' artifact_id: 'module' group_id: 'com.company.module' packaging: 'zip' classifier: 'dist' version: '1.0' - target_dir: /opt/maven/modules/com/company/release
salt.states.nfs_export Management of NFS exports New in version 2018.3.0.
To ensure an NFS export exists:
add_simple_export: nfs_export.present: - name:     '/srv/nfs' - hosts:    '10.0.2.0/24' - options: - 'rw'
This creates the following in /etc/exports:
/srv/nfs 10.0.2.0/24(rw)
For more complex exports with multiple groups of hosts, use 'clients':
add_complex_export: nfs_export.present: - name: '/srv/nfs' - clients: # First export, same as simple one above - hosts: '10.0.2.0/24' options: - 'rw' # Second export - hosts: '*.example.com' options: - 'ro' - 'subtree_check'
/srv/nfs 10.0.2.0/24(rw) 192.168.0.0/24,172.19.0.0/16(ro,subtree_check)
Any export of the given path will be modified to match the one specified.
To ensure an NFS export is absent:
delete_export: nfs_export.absent: - name: '/srv/nfs'
salt.states.nfs_export.absent(name, exports='/etc/exports') Ensure that the named path is not exported
name   The export path to remove
salt.states.nfs_export.present(name, clients=None, hosts=None, options=None, exports='/etc/exports') Ensure that the named export is present with the given options
name   The export path to configure
clients A list of hosts and the options applied to them.  This option may not be used in combination with the 'hosts' or 'options' shortcuts.
- clients: # First export - hosts: '10.0.2.0/24' options: - 'rw' # Second export - hosts: '*.example.com' options: - 'ro' - 'subtree_check'
hosts  A string matching a number of hosts, for example:
hosts: '10.0.2.123'
hosts: '10.0.2.0/24'
hosts: 'minion1.example.com'
hosts: '*.example.com'
hosts: '*'
options A list of NFS options, for example:
options: - 'rw' - 'subtree_check'
salt.states.nftables Management of nftables This is an nftables-specific module designed to manage Linux firewalls. It is expected that this state module, and other system-specific firewall states, may at some point be deprecated in favor of a more generic firewall state.
httpd: nftables.append: - table: filter - chain: input - jump: accept - match: state - connstate: new - dport: 80 - proto: tcp - sport: 1025:65535 - save: True
httpd: nftables.append: - table: filter - family: ipv6 - chain: INPUT - jump: ACCEPT - match: state - connstate: NEW - dport: 80 - proto: tcp - sport: 1025:65535 - save: True
httpd: nftables.insert: - position: 1 - table: filter - chain: INPUT - jump: ACCEPT - match: state - connstate: NEW - dport: 80 - proto: tcp - sport: 1025:65535 - save: True
httpd: nftables.insert: - position: 1 - table: filter - family: ipv6 - chain: INPUT - jump: ACCEPT - match: state - connstate: NEW - dport: 80 - proto: tcp - sport: 1025:65535 - save: True
httpd: nftables.delete: - table: filter - chain: INPUT - jump: ACCEPT - match: state - connstate: NEW - dport: 80 - proto: tcp - sport: 1025:65535 - save: True
httpd: nftables.delete: - position: 1 - table: filter - chain: INPUT - jump: ACCEPT - match: state - connstate: NEW - dport: 80 - proto: tcp - sport: 1025:65535 - save: True
httpd: nftables.delete: - table: filter - family: ipv6 - chain: INPUT - jump: ACCEPT - match: state - connstate: NEW - dport: 80 - proto: tcp - sport: 1025:65535 - save: True
output: nftables.chain_present: - family: ip - table: filter
output: nftables.chain_absent: - family: ip - table: filter
salt.states.nftables.append(name, family='ipv4', **kwargs) New in version 0.17.0.
Append a rule to a chain
All other arguments are passed in with the same name as the long option that would normally be used for nftables, with one exception: --state is specified as connstate instead of state (not to be confused with ctstate).
salt.states.nftables.chain_absent(name, table='filter', family='ipv4') New in version 2014.7.0.
salt.states.nftables.chain_present(name, table='filter', table_type=None, hook=None, priority=None, family='ipv4') New in version 2014.7.0.
Verify a chain exists in a table.
salt.states.nftables.delete(name, family='ipv4', **kwargs) New in version 2014.7.0.
salt.states.nftables.flush(name, family='ipv4', ignore_absence=False, **kwargs) New in version 2014.7.0.
Flush current nftables state
ignore_absence If set to True, attempts to flush a non-existent table will not result in a failed state.
salt.states.nftables.insert(name, family='ipv4', **kwargs) New in version 2014.7.0.
salt.states.nftables.set_policy(name, table='filter', family='ipv4', **kwargs) New in version 3002.
Sets the default policy for nftables chains
policy The requested table policy (accept or drop)
save   Boolean to save the in-memory nftables settings to a file.
save_filename The filename to save the nftables settings (default: /etc/nftables or /etc/nftables/salt-all-in-one.nft if the former is a directory)
salt.states.nftables.table_absent(name, family='ipv4', **kwargs) New in version 3002.
Ensure an nftables table is absent
name   Name of the table to ensure is absent
salt.states.nftables.table_present(name, family='ipv4', **kwargs) New in version 3002.
