Saltstack Official Linux Formula
Вы не можете выбрать более 25 тем Темы должны начинаться с буквы или цифры, могут содержать дефисы(-) и должны содержать не более 35 символов.

7 лет назад
9 лет назад
9 лет назад
7 лет назад
9 лет назад
7 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
7 лет назад
7 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
8 лет назад
8 лет назад
8 лет назад
8 лет назад
8 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
7 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
9 лет назад
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521
  1. ============
  2. Linux Fomula
  3. ============
  4. Linux Operating Systems:
  5. * Ubuntu
  6. * CentOS
  7. * RedHat
  8. * Fedora
  9. * Arch
  10. Sample Pillars
  11. ==============
  12. Linux System
  13. ------------
  14. Basic Linux box
  15. .. code-block:: yaml
  16. linux:
  17. system:
  18. enabled: true
  19. name: 'node1'
  20. domain: 'domain.com'
  21. cluster: 'system'
  22. environment: prod
  23. timezone: 'Europe/Prague'
  24. utc: true
  25. Linux with system users, some with password set:
  26. .. warning:: If no ``password`` variable is passed,
  27. any predifined password will be removed.
  28. .. code-block:: yaml
  29. linux:
  30. system:
  31. ...
  32. user:
  33. jdoe:
  34. name: 'jdoe'
  35. enabled: true
  36. sudo: true
  37. shell: /bin/bash
  38. full_name: 'Jonh Doe'
  39. home: '/home/jdoe'
  40. home_dir_mode: 755
  41. email: 'jonh@doe.com'
  42. unique: false
  43. jsmith:
  44. name: 'jsmith'
  45. enabled: true
  46. full_name: 'With clear password'
  47. home: '/home/jsmith'
  48. hash_password: true
  49. password: "userpassword"
  50. mark:
  51. name: 'mark'
  52. enabled: true
  53. full_name: "unchange password'
  54. home: '/home/mark'
  55. password: false
  56. elizabeth:
  57. name: 'elizabeth'
  58. enabled: true
  59. full_name: 'With hased password'
  60. home: '/home/elizabeth'
  61. password: "$6$nUI7QEz3$dFYjzQqK5cJ6HQ38KqG4gTWA9eJu3aKx6TRVDFh6BVJxJgFWg2akfAA7f1fCxcSUeOJ2arCO6EEI6XXnHXxG10"
  62. Configure password expiration parameters
  63. ----------------------------------------
  64. The following login.defs parameters can be overridden per-user:
  65. * PASS_MAX_DAYS
  66. * PASS_MIN_DAYS
  67. * PASS_WARN_DAYS
  68. * INACTIVE
  69. .. code-block:: yaml
  70. linux:
  71. system:
  72. ...
  73. user:
  74. jdoe:
  75. name: 'jdoe'
  76. enabled: true
  77. ...
  78. maxdays: <PASS_MAX_DAYS>
  79. mindays: <PASS_MIN_DAYS>
  80. warndays: <PASS_WARN_DAYS>
  81. inactdays: <INACTIVE>
  82. Configure sudo for users and groups under ``/etc/sudoers.d/``.
  83. This ways ``linux.system.sudo`` pillar map to actual sudo attributes:
  84. .. code-block:: jinja
  85. # simplified template:
  86. Cmds_Alias {{ alias }}={{ commands }}
  87. {{ user }} {{ hosts }}=({{ runas }}) NOPASSWD: {{ commands }}
  88. %{{ group }} {{ hosts }}=({{ runas }}) NOPASSWD: {{ commands }}
  89. # when rendered:
  90. saltuser1 ALL=(ALL) NOPASSWD: ALL
  91. .. code-block:: yaml
  92. linux:
  93. system:
  94. sudo:
  95. enabled: true
  96. aliases:
  97. host:
  98. LOCAL:
  99. - localhost
  100. PRODUCTION:
  101. - db1
  102. - db2
  103. runas:
  104. DBA:
  105. - postgres
  106. - mysql
  107. SALT:
  108. - root
  109. command:
  110. # Note: This is not 100% safe when ALL keyword is used, user still may modify configs and hide his actions.
  111. # Best practice is to specify full list of commands user is allowed to run.
