neulab/tldr huggingface dataset:
salt.modules.systemd_service.get_all(root=None) Return a list of all available services
salt.modules.systemd_service.get_disabled(root=None) Return a list of all disabled services
salt.modules.systemd_service.get_enabled(root=None) Return a list of all enabled services
salt.modules.systemd_service.get_running() Return a list of all running services, so far as systemd is concerned
salt.modules.systemd_service.get_static(root=None) New in version 2015.8.5.
Return a list of all static services
salt '*' service.get_static
salt.modules.systemd_service.mask(name, runtime=False, root=None) New in version 2015.5.0.
Changed in version 2015.8.12,2016.3.3,2016.11.0: On minions running systemd>=205, systemd-run(1) is now used to isolate commands run by this function from the salt-minion daemon's control group. This is done to avoid a race condition in cases where the salt-minion service is restarted while a service is being modified. If desired, usage of systemd-run(1) can be suppressed by setting a config option called systemd.scope, with a value of False (no quotes).
Mask the specified service with systemd
runtime False Set to True to mask this service only until the next reboot
salt '*' service.mask foo salt '*' service.mask foo runtime=True
salt.modules.systemd_service.masked(name, runtime=False, root=None) New in version 2015.8.0.
Changed in version 2015.8.5: The return data for this function has changed. If the service is masked, the return value will now be the output of the systemctl is-enabled command (so that a persistent mask can be distinguished from a runtime mask). If the service is not masked, then False will be returned.
Changed in version 2017.7.0: This function now returns a boolean telling the user whether a mask specified by the new runtime argument is set. If runtime is False, this function will return True if an indefinite mask is set for the named service (otherwise False will be returned). If runtime is False, this function will return True if a runtime mask is set, otherwise False.
Check whether or not a service is masked
runtime False Set to True to check for a runtime mask
New in version 2017.7.0: In previous versions, this function would simply return the output of systemctl is-enabled when the service was found to be masked. However, since it is possible to both have both indefinite and runtime masks on a service simultaneously, this function now only checks for runtime masks if this argument is set to True.  Otherwise, it will check for an indefinite mask.
salt '*' service.masked foo salt '*' service.masked foo runtime=True
salt.modules.systemd_service.missing(name) New in version 2014.1.0.
The inverse of service.available. Returns True if the specified service is not available, otherwise returns False.
salt.modules.systemd_service.offline() New in version 3004.
Check if systemd is working in offline mode, where is not possible to talk with PID 1.
salt '*' service.offline
salt.modules.systemd_service.reload_(name, no_block=False, unmask=False, unmask_runtime=False) Changed in version 2015.8.12,2016.3.3,2016.11.0: On minions running systemd>=205, systemd-run(1) is now used to isolate commands run by this function from the salt-minion daemon's control group. This is done to avoid a race condition in cases where the salt-minion service is restarted while a service is being modified. If desired, usage of systemd-run(1) can be suppressed by setting a config option called systemd.scope, with a value of False (no quotes).
Reload the specified service with systemd
no_block False Set to True to reload the service using --no-block.
unmask False Set to True to remove an indefinite mask before attempting to reload the service.
New in version 2017.7.0: In previous releases, Salt would simply unmask a service before reloading. This behavior is no longer the default.
unmask_runtime False Set to True to remove a runtime mask before attempting to reload the service.
salt.modules.systemd_service.restart(name, no_block=False, unmask=False, unmask_runtime=False) Changed in version 2015.8.12,2016.3.3,2016.11.0: On minions running systemd>=205, systemd-run(1) is now used to isolate commands run by this function from the salt-minion daemon's control group. This is done to avoid a race condition in cases where the salt-minion service is restarted while a service is being modified. If desired, usage of systemd-run(1) can be suppressed by setting a config option called systemd.scope, with a value of False (no quotes).
Restart the specified service with systemd
unmask False Set to True to remove an indefinite mask before attempting to restart the service.
New in version 2017.7.0: In previous releases, Salt would simply unmask a service before restarting. This behavior is no longer the default.
unmask_runtime False Set to True to remove a runtime mask before attempting to restart the service.
salt.modules.systemd_service.show(name, root=None) New in version 2014.7.0.
Show properties of one or more units/jobs or the manager
salt.modules.systemd_service.start(name, no_block=False, unmask=False, unmask_runtime=False) Changed in version 2015.8.12,2016.3.3,2016.11.0: On minions running systemd>=205, systemd-run(1) is now used to isolate commands run by this function from the salt-minion daemon's control group. This is done to avoid a race condition in cases where the salt-minion service is restarted while a service is being modified. If desired, usage of systemd-run(1) can be suppressed by setting a config option called systemd.scope, with a value of False (no quotes).
Start the specified service with systemd
unmask False Set to True to remove an indefinite mask before attempting to start the service.
New in version 2017.7.0: In previous releases, Salt would simply unmask a service before starting. This behavior is no longer the default.
unmask_runtime False Set to True to remove a runtime mask before attempting to start the service.
salt.modules.systemd_service.status(name, sig=None) Return the status for a service via systemd.  If the name contains globbing, a dict mapping service name to True/False values is returned.
salt.modules.systemd_service.stop(name, no_block=False) Changed in version 2015.8.12,2016.3.3,2016.11.0: On minions running systemd>=205, systemd-run(1) is now used to isolate commands run by this function from the salt-minion daemon's control group. This is done to avoid a race condition in cases where the salt-minion service is restarted while a service is being modified. If desired, usage of systemd-run(1) can be suppressed by setting a config option called systemd.scope, with a value of False (no quotes).
Stop the specified service with systemd
salt.modules.systemd_service.systemctl_reload() New in version 0.15.0.
Reloads systemctl, an action needed whenever unit files are updated.
salt '*' service.systemctl_reload
salt.modules.systemd_service.unmask_(name, runtime=False, root=None) New in version 2015.5.0.