Ensure an nftables table is present
name   A user-defined table name.
salt.states.npm Installation of NPM Packages These states manage the installed packages for node.js using the Node Package Manager (npm). Note that npm must be installed for these states to be available, so npm states should include a requisite to a pkg.installed state for the package which provides npm (simply npm in most cases). Example:
npm: pkg.installed
yaml: npm.installed: - require: - pkg: npm
salt.states.npm.bootstrap(name, user=None, silent=True) Bootstraps a node.js application.
Will execute 'npm install --json' on the specified directory.
user   The user to run NPM with
salt.states.npm.cache_cleaned(name=None, user=None, force=False) Ensure that the given package is not cached.
If no package is specified, this ensures the entire cache is cleared.
name   The name of the package to remove from the cache, or None for all packages
salt.states.npm.installed(name, pkgs=None, dir=None, user=None, force_reinstall=False, registry=None, env=None) Verify that the given package is installed and is at the correct version (if specified).
coffee-script: npm.installed: - user: someuser
coffee-script@1.0.1: npm.installed: []
Changed in version 2014.7.2: This parameter is no longer lowercased by salt so that case-sensitive NPM package names will work.
pkgs   A list of packages to install with a single npm invocation; specifying this argument will ignore the name argument
registry The NPM registry from which to install the package
force_reinstall Install the package even if it is already installed
salt.states.npm.removed(name, dir=None, user=None) Verify that the given package is not installed.
salt.states.ntp Management of NTP servers New in version 2014.1.0.
This state is used to manage NTP servers. Currently only Windows is supported.
win_ntp: ntp.managed: - servers: - pool.ntp.org - us.pool.ntp.org
salt.states.ntp.managed(name, servers=None) Manage NTP servers
servers A list of NTP servers
salt.states.nxos State module for Cisco NX-OS Switch Proxy and Native minions
salt.states.nxos.config_absent(name) Ensure a specific configuration line does not exist in the running config
name   config line to remove
add snmp group: nxos.config_absent: - names: - snmp-server community randoSNMPstringHERE group network-operator - snmp-server community AnotherRandomSNMPSTring group network-admin
NOTE: For certain cases extra lines could be removed based on dependencies.  In this example, included after the example for config_present, the ACLs would be removed because they depend on the existence of the group.
salt.states.nxos.config_present(name) Ensure a specific configuration line exists in the running config
name   config line to set
add snmp group: nxos.config_present: - names: - snmp-server community randoSNMPstringHERE group network-operator - snmp-server community AnotherRandomSNMPSTring group network-admin
add snmp acl: nxos.config_present: - names: - snmp-server community randoSNMPstringHERE use-acl snmp-acl-ro - snmp-server community AnotherRandomSNMPSTring use-acl snmp-acl-rw
salt.states.nxos.replace(name, repl, full_match=False) Replace all instances of a string or full line in the running config
name   String to replace
full_match Whether name will match the full line or only a subset of the line.  Defaults to False. When False, .* is added around name for matching in the show run config.
replace snmp string: nxos.replace: - name: randoSNMPstringHERE - repl: NEWrandoSNMPstringHERE
replace full snmp string: nxos.replace: - name: ^snmp-server community randoSNMPstringHERE group network-operator$ - repl: snmp-server community NEWrandoSNMPstringHERE group network-operator - full_match: True
NOTE: The first example will replace the SNMP string on both the group and the ACL, so you will not lose the ACL setting. Because the second is an exact match of the line, when the group is removed, the ACL is removed, but not readded, because it was not matched.
salt.states.nxos.user_absent(name) Ensure a user is not present
name   username to remove if it exists
delete: nxos.user_absent: - name: daniel
salt.states.nxos.user_present(name, password=None, roles=None, encrypted=False, crypt_salt=None, algorithm='sha256') Ensure a user is present with the specified groups
name   Name of user
password Encrypted or Plain Text password for user
roles  List of roles the user should be assigned.  Any roles not in this list will be removed
encrypted Whether the password is encrypted already or not.  Defaults to False
crypt_salt Salt to use when encrypting the password.  Default is None (salt is randomly generated for unhashed passwords)
algorithm Algorithm to use for hashing password.  Defaults to sha256. Accepts md5, blowfish, sha256, sha512
create: nxos.user_present: - name: daniel - roles: - vdc-admin
set_password: nxos.user_present: - name: daniel - password: admin - roles: - network-admin
update: nxos.user_present: - name: daniel - password: AiN9jaoP - roles: - network-admin - vdc-admin
salt.states.nxos_upgrade Manage NX-OS System Image Upgrades.
salt.states.nxos_upgrade.image_running(name, system_image, kickstart_image=None, issu=True, **kwargs) Ensure the NX-OS system image is running on the device.
name   Name of the salt state task
system_image Name of the system image file on bootflash:
kickstart_image Name of the kickstart image file on bootflash: This is not needed if the system_image is a combined system and kickstart image Default: None
issu   Ensure the correct system is running on the device using an in service software upgrade, or force a disruptive upgrade by setting the option to False.  Default: False
upgrade_software_image_n9k: nxos.image_running: - name: Ensure nxos.7.0.3.I7.5a.bin is running - system_image: nxos.7.0.3.I7.5a.bin - issu: True
upgrade_software_image_n7k: nxos.image_running: - name: Ensure n7000-s2-kickstart.8.0.1.bin is running - kickstart_image: n7000-s2-kickstart.8.0.1.bin - system_image: n7000-s2-dk9.8.0.1.bin - issu: False
salt.states.openstack_config Manage OpenStack configuration file settings.
salt.states.openstack_config.absent(name, filename, section, parameter=None) Ensure a value is not set in an OpenStack configuration file.
parameter (optional) The parameter to change.  If the parameter is not supplied, the name will be used as the parameter.
salt.states.openstack_config.present(name, filename, section, value, parameter=None) Ensure a value is set in an OpenStack configuration file.
salt.states.openvswitch_bridge Management of Open vSwitch bridges.
salt.states.openvswitch_bridge.absent(name) Ensures that the named bridge does not exist, eventually deletes it.