Unmask the specified service with systemd
runtime False Set to True to unmask this service only until the next reboot
New in version 2017.7.0: In previous versions, this function would remove whichever mask was identified by running systemctl is-enabled on the service.  However, since it is possible to both have both indefinite and runtime masks on a service simultaneously, this function now removes a runtime mask only when this argument is set to True, and otherwise removes an indefinite mask.
salt '*' service.unmask foo salt '*' service.unmask foo runtime=True
salt.modules.telegram Module for sending messages via Telegram.
configuration In order to send a message via the Telegram, certain configuration is required in /etc/salt/minion on the relevant minions or in the pillar. Some sample configs might look like:
telegram.chat_id: '123456789' telegram.token: '00000000:xxxxxxxxxxxxxxxxxxxxxxxx'
salt.modules.telegram.post_message(message, chat_id=None, token=None) Send a message to a Telegram chat.
• message -- The message to send to the Telegram chat.
• chat_id -- (optional) The Telegram chat id.
• token -- (optional) The Telegram API token.
salt '*' telegram.post_message message="Hello Telegram!"
salt.modules.telemetry Connection module for Telemetry
https://github.com/mongolab/mongolab-telemetry-api-docs/blob/master/alerts.md
configuration This module accepts explicit telemetry credentials or can also read api key credentials from a pillar. More Information available here.
In the minion's config file:
telemetry.telemetry_api_keys: - abc123  # Key 1 - efg321  # Backup Key 1 telemetry_api_base_url: https://telemetry-api.mongolab.com/v0
salt.modules.telemetry.create_alarm(deployment_id, metric_name, data, api_key=None, profile='telemetry') create an telemetry alarms.
data is a dict of alert configuration data.
Returns (bool success, str message) tuple.
salt myminion telemetry.create_alarm rs-ds033197 {} profile=telemetry
salt.modules.telemetry.delete_alarms(deployment_id, alert_id=None, metric_name=None, api_key=None, profile='telemetry')
delete an alert specified by alert_id or if not specified blows away all the alerts in the current deployment.
salt myminion telemetry.delete_alarms rs-ds033197 profile=telemetry
salt.modules.telemetry.get_alarms(deployment_id, profile='telemetry') get all the alarms set up against the current deployment
Returns dictionary of alarm information
salt myminion telemetry.get_alarms rs-ds033197 profile=telemetry
salt.modules.telemetry.get_alert_config(deployment_id, metric_name=None, api_key=None, profile='telemetry') Get all alert definitions associated with a given deployment or if metric_name is specified, obtain the specific alert config
Returns dictionary or list of dictionaries.
salt myminion telemetry.get_alert_config rs-ds033197 currentConnections profile=telemetry salt myminion telemetry.get_alert_config rs-ds033197 profile=telemetry
salt.modules.telemetry.get_notification_channel_id(notify_channel, profile='telemetry') Given an email address, creates a notification-channels if one is not found and also returns the corresponding notification channel id.
notify_channel Email escalation policy
profile A dict of telemetry config information.
salt myminion telemetry.get_notification_channel_id userx@company.com profile=telemetry
salt.modules.telemetry.update_alarm(deployment_id, metric_name, data, api_key=None, profile='telemetry') update an telemetry alarms. data is a dict of alert configuration data.
salt myminion telemetry.update_alarm rs-ds033197 {} profile=telemetry
salt.modules.temp Simple module for creating temporary directories and files
This is a thin wrapper around Pythons tempfile module
salt.modules.temp.dir(suffix='', prefix='tmp', parent=None) Create a temporary directory
salt '*' temp.dir salt '*' temp.dir prefix='mytemp-' parent='/var/run/'
salt.modules.temp.file(suffix='', prefix='tmp', parent=None) Create a temporary file
salt '*' temp.file salt '*' temp.file prefix='mytemp-' parent='/var/run/'
salt.modules.test Module for running arbitrary tests
salt.modules.test.arg(*args, **kwargs) Print out the data passed into the function *args and kwargs, this is used to both test the publication data and CLI argument passing, but also to display the information available within the publication data.
Returns {"args": args, "kwargs": kwargs}
salt '*' test.arg 1 "two" 3.1 txt="hello" wow='{a: 1, b: "hello"}'
salt.modules.test.arg_clean(*args, **kwargs) Like test.arg but cleans kwargs of the __pub* items
salt '*' test.arg_clean 1 "two" 3.1 txt="hello" wow='{a: 1, b: "hello"}'
salt.modules.test.arg_repr(*args, **kwargs) Print out the data passed into the function *args and kwargs, this is used to both test the publication data and CLI argument passing, but also to display the information available within the publication data.
Returns {"args": repr(args), "kwargs": repr(kwargs)}
salt '*' test.arg_repr 1 "two" 3.1 txt="hello" wow='{a: 1, b: "hello"}'
salt.modules.test.arg_type(*args, **kwargs) Print out the types of the args and kwargs. This is used to test the types of the args and kwargs passed down to the Minion
salt '*' test.arg_type 1 'int'
salt.modules.test.assertion(assertion) Assert the given argument
salt '*' test.assertion False
salt.modules.test.attr_call() Call grains.items via the attribute
salt '*' test.attr_call
salt.modules.test.collatz(start) Execute the collatz conjecture from the passed starting number, returns the sequence and the time it took to compute. Used for performance tests.
salt '*' test.collatz 3
salt.modules.test.conf_test() Return the value for test.foo in the minion configuration file, or return the default value
salt '*' test.conf_test
salt.modules.test.cross_test(func, args=None) Execute a minion function via the __salt__ object in the test module, used to verify that the Minion functions can be called via the __salt__ module.
salt '*' test.cross_test file.gid_to_group 0
salt.modules.test.echo(text) Return a string - used for testing the connection
salt '*' test.echo 'foo bar baz quo qux'
salt.modules.test.exception(message='Test Exception') Raise an exception
Optionally provide an error message or output the full stack.
salt '*' test.exception 'Oh noes!'
salt.modules.test.false_() Always return False
salt '*' test.false
salt.modules.test.fib(num) Return the num-th Fibonacci number, and the time it took to compute in seconds. Used for performance tests.