Parameters name -- The name of the bridge.
salt.states.openvswitch_bridge.present(name) Ensures that the named bridge exists, eventually creates it.
salt.states.openvswitch_port Management of Open vSwitch ports.
salt.states.openvswitch_port.absent(name, bridge=None) Ensures that the named port exists on bridge, eventually deletes it.  If bridge is not set, port is removed from  whatever bridge contains it.
• name -- The name of the port.
• bridge -- The name of the bridge.
salt.states.openvswitch_port.present(name, bridge, tunnel_type=None, id=None, remote=None, dst_port=None, internal=False) Ensures that the named port exists on bridge, eventually creates it.
• tunnel_type -- Optional type of interface to create, currently supports: vlan, vxlan and gre.
• id -- Optional tunnel's key.
• remote -- Remote endpoint's IP address.
• dst_port -- Port to use when creating tunnelport in the switch.
• internal -- Create an internal port if one does not exist
salt.states.opsgenie Create/Close an alert in OpsGenie New in version 2018.3.0.
This state is useful for creating or closing alerts in OpsGenie during state runs.
used_space: disk.status: - name: / - maximum: 79% - minimum: 20%
opsgenie_create_action_sender: opsgenie.create_alert: - api_key: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX - reason: 'Disk capacity is out of designated range.' - name: disk.status - onfail: - disk: used_space
opsgenie_close_action_sender: opsgenie.close_alert: - api_key: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX - name: disk.status - require: - disk: used_space
salt.states.opsgenie.close_alert(name=None, api_key=None, reason='Conditions are met.', action_type='Close') Close an alert in OpsGenie. It's a wrapper function for create_alert.  Example usage with Salt's requisites and other global state arguments could be found above.
Required Parameters:
name   It will be used as alert's alias. If you want to use the close functionality you must provide name field for both states like in above case.
Optional Parameters:
action_type OpsGenie supports the default values Create/Close for action_type.  You can customize this field with OpsGenie's custom actions for other purposes like adding notes or acknowledging alerts.
salt.states.opsgenie.create_alert(name=None, api_key=None, reason=None, action_type='Create') Create an alert in OpsGenie. Example usage with Salt's requisites and other global state arguments could be found above.
salt.states.pagerduty Create an Event in PagerDuty New in version 2014.1.0.
This state is useful for creating events on the PagerDuty service during state runs.
server-warning-message: pagerduty.create_event: - name: 'This is a server warning message' - details: 'This is a much more detailed message' - service_key: 9abcd123456789efabcde362783cdbaf - profile: my-pagerduty-account
salt.states.pagerduty.create_event(name, details, service_key, profile) Create an event on the PagerDuty service
name   This is a short description of the event.
salt.states.pagerduty_escalation_policy Manage PagerDuty escalation policies.
Schedules and users can be referenced by pagerduty ID, or by name, or by email address.
ensure test escalation policy: pagerduty_escalation_policy.present: - name: bruce test escalation policy - escalation_rules: - targets: - type: schedule id: 'bruce test schedule level1' - type: user id: 'Bruce Sherrod' escalation_delay_in_minutes: 15 - targets: - type: schedule id: 'bruce test schedule level2' escalation_delay_in_minutes: 15 - targets: - type: user id: 'Bruce TestUser1' - type: user id: 'Bruce TestUser2' - type: user id: 'Bruce TestUser3' - type: user id:  'bruce+test4@lyft.com' escalation_delay_in_minutes: 15
salt.states.pagerduty_escalation_policy.absent(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure that a PagerDuty escalation policy does not exist.  Accepts all the arguments that pagerduty_escalation_policy.present accepts; but ignores all arguments except the name.
Name can be the escalation policy id or the escalation policy name.
salt.states.pagerduty_escalation_policy.present(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure that a pagerduty escalation policy exists.  Will create or update as needed.
This method accepts as args everything defined in https://developer.pagerduty.com/documentation/rest/escalation_policies/create. In addition, user and schedule id's will be translated from name (or email address) into PagerDuty unique ids.  For example:
pagerduty_escalation_policy.present:
• name: bruce test escalation policy
escalation_rules:
targets:
• type: schedule id: 'bruce test schedule level1'
• type: user id: 'Bruce Sherrod'
In this example, 'Bruce Sherrod' will be looked up and replaced with the PagerDuty id (usually a 7 digit all-caps string, e.g. PX6GQL7)
salt.states.pagerduty_schedule Manage PagerDuty schedules.