This function is designed to have terrible performance.
salt '*' test.fib 3
salt.modules.test.get_opts() Return the configuration options passed to this minion
salt '*' test.get_opts
salt.modules.test.kwarg(**kwargs) Print out the data passed into the function **kwargs, this is used to both test the publication data and CLI kwarg passing, but also to display the information available within the publication data.
salt '*' test.kwarg num=1 txt="two" env='{a: 1, b: "hello"}'
salt.modules.test.missing_func()
salt.modules.test.module_report() Return a dict containing all of the execution modules with a report on the overall availability via different references
salt '*' test.module_report
salt.modules.test.not_loaded() List the modules that were not loaded by the salt loader system
salt '*' test.not_loaded
salt.modules.test.opts_pkg() Return an opts package with the grains and opts for this Minion. This is primarily used to create the options used for Master side state compiling routines
salt '*' test.opts_pkg
salt.modules.test.outputter(data) Test the outputter, pass in data to return
salt '*' test.outputter foobar
salt.modules.test.ping() Used to make sure the minion is up and responding. Not an ICMP ping.
Returns True.
salt '*' test.ping
salt.modules.test.provider(module) Pass in a function name to discover what provider is being used
salt '*' test.provider service
salt.modules.test.providers() Return a dict of the provider names and the files that provided them
salt '*' test.providers
salt.modules.test.raise_exception(name, *args, **kwargs) Raise an exception. Built-in exceptions and those in salt.exceptions can be raised by this test function. If no matching exception is found, then no exception will be raised and this function will return False.
This function is designed to test Salt's exception and return code handling.
salt '*' test.raise_exception TypeError "An integer is required" salt '*' test.raise_exception salt.exceptions.CommandExecutionError "Something went wrong"
salt.modules.test.rand_sleep(max=60) Sleep for a random number of seconds, used to test long-running commands and minions returning at differing intervals
salt '*' test.rand_sleep 60
salt.modules.test.rand_str(size=9999999999, hash_type=None) This function has been renamed to test.random_hash. This function will stay to ensure backwards compatibility, but please switch to using the preferred name test.random_hash.
salt.modules.test.random_hash(size=9999999999, hash_type=None) New in version 2015.5.2.
Changed in version 2018.3.0: Function has been renamed from test.rand_str to test.random_hash
Generates a random number between 1 and size, then returns a hash of that number. If no hash_type is passed, the hash_type specified by the Minion's hash_type config option is used.
salt '*' test.random_hash salt '*' test.random_hash hash_type=sha512
salt.modules.test.retcode(code=42) Test that the returncode system is functioning correctly
salt '*' test.retcode 42
salt.modules.test.sleep(length) Instruct the minion to initiate a process that will sleep for a given period of time.
salt '*' test.sleep 20
salt.modules.test.stack() Return the current stack trace
salt '*' test.stack
salt.modules.test.true_() Always return True
salt '*' test.true
salt.modules.test.try_(module, return_try_exception=False, **kwargs) Try to run a module command. On an exception return None.  If return_try_exception is set to True, return the exception.  This can be helpful in templates where running a module might fail as expected.
{% for i in range(0,230) %} {{ salt['test.try'](module='ipmi.get_users', bmc_host='172.2.2.'+i)|yaml(False) }} {% endfor %}
salt.modules.test.tty(*args, **kwargs) Deprecated! Moved to cmd.tty
salt '*' test.tty tty0 'This is a test' salt '*' test.tty pts3 'This is a test'
salt.modules.test.version() Return the version of salt on the minion
salt.modules.test.versions() This function is an alias of versions_report. Returns versions of components used by salt
salt '*' test.versions_report
salt.modules.test.versions_information() Report the versions of dependent and system software
salt '*' test.versions_information
salt.modules.test.versions_report() Returns versions of components used by salt
salt.modules.test_virtual Module for running arbitrary tests with a __virtual__ function
salt.modules.test_virtual.ping()
salt.modules.testinframod This module exposes the functionality of the TestInfra library for use with SaltStack in order to verify the state of your minions.  In order to allow for the addition of new resource types in TestInfra this module dynamically generates wrappers for the various resources by iterating over the values in the __all__ variable exposed by the testinfra.modules namespace.
exception salt.modules.testinframod.InvalidArgumentError
salt.modules.testinframod.camel_to_snake_case(camel_input) Converts camelCase (or CamelCase) to snake_case.  From https://codereview.stackexchange.com/questions/185966/functions-to-convert-camelcase-strings-to-snake-case
Parameters camel_input (str) -- The camelcase or CamelCase string to convert to snake_case
:return str
salt.modules.testinframod.snake_to_camel_case(snake_input, uppercamel=False) Converts snake_case to camelCase (or CamelCase if uppercamel is True).  Inspired by https://codereview.stackexchange.com/questions/85311/transform-snake-case-to-camelcase
• snake_input (str) -- The input snake_case string to convert to camelCase
• uppercamel (bool) -- Whether or not to convert to CamelCase instead
salt.modules.textfsm_mod TextFSM New in version 2018.3.0.
Execution module that processes plain text and extracts data using TextFSM templates. The output is presented in JSON serializable data, and can be easily re-used in other modules, or directly inside the renderer (Jinja, Mako, Genshi, etc.).