ensure test schedule: pagerduty_schedule.present: - name: 'bruce test schedule level1' - schedule: name: 'bruce test schedule level1' time_zone: 'Pacific Time (US & Canada)' schedule_layers: - name: 'Schedule Layer 1' start: '2015-01-01T00:00:00' users: - user: 'id': 'Bruce TestUser1' member_order: 1 - user: 'id': 'Bruce TestUser2' member_order: 2 - user: 'id': 'bruce+test3@lyft.com' member_order: 3 - user: 'id': 'bruce+test4@lyft.com' member_order: 4 rotation_virtual_start: '2015-01-01T00:00:00' priority: 1 rotation_turn_length_seconds: 604800
salt.states.pagerduty_schedule.absent(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure that a pagerduty schedule does not exist.  Name can be pagerduty schedule id or pagerduty schedule name.
salt.states.pagerduty_schedule.present(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure that a pagerduty schedule exists.  This method accepts as args everything defined in https://developer.pagerduty.com/documentation/rest/schedules/create. This means that most arguments are in a dict called "schedule."
User id's can be pagerduty id, or name, or email address.
salt.states.pagerduty_service Manage PagerDuty services
Escalation policies can be referenced by pagerduty ID or by namea.
ensure test service pagerduty_service.present: - name: 'my service' - escalation_policy_id: 'my escalation policy' - type: nagios
salt.states.pagerduty_service.absent(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure a pagerduty service does not exist.  Name can be the service name or pagerduty service id.
salt.states.pagerduty_service.present(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure pagerduty service exists.  This method accepts as arguments everything defined in https://developer.pagerduty.com/documentation/rest/services/create
Note that many arguments are mutually exclusive, depending on the "type" argument.
# create a PagerDuty email service at test-email@DOMAIN.pagerduty.com ensure generic email service exists: pagerduty_service.present: - name: my email service - service: description: "email service controlled by salt" escalation_policy_id: "my escalation policy" type: "generic_email" service_key: "test-email"
# create a pagerduty service using cloudwatch integration ensure my cloudwatch service exists: pagerduty_service.present: - name: my cloudwatch service - service: escalation_policy_id: "my escalation policy" type: aws_cloudwatch description: "my cloudwatch service controlled by salt"
salt.states.pagerduty_user Manage PagerDuty users.
ensure bruce test user 1:
pagerduty.user_present:
• name: 'Bruce TestUser1'
• email: bruce+test1@lyft.com
• requester_id: P1GV5NT
salt.states.pagerduty_user.absent(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure pagerduty user does not exist.  Name can be pagerduty id, email address, or user name.
salt.states.pagerduty_user.present(profile='pagerduty', subdomain=None, api_key=None, **kwargs) Ensure pagerduty user exists.  Arguments match those supported by https://developer.pagerduty.com/documentation/rest/users/create.
salt.states.panos A state module to manage Palo Alto network devices.
About This state module was designed to handle connections to a Palo Alto based firewall. This module relies on the Palo Alto proxy module to interface with the devices.
This state module is designed to give extreme flexibility in the control over XPATH values on the PANOS device. It exposes the core XML API commands and allows state modules to chain complex XPATH commands.
Below is an example of how to construct a security rule and move to the top of the policy. This will take a config lock to prevent execution during the operation, then remove the lock. After the XPATH has been deployed, it will commit to the device.
panos/takelock: panos.add_config_lock panos/service_tcp_22: panos.set_config: - xpath: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/service - value: <entry name='tcp-22'><protocol><tcp><port>22</port></tcp></protocol></entry> - commit: False panos/create_rule1: panos.set_config: - xpath: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules - value: ' <entry name="rule1"> <from><member>trust</member></from> <to><member>untrust</member></to> <source><member>10.0.0.1</member></source> <destination><member>10.0.1.1</member></destination> <service><member>tcp-22</member></service> <application><member>any</member></application> <action>allow</action> <disabled>no</disabled> </entry>' - commit: False panos/moveruletop: panos.move_config: - xpath: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1'] - where: top - commit: False panos/removelock: panos.remove_config_lock panos/commit: panos.commit_config
Version Specific Configurations Palo Alto devices running different versions will have different supported features and different command structures. In order to account for this, the proxy module can be leveraged to check if the panos device is at a specific revision level.
The proxy['panos.is_required_version'] method will check if a panos device is currently running a version equal or greater than the passed version. For example, proxy['panos.is_required_version']('7.0.0') would match both 7.1.0 and 8.0.0.
{% if proxy['panos.is_required_version']('8.0.0') %} panos/deviceconfig/system/motd-and-banner: panos.set_config: - xpath: /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/motd-and-banner - value: | <banner-header>BANNER TEXT</banner-header> <banner-header-color>color2</banner-header-color> <banner-header-text-color>color18</banner-header-text-color> <banner-header-footer-match>yes</banner-header-footer-match> - commit: False {% endif %}
salt.states.panos.add_config_lock(name) Prevent other users from changing configuration until the lock is released.
panos/takelock: panos.add_config_lock
salt.states.panos.address_exists(name, addressname=None, vsys=1, ipnetmask=None, iprange=None, fqdn=None, description=None, commit=False) Ensures that an address object exists in the configured state. If it does not exist or is not configured with the specified attributes, it will be adjusted to match the specified values.
This module will only process a single address type (ip-netmask, ip-range, or fqdn). It will process the specified value if the following order: ip-netmask, ip-range, fqdn. For proper execution, only specify a single address type.
addressname(str): The name of the address object.  The name is case-sensitive and can have up to 31 characters, which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on Panorama, unique within its device group and any ancestor or descendant device groups.
vsys(str): The string representation of the VSYS ID. Defaults to VSYS 1.
ipnetmask(str): The IPv4 or IPv6 address or IP address range using the format ip_address/mask or ip_address where the mask is the number of significant binary digits used for the network portion of the address. Ideally, for IPv6, you specify only the network portion, not the host portion.
iprange(str): A range of addresses using the format ip_address–ip_address where both addresses can be  IPv4 or both can be IPv6.
fqdn(str): A fully qualified domain name format. The FQDN initially resolves at commit time. Entries are subsequently refreshed when the firewall performs a check every 30 minutes; all changes in the IP address for the entries are picked up at the refresh cycle.
description(str): A description for the policy (up to 255 characters).
commit(bool): If true the firewall will commit the changes, if false do not commit changes.
panos/address/h-10.10.10.10: panos.address_exists: - addressname: h-10.10.10.10 - vsys: 1 - ipnetmask: 10.10.10.10 - commit: False
panos/address/10.0.0.1-10.0.0.50: panos.address_exists: - addressname: r-10.0.0.1-10.0.0.50 - vsys: 1 - iprange: 10.0.0.1-10.0.0.50 - commit: False
panos/address/foo.bar.com: panos.address_exists: - addressname: foo.bar.com - vsys: 1 - fqdn: foo.bar.com - description: My fqdn object - commit: False
salt.states.panos.address_group_exists(name, groupname=None, vsys=1, members=None, description=None, commit=False) Ensures that an address group object exists in the configured state. If it does not exist or is not configured with the specified attributes, it will be adjusted to match the specified values.
This module will enforce group membership. If a group exists and contains members this state does not include, those members will be removed and replaced with the specified members in the state.
groupname(str): The name of the address group object.  The name is case-sensitive and can have up to 31 characters, which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on Panorama, unique within its device group and any ancestor or descendant device groups.
members(str, list): The members of the address group. These must be valid address objects or address groups on the system that already exist prior to the execution of this state.
panos/address-group/my-group: panos.address_group_exists: - groupname: my-group - vsys: 1 - members: - my-address-object - my-other-address-group - description: A group that needs to exist - commit: False
salt.states.panos.clone_config(name, xpath=None, newname=None, commit=False) Clone a specific XPATH and set it to a new name.
xpath(str): The XPATH of the configuration API tree to clone.
newname(str): The new name of the XPATH clone.
panos/clonerule: panos.clone_config: - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules&from=/config/devices/ entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1'] - value: rule2 - commit: True
salt.states.panos.commit_config(name) Commits the candidate configuration to the running configuration.
panos/commit: panos.commit_config
salt.states.panos.delete_config(name, xpath=None, commit=False) Deletes a Palo Alto XPATH to a specific value.
Use the xpath parameter to specify the location of the object to be deleted.
xpath(str): The XPATH of the configuration API tree to control.
panos/deletegroup: panos.delete_config: - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='test'] - commit: True
salt.states.panos.download_software(name, version=None, synch=False, check=False) Ensures that a software version is downloaded.
version(str): The software version to check. If this version is not already downloaded, it will attempt to download the file from Palo Alto.
synch(bool): If true, after downloading the file it will be synched to its peer.
check(bool): If true, the PANOS device will first attempt to pull the most recent software inventory list from Palo Alto.
panos/version8.0.0: panos.download_software: - version: 8.0.0 - synch: False - check: True
salt.states.panos.edit_config(name, xpath=None, value=None, commit=False) Edits a Palo Alto XPATH to a specific value. This will always overwrite the existing value, even if it is not changed.
You can replace an existing object hierarchy at a specified location in the configuration with a new value. Use the xpath parameter to specify the location of the object, including the node to be replaced.
This is the recommended state to enforce configurations on a xpath.
value(str): The XML value to edit. This must be a child to the XPATH.
panos/addressgroup: panos.edit_config: - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='test'] - value: <static><entry name='test'><member>abc</member><member>xyz</member></entry></static> - commit: True
salt.states.panos.move_config(name, xpath=None, where=None, dst=None, commit=False) Moves a XPATH value to a new location.
Use the xpath parameter to specify the location of the object to be moved, the where parameter to specify type of move, and dst parameter to specify the destination path.
xpath(str): The XPATH of the configuration API tree to move.
where(str): The type of move to execute. Valid options are after, before, top, bottom. The after and before options will require the dst option to specify the destination of the action. The top action will move the XPATH to the top of its structure. The botoom action will move the XPATH to the bottom of its structure.
dst(str): Optional. Specifies the destination to utilize for a move action. This is ignored for the top or bottom action.
commit(bool): If true the firewall will commit the changes, if false do not commit changes. If the operation is not successful, it will not commit.
panos/moveruletop: panos.move_config: - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1'] - where: top - commit: True
panos/moveruleafter: panos.move_config: - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1'] - where: after - dst: rule2 - commit: True
salt.states.panos.remove_config_lock(name) Release config lock previously held.
panos/takelock: panos.remove_config_lock
salt.states.panos.rename_config(name, xpath=None, newname=None, commit=False) Rename a Palo Alto XPATH to a specific value. This will always rename the value even if a change is not needed.
newname(str): The new name of the XPATH value.
panos/renamegroup: panos.rename_config: - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/address/entry[@name='old_address'] - value: new_address - commit: True
salt.states.panos.security_rule_exists(name, rulename=None, vsys='1', action=None, disabled=None, sourcezone=None, destinationzone=None, source=None, destination=None, application=None, service=None, description=None, logsetting=None, logstart=None, logend=None, negatesource=None, negatedestination=None, profilegroup=None, datafilter=None, fileblock=None, spyware=None, urlfilter=None, virus=None, vulnerability=None, wildfire=None, move=None, movetarget=None, commit=False) Ensures that a security rule exists on the device. Also, ensure that all configurations are set appropriately.