• textfsm Python library
NOTE: Install  textfsm library: pip install textfsm.
salt.modules.textfsm_mod.extract(template_path, raw_text=None, raw_text_file=None, saltenv='base') Extracts the data entities from the unstructured raw text sent as input and returns the data mapping, processing using the TextFSM template.
template_path The path to the TextFSM template.  This can be specified using the absolute path to the file, or using one of the following URL schemes:
raw_text: None The unstructured text to be parsed.
raw_text_file: None Text file to read, having the raw text to be parsed using the TextFSM template.  Supports the same URL schemes as the template_path argument.
saltenv: base Salt fileserver environment from which to retrieve the file.  Ignored if template_path is not a salt:// URL.
salt '*' textfsm.extract salt://textfsm/juniper_version_template raw_text_file=s3://junos_ver.txt salt '*' textfsm.extract http://some-server/textfsm/juniper_version_template raw_text='Hostname: router.abc ... snip ...'
Jinja template example:
{%- set raw_text = 'Hostname: router.abc ... snip ...' -%} {%- set textfsm_extract = salt.textfsm.extract('https://some-server/textfsm/juniper_version_template', raw_text) -%}
Raw text example:
Hostname: router.abc Model: mx960 JUNOS Base OS boot [9.1S3.5] JUNOS Base OS Software Suite [9.1S3.5] JUNOS Kernel Software Suite [9.1S3.5] JUNOS Crypto Software Suite [9.1S3.5] JUNOS Packet Forwarding Engine Support (M/T Common) [9.1S3.5] JUNOS Packet Forwarding Engine Support (MX Common) [9.1S3.5] JUNOS Online Documentation [9.1S3.5] JUNOS Routing Software Suite [9.1S3.5]
TextFSM Example:
Value Chassis (\S+) Value Required Model (\S+) Value Boot (.*) Value Base (.*) Value Kernel (.*) Value Crypto (.*) Value Documentation (.*) Value Routing (.*)
Start # Support multiple chassis systems. ^\S+:$$ -> Continue.Record ^${Chassis}:$$ ^Model: ${Model} ^JUNOS Base OS boot \[${Boot}\] ^JUNOS Software Release \[${Base}\] ^JUNOS Base OS Software Suite \[${Base}\] ^JUNOS Kernel Software Suite \[${Kernel}\] ^JUNOS Crypto Software Suite \[${Crypto}\] ^JUNOS Online Documentation \[${Documentation}\] ^JUNOS Routing Software Suite \[${Routing}\]
{ "comment": "", "result": true, "out": [ { "kernel": "9.1S3.5", "documentation": "9.1S3.5", "boot": "9.1S3.5", "crypto": "9.1S3.5", "chassis": "", "routing": "9.1S3.5", "base": "9.1S3.5", "model": "mx960" } ] }
salt.modules.textfsm_mod.index(command, platform=None, platform_grain_name=None, platform_column_name=None, output=None, output_file=None, textfsm_path=None, index_file=None, saltenv='base', include_empty=False, include_pat=None, exclude_pat=None) Dynamically identify the template required to extract the information from the unstructured raw text.
The output has the same structure as the extract execution function, the difference being that index is capable to identify what template to use, based on the platform details and the command.
command The command executed on the device, to get the output.
platform The platform name, as defined in the TextFSM index file.
NOTE: For ease of use, it is recommended to define the TextFSM indexfile with values that can be matches using the grains.
platform_grain_name The name of the grain used to identify the platform name in the TextFSM index file.
NOTE: This option is ignored when platform is specified.
output The raw output from the device, to be parsed and extract the structured data.
output_file The path to a file that contains the raw output from the device, used to extract the structured data.  This option supports the usual Salt-specific schemes: file://, salt://, http://, https://, ftp://, s3://, swift://.
textfsm_path The path where the TextFSM templates can be found. This can be either absolute path on the server, either specified using the following URL schemes: file://, salt://, http://, https://, ftp://, s3://, swift://.
salt '*' textfsm.index 'sh ver' platform=Juniper output_file=salt://textfsm/juniper_version_example textfsm_path=salt://textfsm/ salt '*' textfsm.index 'sh ver' output_file=salt://textfsm/juniper_version_example textfsm_path=ftp://textfsm/ platform_column_name=Vendor salt '*' textfsm.index 'sh ver' output_file=salt://textfsm/juniper_version_example textfsm_path=https://some-server/textfsm/ platform_column_name=Vendor platform_grain_name=vendor
TextFSM index file example:
salt://textfsm/index
Template, Hostname, Vendor, Command juniper_version_template, .*, Juniper, sh[[ow]] ve[[rsion]]
The usage can be simplified, by defining (some of) the following options: textfsm_platform_grain, textfsm_path, textfsm_platform_column_name, or textfsm_index_file, in the (proxy) minion configuration file or pillar.
textfsm_platform_grain: vendor textfsm_path: salt://textfsm/ textfsm_platform_column_name: Vendor
And the CLI usage becomes as simple as:
salt '*' textfsm.index 'sh ver' output_file=salt://textfsm/juniper_version_example
Usgae inside a Jinja template:
{%- set command = 'sh ver' -%} {%- set output = salt.net.cli(command) -%} {%- set textfsm_extract = salt.textfsm.index(command, output=output) -%}
salt.modules.timezone Module for managing timezone on POSIX-like systems.
salt.modules.timezone.get_hwclock() Get current hardware clock setting (UTC or localtime)
salt.modules.timezone.get_offset() Get current numeric timezone offset from UTC (i.e. -0700)
salt.modules.timezone.get_zone() Get current timezone (i.e. America/Denver)
NOTE: On AIX operating systems, Posix values can also be returned 'CST6CDT,M3.2.0/2:00:00,M11.1.0/2:00:00'
salt.modules.timezone.get_zonecode() Get current timezone (i.e. PST, MDT, etc)
salt.modules.timezone.set_hwclock(clock) Sets the hardware clock to be either UTC or localtime
salt.modules.timezone.set_zone(timezone) Unlinks, then symlinks /etc/localtime to the set timezone.