This method will create the rule if it does not exist. If the rule does exist, it will ensure that the configurations are set appropriately.
If the rule does not exist and is created, any value that is not provided will be provided as the default.  The action, to, from, source, destination, application, and service fields are mandatory and must be provided.
This will enforce the exact match of the rule. For example, if the rule is currently configured with the log-end option, but this option is not specified in the state method, it will be removed and reset to the system default.
It is strongly recommended to specify all options to ensure proper operation.
When defining the profile group settings, the device can only support either a profile group or individual settings.  If both are specified, the profile group will be preferred and the individual settings are ignored. If neither are specified, the value will be set to system default of none.
rulename(str): The name of the security rule.  The name is case-sensitive and can have up to 31 characters, which can be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on Panorama, unique within its device group and any ancestor or descendant device groups.
action(str): The action that the security rule will enforce. Valid options are: allow, deny, drop, reset-client, reset-server, reset-both.
disabled(bool): Controls if the rule is disabled. Set 'True' to disable and 'False' to enable.
sourcezone(str, list): The source zone(s). The value 'any' will match all zones.
destinationzone(str, list): The destination zone(s). The value 'any' will match all zones.
source(str, list): The source address(es). The value 'any' will match all addresses.
destination(str, list): The destination address(es). The value 'any' will match all addresses.
application(str, list): The application(s) matched. The value 'any' will match all applications.
service(str, list): The service(s) matched. The value 'any' will match all services. The value 'application-default' will match based upon the application defined ports.
logsetting(str): The name of a valid log forwarding profile.
logstart(bool): Generates a traffic log entry for the start of a session (disabled by default).
logend(bool): Generates a traffic log entry for the end of a session (enabled by default).
negatesource(bool): Match all but the specified source addresses.
negatedestination(bool): Match all but the specified destination addresses.
profilegroup(str): A valid profile group name.
datafilter(str): A valid data filter profile name. Ignored with the profilegroup option set.
fileblock(str): A valid file blocking profile name. Ignored with the profilegroup option set.
spyware(str): A valid spyware profile name. Ignored with the profilegroup option set.
urlfilter(str): A valid URL filtering profile name. Ignored with the profilegroup option set.
virus(str): A valid virus profile name. Ignored with the profilegroup option set.
vulnerability(str): A valid vulnerability profile name. Ignored with the profilegroup option set.
wildfire(str): A valid vulnerability profile name. Ignored with the profilegroup option set.
move(str): An optional argument that ensure the rule is moved to a specific location. Valid options are 'top', 'bottom', 'before', or 'after'. The 'before' and 'after' options require the use of the 'movetarget' argument to define the location of the move request.
movetarget(str): An optional argument that defines the target of the move operation if the move argument is set to 'before' or 'after'.
panos/rulebase/security/rule01: panos.security_rule_exists: - rulename: rule01 - vsys: 1 - action: allow - disabled: False - sourcezone: untrust - destinationzone: trust - source: - 10.10.10.0/24 - 1.1.1.1 - destination: - 2.2.2.2-2.2.2.4 - application: - any - service: - tcp-25 - description: My test security rule - logsetting: logprofile - logstart: False - logend: True - negatesource: False - negatedestination: False - profilegroup: myprofilegroup - move: top - commit: False
panos/rulebase/security/rule01: panos.security_rule_exists: - rulename: rule01 - vsys: 1 - action: allow - disabled: False - sourcezone: untrust - destinationzone: trust - source: - 10.10.10.0/24 - 1.1.1.1 - destination: - 2.2.2.2-2.2.2.4 - application: - any - service: - tcp-25 - description: My test security rule - logsetting: logprofile - logstart: False - logend: False - datafilter: foobar - fileblock: foobar - spyware: foobar - urlfilter: foobar - virus: foobar - vulnerability: foobar - wildfire: foobar - move: after - movetarget: rule02 - commit: False
salt.states.panos.service_exists(name, servicename=None, vsys=1, protocol=None, port=None, description=None, commit=False) Ensures that a service object exists in the configured state. If it does not exist or is not configured with the specified attributes, it will be adjusted to match the specified values.
servicename(str): The name of the security object.  The name is case-sensitive and can have up to 31 characters, which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on Panorama, unique within its device group and any ancestor or descendant device groups.
protocol(str): The protocol that is used by the service object. The only valid options are tcp and udp.
port(str): The port number that is used by the service object. This can be specified as a single integer or a valid range of ports.
panos/service/tcp-80: panos.service_exists: - servicename: tcp-80 - vsys: 1 - protocol: tcp - port: 80 - description: Hypertext Transfer Protocol - commit: False
panos/service/udp-500-550: panos.service_exists: - servicename: udp-500-550 - vsys: 3 - protocol: udp - port: 500-550 - commit: False
salt.states.panos.service_group_exists(name, groupname=None, vsys=1, members=None, description=None, commit=False) Ensures that a service group object exists in the configured state. If it does not exist or is not configured with the specified attributes, it will be adjusted to match the specified values.
groupname(str): The name of the service group object.  The name is case-sensitive and can have up to 31 characters, which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on Panorama, unique within its device group and any ancestor or descendant device groups.
members(str, list): The members of the service group. These must be valid service objects or service groups on the system that already exist prior to the execution of this state.
panos/service-group/my-group: panos.service_group_exists: - groupname: my-group - vsys: 1 - members: - tcp-80 - custom-port-group - description: A group that needs to exist - commit: False
salt.states.panos.set_config(name, xpath=None, value=None, commit=False) Sets a Palo Alto XPATH to a specific value. This will always overwrite the existing value, even if it is not changed.
You can add or create a new object at a specified location in the configuration hierarchy. Use the xpath parameter to specify the location of the object in the configuration
value(str): The XML value to set. This must be a child to the XPATH.
panos/hostname: panos.set_config: - xpath: /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system - value: <hostname>foobar</hostname> - commit: True
salt.states.pbm Manages VMware storage policies (called pbm because the vCenter endpoint is /pbm)
Storage policy { "name": "salt_storage_policy" "description": "Managed by Salt. Random capability values.", "resource_type": "STORAGE", "subprofiles": [ { "capabilities": [ { "setting": { "type": "scalar", "value": 2 }, "namespace": "VSAN", "id": "hostFailuresToTolerate" }, { "setting": { "type": "scalar", "value": 2 }, "namespace": "VSAN", "id": "stripeWidth" }, { "setting": { "type": "scalar", "value": true }, "namespace": "VSAN", "id": "forceProvisioning" }, { "setting": { "type": "scalar", "value": 50 }, "namespace": "VSAN", "id": "proportionalCapacity" }, { "setting": { "type": "scalar", "value": 0 }, "namespace": "VSAN", "id": "cacheReservation" } ], "name": "Rule-Set 1: VSAN", "force_provision": null } ], }
NOTE: Version 6.0 of pyVmomi has some problems with SSL error handling on certain versions of Python. If using version 6.0 of pyVmomi, Python 2.6, Python 2.7.9, or newer must be present. This is due to an upstream dependency in pyVmomi 6.0 that is not supported in Python versions 2.7 to 2.7.8. If the version of Python is not in the supported range, you will need to install an earlier version of pyVmomi. See Issue #29537 <https://github.com/saltstack/salt/issues/29537> for more information.
salt.states.pbm.default_storage_policy_assigned(name, policy, datastore) Assigns a default storage policy to a datastore
policy Name of storage policy
datastore Name of datastore
salt.states.pbm.default_vsan_policy_configured(name, policy) Configures the default VSAN policy on a vCenter.  The state assumes there is only one default VSAN policy on a vCenter.
policy Dict representation of a policy
salt.states.pbm.storage_policies_configured(name, policies) Configures storage policies on a vCenter.
policies List of dict representation of the required storage policies
salt.states.pcs Management of Pacemaker/Corosync clusters with PCS A state module to manage Pacemaker/Corosync clusters with the Pacemaker/Corosync configuration system (PCS)
New in version 2016.110.
Walkthrough of a complete PCS cluster setup: http://clusterlabs.org/doc/en-US/Pacemaker/1.1/html/Clusters_from_Scratch/
Requirements: PCS is installed, pcs service is started and the password for the hacluster user is set and known.
Remark on the cibname variable used in the examples: The use of the cibname variable is optional.  Use it only if you want to deploy your changes into a cibfile first and then push it. This makes only sense if you want to deploy multiple changes (which require each other) at once to the cluster.
At first the cibfile must be created:
mysql_pcs__cib_present_cib_for_galera: pcs.cib_present: - cibname: cib_for_galera - scope: None - extra_args: None
Then the cibfile can be modified by creating resources (creating only 1 resource for demonstration, see also 7.):
mysql_pcs__resource_present_galera: pcs.resource_present: - resource_id: galera - resource_type: "ocf:heartbeat:galera" - resource_options: - 'wsrep_cluster_address=gcomm://node1.example.org,node2.example.org,node3.example.org' - '--master' - cibname: cib_for_galera
After modifying the cibfile, it can be pushed to the live CIB in the cluster:
mysql_pcs__cib_pushed_cib_for_galera: pcs.cib_pushed: - cibname: cib_for_galera - scope: None - extra_args: None
Create a cluster from scratch:
This authorizes nodes to each other. It probably won't work with Ubuntu as it rolls out a default cluster that needs to be destroyed before the new cluster can be created. This is a little complicated so it's best to just run the cluster_setup below in most cases.:
pcs_auth__auth: pcs.auth: - nodes: - node1.example.com - node2.example.com - pcsuser: hacluster - pcspasswd: hoonetorg
2. Do the initial cluster setup:
pcs_setup__setup: pcs.cluster_setup: - nodes: - node1.example.com - node2.example.com - pcsclustername: pcscluster - extra_args: - '--start' - '--enable' - pcsuser: hacluster - pcspasswd: hoonetorg
3. Optional: Set cluster properties:
pcs_properties__prop_has_value_no-quorum-policy: pcs.prop_has_value: - prop: no-quorum-policy - value: ignore - cibname: cib_for_cluster_settings