The timezone is crucial to several system processes, each of which SHOULD be restarted (for instance, whatever you system uses as its cron and syslog daemons). This will not be automagically done and must be done manually!
salt '*' timezone.set_zone 'America/Denver'
NOTE: On AIX operating systems, Posix values are also allowed, see below
salt '*' timezone.set_zone 'CST6CDT,M3.2.0/2:00:00,M11.1.0/2:00:00'
salt.modules.timezone.zone_compare(timezone) Compares the given timezone name with the system timezone name. Checks the hash sum between the given timezone, and the one set in /etc/localtime. Returns True if names and hash sums match, and False if not.  Mostly useful for running state checks.
NOTE: On Solaris-link operating systems only a string comparison is done.
NOTE: On AIX operating systems only a string comparison is done.
salt '*' timezone.zone_compare 'America/Denver'
salt.modules.tls A salt module for SSL/TLS.  Can create a Certificate Authority (CA) or use Self-Signed certificates.
depends PyOpenSSL Python module (0.10 or later, 0.14 or later for X509 extension support)
configuration Add the following values in /etc/salt/minion for the CA module to function properly:
ca.cert_base_path: '/etc/pki'
CLI Example #1: Creating a CA, a server request and its signed certificate:
# salt-call tls.create_ca my_little \ days=5 \ CN='My Little CA' \ C=US \ ST=Utah \ L=Salt Lake City \ O=Saltstack \ emailAddress=pleasedontemail@example.com
Created Private Key: "/etc/pki/my_little/my_little_ca_cert.key" Created CA "my_little_ca": "/etc/pki/my_little_ca/my_little_ca_cert.crt"
# salt-call tls.create_csr my_little CN=www.example.com Created Private Key: "/etc/pki/my_little/certs/www.example.com.key Created CSR for "www.example.com": "/etc/pki/my_little/certs/www.example.com.csr"
# salt-call tls.create_ca_signed_cert my_little CN=www.example.com Created Certificate for "www.example.com": /etc/pki/my_little/certs/www.example.com.crt"
CLI Example #2: Creating a client request and its signed certificate
# salt-call tls.create_csr my_little CN=DBReplica_No.1 cert_type=client Created Private Key: "/etc/pki/my_little/certs//DBReplica_No.1.key." Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.csr."
# salt-call tls.create_ca_signed_cert my_little CN=DBReplica_No.1 Created Certificate for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.crt"
CLI Example #3: Creating both a server and client req + cert for the same CN
# salt-call tls.create_csr my_little CN=MasterDBReplica_No.2  \ cert_type=client Created Private Key: "/etc/pki/my_little/certs/MasterDBReplica_No.2.key." Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/MasterDBReplica_No.2.csr."
# salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2 Created Certificate for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.crt"
# salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \ cert_type=server Certificate "MasterDBReplica_No.2" already exists
(doh!)
# salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \ cert_type=server type_ext=True Created Private Key: "/etc/pki/my_little/certs/DBReplica_No.1_client.key." Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1_client.csr."
# salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2 Certificate "MasterDBReplica_No.2" already exists
(DOH!)
# salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2 \ cert_type=server type_ext=True Created Certificate for "MasterDBReplica_No.2": "/etc/pki/my_little/certs/MasterDBReplica_No.2_server.crt"
CLI Example #4: Create a server req + cert with non-CN filename for the cert
# salt-call tls.create_csr my_little CN=www.anothersometh.ing \ cert_type=server type_ext=True Created Private Key: "/etc/pki/my_little/certs/www.anothersometh.ing_server.key." Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/www.anothersometh.ing_server.csr."
# salt-call tls_create_ca_signed_cert my_little CN=www.anothersometh.ing \ cert_type=server cert_filename="something_completely_different" Created Certificate for "www.anothersometh.ing": /etc/pki/my_little/certs/something_completely_different.crt
salt.modules.tls.ca_exists(ca_name, cacert_path=None, ca_filename=None) Verify whether a Certificate Authority (CA) already exists
ca_name name of the CA
cacert_path absolute path to ca certificates root directory
ca_filename alternative filename for the CA
salt '*' tls.ca_exists test_ca /etc/certs
salt.modules.tls.cert_base_path(cacert_path=None) Return the base path for certs from CLI or from options
salt '*' tls.cert_base_path
salt.modules.tls.cert_info(cert, digest='sha256') Return information for a particular certificate
cert   path to the certifiate PEM file or string
Changed in version 2018.3.4.
digest what digest to use for fingerprinting
salt '*' tls.cert_info /dir/for/certs/cert.pem
salt.modules.tls.create_ca(ca_name, bits=2048, days=365, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='SaltStack', OU=None, emailAddress=None, fixmode=False, cacert_path=None, ca_filename=None, digest='sha256', onlyif=None, unless=None, replace=False) Create a Certificate Authority (CA)
bits   number of RSA key bits, default is 2048
days   number of days the CA will be valid, default is 365
CN     common name in the request, default is "localhost"
C      country, default is "US"
ST     state, default is "Utah"
L      locality, default is "Centerville", the city where SaltStack originated
O      organization, default is "SaltStack"
OU     organizational unit, default is None
emailAddress email address for the CA owner, default is None
digest The message digest algorithm. Must be a string describing a digest algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically).  For example, "md5" or "sha1". Default: 'sha256'
replace Replace this certificate even if it exists
New in version 2015.5.1.
Writes out a CA certificate based upon defined config values. If the file already exists, the function just returns assuming the CA certificate already exists.