4. Optional: Set resource defaults:
pcs_properties__resource_defaults_to_resource-stickiness: pcs.resource_defaults_to: - default: resource-stickiness - value: 100 - cibname: cib_for_cluster_settings
5. Optional: Set resource op defaults:
pcs_properties__resource_op_defaults_to_monitor-interval: pcs.resource_op_defaults_to: - op_default: monitor-interval - value: 60s - cibname: cib_for_cluster_settings
6. Configure Fencing (!is often not optional on production ready cluster!):
pcs_stonith__created_eps_fence: pcs.stonith_present: - stonith_id: eps_fence - stonith_device_type: fence_eps - stonith_device_options: - 'pcmk_host_map=node1.example.org:01;node2.example.org:02' - 'ipaddr=myepsdevice.example.org' - 'power_wait=5' - 'verbose=1' - 'debug=/var/log/pcsd/eps_fence.log' - 'login=hidden' - 'passwd=hoonetorg' - cibname: cib_for_stonith
7. Add resources to your cluster:
8. Optional: Add constraints (locations, colocations, orders):
haproxy_pcs__constraint_present_colocation-vip_galera-haproxy-clone-INFINITY: pcs.constraint_present: - constraint_id: colocation-vip_galera-haproxy-clone-INFINITY - constraint_type: colocation - constraint_options: - 'add' - 'vip_galera' - 'with' - 'haproxy-clone' - cibname: cib_for_haproxy
salt.states.pcs.auth(name, nodes, pcsuser='hacluster', pcspasswd='hacluster', extra_args=None) Ensure all nodes are authorized to the cluster
name   Irrelevant, not used (recommended: pcs_auth__auth)
pcsuser user for communication with pcs (default: hacluster)
extra_args list of extra args for the 'pcs cluster auth' command, there are none so it's here for compatibility.
pcs_auth__auth: pcs.auth: - nodes: - node1.example.com - node2.example.com - pcsuser: hacluster - pcspasswd: hoonetorg - extra_args: []
salt.states.pcs.cib_present(name, cibname, scope=None, extra_args=None) Ensure that a CIB-file with the content of the current live CIB is created
Should be run on one cluster node only (there may be races)
name   Irrelevant, not used (recommended: {{formulaname}}__cib_present_{{cibname}})
cibname name/path of the file containing the CIB
scope  specific section of the CIB (default: None)
salt.states.pcs.cib_pushed(name, cibname, scope=None, extra_args=None) Ensure that a CIB-file is pushed if it is changed since the creation of it with pcs.cib_present
name   Irrelevant, not used (recommended: {{formulaname}}__cib_pushed_{{cibname}})
scope  specific section of the CIB
salt.states.pcs.cluster_node_present(name, node, extra_args=None) Add a node to the Pacemaker cluster via PCS Should be run on one cluster node only (there may be races) Can only be run on a already setup/added node
name   Irrelevant, not used (recommended: pcs_setup__node_add_{{node}})
extra_args list of extra args for the 'pcs cluster node add' command
pcs_setup__node_add_node1.example.com: pcs.cluster_node_present: - node: node1.example.com - extra_args: - '--start' - '--enable'
salt.states.pcs.cluster_setup(name, nodes, pcsclustername='pcscluster', extra_args=None, pcsuser='hacluster', pcspasswd='hacluster', pcs_auth_extra_args=None, wipe_default=False) Setup Pacemaker cluster on nodes.  Should be run on one cluster node only to avoid race conditions.  This performs auth as well as setup so can be run in place of the auth state.  It is recommended not to run auth on Debian/Ubuntu for a new cluster and just to run this because of the initial cluster config that is installed on Ubuntu/Debian by default.
name   Irrelevant, not used (recommended: pcs_setup__setup)
pcsclustername Name of the Pacemaker cluster
extra_args list of extra args for the 'pcs cluster setup' command
pcsuser The username for authenticating the cluster (default: hacluster)
pcspasswd The password for authenticating the cluster (default: hacluster)
pcs_auth_extra_args Extra args to be passed to the auth function in case of reauth.
wipe_default This removes the files that are installed with Debian based operating systems.
salt.states.pcs.constraint_present(name, constraint_id, constraint_type, constraint_options=None, cibname=None) Ensure that a constraint is created
Should be run on one cluster node only (there may be races) Can only be run on a node with a functional pacemaker/corosync
name   Irrelevant, not used (recommended: {{formulaname}}__constraint_present_{{constraint_id}})
constraint_id name for the constraint (try first to create manually to find out the autocreated name)
constraint_type constraint type (location, colocation, order)
constraint_options options for creating the constraint
cibname use a cached CIB-file named like cibname instead of the live CIB
salt.states.pcs.prop_has_value(name, prop, value, extra_args=None, cibname=None) Ensure that a property in the cluster is set to a given value
name   Irrelevant, not used (recommended: pcs_properties__prop_has_value_{{prop}})
value  value of the property
salt.states.pcs.resource_defaults_to(name, default, value, extra_args=None, cibname=None) Ensure a resource default in the cluster is set to a given value
name   Irrelevant, not used (recommended: pcs_properties__resource_defaults_to_{{default}})
default name of the default resource property
value  value of the default resource property
salt.states.pcs.resource_op_defaults_to(name, op_default, value, extra_args=None, cibname=None) Ensure a resource operation default in the cluster is set to a given value