If the following values were set:
ca.cert_base_path='/etc/pki' ca_name='koji'
the resulting CA, and corresponding key, would be written in the following location with appropriate permissions:
/etc/pki/koji/koji_ca_cert.crt /etc/pki/koji/koji_ca_cert.key
salt '*' tls.create_ca test_ca
salt.modules.tls.create_ca_signed_cert(ca_name, CN, days=365, cacert_path=None, ca_filename=None, cert_path=None, cert_filename=None, digest='sha256', cert_type=None, type_ext=False, replace=False) Create a Certificate (CERT) signed by a named Certificate Authority (CA)
If the certificate file already exists, the function just returns assuming the CERT already exists.
The CN must match an existing CSR generated by create_csr. If it does not, this method does nothing.
CN     common name matching the certificate signing request
days   number of days certificate is valid, default is 365 (1 year)
cert_path full path to the certificates directory
cert_filename alternative filename for the certificate, useful when using special characters in the CN. If this option is set it will override the certificate filename output effects of cert_type.  type_ext will be completely overridden.
cert_type string. Either 'server' or 'client' (see create_csr() for details).
If create_csr(type_ext=True) this function must be called with the same cert_type so it can find the CSR file.
NOTE: create_csr() defaults to cert_type='server'; therefore, if it was also called with type_ext, cert_type becomes a required argument for create_ca_signed_cert()
type_ext bool. If set True, use cert_type as an extension to the CN when formatting the filename.
e.g.: some_subject_CN_server.crt or some_subject_CN_client.crt
This facilitates the context where both types are required for the same subject
If cert_filename is not None, setting type_ext has no effect
ca.cert_base_path='/etc/pki' ca_name='koji' CN='test.egavas.org'
the resulting signed certificate would be written in the following location:
/etc/pki/koji/certs/test.egavas.org.crt
salt '*' tls.create_ca_signed_cert test localhost
salt.modules.tls.create_csr(ca_name, bits=2048, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='SaltStack', OU=None, emailAddress=None, subjectAltName=None, cacert_path=None, ca_filename=None, csr_path=None, csr_filename=None, digest='sha256', type_ext=False, cert_type='server', replace=False) Create a Certificate Signing Request (CSR) for a particular Certificate Authority (CA)
O      organization, default is "SaltStack" NOTE: Must the same as CA certificate or an error will be raised
emailAddress email address for the request, default is None
subjectAltName valid subjectAltNames in full form, e.g. to add DNS entry you would call this function with this value:
examples: ['DNS:somednsname.com', 'DNS:1.2.3.4', 'IP:1.2.3.4', 'IP:2001:4801:7821:77:be76:4eff:fe11:e51', 'email:me@i.like.pie.com']
NOTE: some libraries do not properly query IP: prefixes, instead looking for the given req. source with a DNS: prefix. To be thorough, you may want to include both DNS: and IP: entries if you are using subjectAltNames for destinations for your TLS connections.  e.g.: requests to https://1.2.3.4 will fail from python's requests library w/out the second entry in the above list
cert_type Specify the general certificate type. Can be either server or client. Indicates the set of common extensions added to the CSR.
server: { 'basicConstraints': 'CA:FALSE', 'extendedKeyUsage': 'serverAuth', 'keyUsage': 'digitalSignature, keyEncipherment' }
client: { 'basicConstraints': 'CA:FALSE', 'extendedKeyUsage': 'clientAuth', 'keyUsage': 'nonRepudiation, digitalSignature, keyEncipherment' }
type_ext boolean.  Whether or not to extend the filename with CN_[cert_type] This can be useful if a server and client certificate are needed for the same CN. Defaults to False to avoid introducing an unexpected file naming pattern
The files normally named some_subject_CN.csr and some_subject_CN.key will then be saved
replace Replace this signing request even if it exists
Writes out a Certificate Signing Request (CSR) If the file already exists, the function just returns assuming the CSR already exists.
the resulting CSR, and corresponding key, would be written in the following location with appropriate permissions:
/etc/pki/koji/certs/test.egavas.org.csr /etc/pki/koji/certs/test.egavas.org.key
salt '*' tls.create_csr test
salt.modules.tls.create_empty_crl(ca_name, cacert_path=None, ca_filename=None, crl_file=None, digest='sha256') Create an empty Certificate Revocation List.
crl_file full path to the CRL file
salt '*' tls.create_empty_crl ca_name='koji'                 ca_filename='ca'                 crl_file='/etc/openvpn/team1/crl.pem'
salt.modules.tls.create_pkcs12(ca_name, CN, passphrase='', cacert_path=None, replace=False) Create a PKCS#12 browser certificate for a particular Certificate (CN)
passphrase used to unlock the PKCS#12 certificate when loaded into the browser
/etc/pki/koji/certs/test.egavas.org.p12
salt '*' tls.create_pkcs12 test localhost
salt.modules.tls.create_self_signed_cert(tls_dir='tls', bits=2048, days=365, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='SaltStack', OU=None, emailAddress=None, cacert_path=None, cert_filename=None, digest='sha256', replace=False) Create a Self-Signed Certificate (CERT)
tls_dir location appended to the ca.cert_base_path, default is 'tls'
Writes out a Self-Signed Certificate (CERT). If the file already exists, the function just returns.
ca.cert_base_path='/etc/pki' tls_dir='koji' CN='test.egavas.org'
the resulting CERT, and corresponding key, would be written in the following location with appropriate permissions:
/etc/pki/koji/certs/test.egavas.org.crt /etc/pki/koji/certs/test.egavas.org.key
salt '*' tls.create_self_signed_cert
Passing options from the command line:
salt 'minion' tls.create_self_signed_cert CN='test.mysite.org'
salt.modules.tls.get_ca(ca_name, as_text=False, cacert_path=None) Get the certificate path or content
as_text if true, return the certificate content instead of the path
salt '*' tls.get_ca test_ca as_text=False cacert_path=/etc/certs
salt.modules.tls.get_ca_signed_cert(ca_name, CN='localhost', as_text=False, cacert_path=None, cert_filename=None) Get the certificate path or content
CN     common name of the certificate
cacert_path absolute path to certificates root directory
cert_filename alternative filename for the certificate, useful when using special characters in the CN
salt '*' tls.get_ca_signed_cert test_ca CN=localhost as_text=False cacert_path=/etc/certs
salt.modules.tls.get_ca_signed_key(ca_name, CN='localhost', as_text=False, cacert_path=None, key_filename=None) Get the certificate path or content
key_filename alternative filename for the key, useful when using special characters
in the CN
salt '*' tls.get_ca_signed_key                 test_ca CN=localhost                 as_text=False                 cacert_path=/etc/certs
salt.modules.tls.get_expiration_date(cert, date_format='%Y-%m-%d') New in version 2019.2.0.
Get a certificate's expiration date
cert   Full path to the certificate
date_format By default this will return the expiration date in YYYY-MM-DD format, use this to specify a different strftime format string. Note that the expiration time will be in UTC.
salt '*' tls.get_expiration_date /path/to/foo.crt salt '*' tls.get_expiration_date /path/to/foo.crt date_format='%d/%m/%Y'
salt.modules.tls.get_extensions(cert_type) Fetch X509 and CSR extension definitions from tls:extensions: (common|server|client) or set them to standard defaults.
cert_type: The type of certificate such as server or client.
salt '*' tls.get_extensions client
salt.modules.tls.maybe_fix_ssl_version(ca_name, cacert_path=None, ca_filename=None) Check that the X509 version is correct (was incorrectly set in previous salt versions).  This will fix the version if needed.
ca_name ca authority name
salt '*' tls.maybe_fix_ssl_version test_ca /etc/certs
salt.modules.tls.revoke_cert(ca_name, CN, cacert_path=None, ca_filename=None, cert_path=None, cert_filename=None, crl_file=None, digest='sha256') Revoke a certificate.
ca_name Name of the CA.
CN     Common name matching the certificate signing request.
cacert_path Absolute path to ca certificates root directory.
ca_filename Alternative filename for the CA.
cert_path Path to the cert file.
cert_filename Alternative filename for the certificate, useful when using special characters in the CN.
crl_file Full path to the CRL file.
salt '*' tls.revoke_cert ca_name='koji'                 ca_filename='ca'                 crl_file='/etc/openvpn/team1/crl.pem'
salt.modules.tls.set_ca_path(cacert_path) If wanted, store the aforementioned cacert_path in context to be used as the basepath for further operations
salt '*' tls.set_ca_path /etc/certs
salt.modules.tls.validate(cert, ca_name, crl_file) New in version 3000.
Validate a certificate against a given CA/CRL.
salt.modules.tomcat Support for Tomcat
This module uses the manager webapp to manage Apache tomcat webapps.  If the manager webapp is not configured some of the functions won't work.
• Java bin path should be in default path
• If ipv6 is enabled make sure you permit manager access to ipv6 interface "0:0:0:0:0:0:0:1"
• If you are using tomcat.tar.gz it has to be installed or symlinked under /opt, preferably using name tomcat
• "tomcat.signal start/stop" works but it does not use the startup scripts
The following grains/pillar should be set:
tomcat-manager: user: <username> passwd: <password>
or the old format:
tomcat-manager.user: <username> tomcat-manager.passwd: <password>
Also configure a user in the conf/tomcat-users.xml file:
<?xml version='1.0' encoding='utf-8'?> <tomcat-users> <role rolename="manager-script"/> <user username="tomcat" password="tomcat" roles="manager-script"/> </tomcat-users>
• More information about tomcat manager: http://tomcat.apache.org/tomcat-7.0-doc/manager-howto.html
• if you use only this module for deployments you've might want to strict access to the manager only from localhost for more info: http://tomcat.apache.org/tomcat-7.0-doc/manager-howto.html#Configuring_Manager_Application_Access
• Tested on:
JVM Vendor: Sun Microsystems Inc.
JVM Version: 1.6.0_43-b01
OS Architecture: amd64
OS Name: Linux
OS Version: 2.6.32-358.el6.x86_64
Tomcat Version: Apache Tomcat/7.0.37
salt.modules.tomcat.deploy_war(war, context, force='no', url='http://localhost:8080/manager', saltenv='base', timeout=180, temp_war_location=None, version=True) Deploy a WAR file
war    absolute path to WAR file (should be accessible by the user running tomcat) or a path supported by the salt.modules.cp.get_file function
context the context path to deploy
force  False set True to deploy the webapp even one is deployed in the context
url    http://localhost:8080/manager the URL of the server manager webapp
saltenv base the environment for WAR file in used by salt.modules.cp.get_url function
timeout 180 timeout for HTTP request
temp_war_location None use another location to temporarily copy to war file by default the system's temp directory is used
version '' Specify the war version.  If this argument is provided, it overrides the version encoded in the war file name, if one is present.
salt '*' tomcat.deploy_war salt://salt-2015.8.6.war version=2015.08.r6
New in version 2015.8.6.
cp module
salt '*' tomcat.deploy_war salt://application.war /api salt '*' tomcat.deploy_war salt://application.war /api no salt '*' tomcat.deploy_war salt://application.war /api yes http://localhost:8080/manager
minion local file system
salt '*' tomcat.deploy_war /tmp/application.war /api salt '*' tomcat.deploy_war /tmp/application.war /api no salt '*' tomcat.deploy_war /tmp/application.war /api yes http://localhost:8080/manager
salt.modules.tomcat.extract_war_version(war) Extract the version from the war file name. There does not seem to be a standard for encoding the version into the war file name
/path/salt-2015.8.6.war -> 2015.8.6 /path/V6R2013xD5.war -> None
salt.modules.tomcat.fullversion() Return all server information from catalina.sh version
salt '*' tomcat.fullversion
salt.modules.tomcat.leaks(url='http://localhost:8080/manager', timeout=180) Find memory leaks in tomcat
salt '*' tomcat.leaks
salt.modules.tomcat.ls(url='http://localhost:8080/manager', timeout=180) list all the deployed webapps
salt '*' tomcat.ls salt '*' tomcat.ls http://localhost:8080/manager
salt.modules.tomcat.passwd(passwd, user='', alg='sha1', realm=None) This function replaces the $CATALINA_HOME/bin/digest.sh script convert a clear-text password to the $CATALINA_BASE/conf/tomcat-users.xml format
salt '*' tomcat.passwd secret salt '*' tomcat.passwd secret tomcat sha1 salt '*' tomcat.passwd secret tomcat sha1 'Protected Realm'
salt.modules.tomcat.reload_(app, url='http://localhost:8080/manager', timeout=180) Reload the webapp
app    the webapp context path
salt '*' tomcat.reload /jenkins salt '*' tomcat.reload /jenkins http://localhost:8080/manager
salt.modules.tomcat.serverinfo(url='http://localhost:8080/manager', timeout=180) return details about the server
salt '*' tomcat.serverinfo salt '*' tomcat.serverinfo http://localhost:8080/manager
salt.modules.tomcat.sessions(app, url='http://localhost:8080/manager', timeout=180) return the status of the webapp sessions
salt '*' tomcat.sessions /jenkins salt '*' tomcat.sessions /jenkins http://localhost:8080/manager
salt.modules.tomcat.signal(signal=None) Signals catalina to start, stop, securestart, forcestop.
salt '*' tomcat.signal start
salt.modules.tomcat.start(app, url='http://localhost:8080/manager', timeout=180) Start the webapp
timeout timeout for HTTP request
salt '*' tomcat.start /jenkins salt '*' tomcat.start /jenkins http://localhost:8080/manager
salt.modules.tomcat.status(url='http://localhost:8080/manager', timeout=180) Used to test if the tomcat manager is up
salt '*' tomcat.status salt '*' tomcat.status http://localhost:8080/manager
salt.modules.tomcat.status_webapp(app, url='http://localhost:8080/manager', timeout=180) return the status of the webapp (stopped | running | missing)
salt '*' tomcat.status_webapp /jenkins salt '*' tomcat.status_webapp /jenkins http://localhost:8080/manager
salt.modules.tomcat.stop(app, url='http://localhost:8080/manager', timeout=180) Stop the webapp
salt '*' tomcat.stop /jenkins salt '*' tomcat.stop /jenkins http://localhost:8080/manager
salt.modules.tomcat.undeploy(app, url='http://localhost:8080/manager', timeout=180) Undeploy a webapp
salt '*' tomcat.undeploy /jenkins salt '*' tomcat.undeploy /jenkins http://localhost:8080/manager
salt.modules.tomcat.version() Return server version from catalina.sh version
salt '*' tomcat.version
salt.modules.trafficserver Apache Traffic Server execution module.
traffic_ctl is used to execute individual Traffic Server commands and to script multiple commands in a shell.
salt.modules.trafficserver.alarms() List all alarm events that have not been acknowledged (cleared).
salt '*' trafficserver.alarms
salt.modules.trafficserver.bounce_cluster() Bounce all Traffic Server nodes in the cluster. Bouncing Traffic Server shuts down and immediately restarts Traffic Server, node-by-node.
salt '*' trafficserver.bounce_cluster
salt.modules.trafficserver.bounce_local(drain=False) Bounce Traffic Server on the local node. Bouncing Traffic Server shuts down and immediately restarts the Traffic Server node.
drain  This option modifies the restart behavior such that traffic_server is not shut down until the number of active client connections drops to the number given by the proxy.config.restart.active_client_threshold configuration variable.
salt '*' trafficserver.bounce_local salt '*' trafficserver.bounce_local drain=True
salt.modules.trafficserver.clear_alarms(alarm) Clear (acknowledge) an alarm event. The arguments are “all” for all current alarms, a specific alarm number (e.g. ‘‘1’‘), or an alarm string identifier (e.g. ‘’MGMT_ALARM_PROXY_CONFIG_ERROR’‘).
salt '*' trafficserver.clear_alarms [all | #event | name]
salt.modules.trafficserver.clear_cluster() Clears accumulated statistics on all nodes in the cluster.
salt '*' trafficserver.clear_cluster
salt.modules.trafficserver.clear_node() Clears accumulated statistics on the local node.
salt '*' trafficserver.clear_node
salt.modules.trafficserver.match_config(regex) Display the current values of all configuration variables whose names match the given regular expression.
salt '*' trafficserver.match_config regex
salt.modules.trafficserver.match_metric(regex) Display the current values of all metrics whose names match the given regular expression.
salt '*' trafficserver.match_metric regex
salt.modules.trafficserver.offline(path) Mark a cache storage device as offline. The storage is identified by a path which must match exactly a path specified in storage.config. This removes the storage from the cache and redirects requests that would have used this storage to other storage. This has exactly the same effect as a disk failure for that storage. This does not persist across restarts of the traffic_server process.
salt '*' trafficserver.offline /path/to/cache
salt.modules.trafficserver.read_config(*args) Read Traffic Server configuration variable definitions.
salt '*' trafficserver.read_config proxy.config.http.keep_alive_post_out
salt.modules.trafficserver.read_metric(*args) Read Traffic Server one or more metrics.
salt '*' trafficserver.read_metric proxy.process.http.tcp_hit_count_stat
salt.modules.trafficserver.refresh() Initiate a Traffic Server configuration file reread. Use this command to update the running configuration after any configuration file modification.
The timestamp of the last reconfiguration event (in seconds since epoch) is published in the proxy.node.config.reconfigure_time metric.
salt '*' trafficserver.refresh