  112. SUPPORT_RESTRICTED:
  113. - /bin/vi /etc/sudoers*
  114. - /bin/vim /etc/sudoers*
  115. - /bin/nano /etc/sudoers*
  116. - /bin/emacs /etc/sudoers*
  117. - /bin/su - root
  118. - /bin/su -
  119. - /bin/su
  120. - /usr/sbin/visudo
  121. SUPPORT_SHELLS:
  122. - /bin/sh
  123. - /bin/ksh
  124. - /bin/bash
  125. - /bin/rbash
  126. - /bin/dash
  127. - /bin/zsh
  128. - /bin/csh
  129. - /bin/fish
  130. - /bin/tcsh
  131. - /usr/bin/login
  132. - /usr/bin/su
  133. - /usr/su
  134. ALL_SALT_SAFE:
  135. - /usr/bin/salt state*
  136. - /usr/bin/salt service*
  137. - /usr/bin/salt pillar*
  138. - /usr/bin/salt grains*
  139. - /usr/bin/salt saltutil*
  140. - /usr/bin/salt-call state*
  141. - /usr/bin/salt-call service*
  142. - /usr/bin/salt-call pillar*
  143. - /usr/bin/salt-call grains*
  144. - /usr/bin/salt-call saltutil*
  145. SALT_TRUSTED:
  146. - /usr/bin/salt*
  147. users:
  148. # saltuser1 with default values: saltuser1 ALL=(ALL) NOPASSWD: ALL
  149. saltuser1: {}
  150. saltuser2:
  151. hosts:
  152. - LOCAL
  153. # User Alias DBA
  154. DBA:
  155. hosts:
  156. - ALL
  157. commands:
  158. - ALL_SALT_SAFE
  159. groups:
  160. db-ops:
  161. hosts:
  162. - ALL
  163. - '!PRODUCTION'
  164. runas:
  165. - DBA
  166. commands:
  167. - /bin/cat *
  168. - /bin/less *
  169. - /bin/ls *
  170. salt-ops:
  171. hosts:
  172. - 'ALL'
  173. runas:
  174. - SALT
  175. commands:
  176. - SUPPORT_SHELLS
  177. salt-ops-2nd:
  178. name: salt-ops
  179. nopasswd: false
  180. setenv: true # Enable sudo -E option
  181. runas:
  182. - DBA
  183. commands:
  184. - ALL
  185. - '!SUPPORT_SHELLS'
  186. - '!SUPPORT_RESTRICTED'
  187. Linux with package, latest version:
  188. .. code-block:: yaml
  189. linux:
  190. system:
  191. ...
  192. package:
  193. package-name:
  194. version: latest
  195. Linux with package from certail repo, version with no upgrades:
  196. .. code-block:: yaml
  197. linux:
  198. system:
  199. ...
  200. package:
  201. package-name:
  202. version: 2132.323
  203. repo: 'custom-repo'
  204. hold: true
  205. Linux with package from certail repo, version with no GPG
  206. verification:
  207. .. code-block:: yaml
  208. linux:
  209. system:
  210. ...
  211. package:
  212. package-name:
  213. version: 2132.323
  214. repo: 'custom-repo'
  215. verify: false
  216. Linux with autoupdates (automatically install security package
  217. updates):
  218. .. code-block:: yaml
  219. linux:
  220. system:
  221. ...
  222. autoupdates:
  223. enabled: true
  224. mail: root@localhost
  225. mail_only_on_error: true
  226. remove_unused_dependencies: false
  227. automatic_reboot: true
  228. automatic_reboot_time: "02:00"
  229. Managing cron tasks
  230. -------------------
  231. There are two data structures that are related to managing cron itself and
  232. cron tasks:
  233. .. code-block:: yaml
  234. linux:
  235. system:
  236. cron:
  237. and
  238. .. code-block:: yaml
  239. linux:
  240. system:
  241. job:
  242. `linux:system:cron` manages cron packages, services, and '/etc/cron.allow' file.
  243. 'deny' files are managed the only way - we're ensuring they are absent, that's
  244. a requirement from CIS 5.1.8
  245. 'cron' pillar structure is the following:
  246. .. code-block:: yaml
  247. linux:
  248. system:
  249. cron:
  250. enabled: true
  251. pkgs: [ <cron packages> ]
  252. services: [ <cron services> ]
  253. user:
  254. <username>:
  255. enabled: true
  256. To add user to '/etc/cron.allow' use 'enabled' key as shown above.
  257. '/etc/cron.deny' is not managed as CIS 5.1.8 requires it was removed.
  258. A user would be ignored if any of the following is true:
  259. * user is disabled in `linux:system:user:<username>`
  260. * user is disabled in `linux:system:cron:user:<username>`
  261. `linux:system:job` manages individual cron tasks.
  262. By default, it will use name as an identifier, unless identifier key is
  263. explicitly set or False (then it will use Salt's default behavior which is
  264. identifier same as command resulting in not being able to change it):
  265. .. code-block:: yaml
  266. linux:
  267. system:
  268. ...
  269. job:
  270. cmd1:
  271. command: '/cmd/to/run'
  272. identifier: cmd1
  273. enabled: true
  274. user: 'root'
  275. hour: 2
  276. minute: 0
  277. Managing 'at' tasks
  278. -------------------
  279. Pillar for managing `at` tasks is similar to one for `cron` tasks:
  280. .. code-block:: yaml
  281. linux:
  282. system:
  283. at:
  284. enabled: true
  285. pkgs: [ <at packages> ]
  286. services: [ <at services> ]
  287. user:
  288. <username>:
  289. enabled: true
  290. To add a user to '/etc/at.allow' use 'enabled' key as shown above.
  291. '/etc/at.deny' is not managed as CIS 5.1.8 requires it was removed.
  292. A user will be ignored if any of the following is true:
  293. * user is disabled in `linux:system:user:<username>`
  294. * user is disabled in `linux:system:at:user:<username>`
  295. Linux security limits (limit sensu user memory usage to max 1GB):
  296. .. code-block:: yaml
  297. linux:
  298. system:
  299. ...
  300. limit:
  301. sensu:
  302. enabled: true
  303. domain: sensu
  304. limits:
  305. - type: hard
  306. item: as
  307. value: 1000000
  308. Enable autologin on ``tty1`` (may work only for Ubuntu 14.04):
  309. .. code-block:: yaml
  310. linux:
  311. system:
  312. console:
  313. tty1:
  314. autologin: root
  315. # Enable serial console
  316. ttyS0:
  317. autologin: root
  318. rate: 115200
  319. term: xterm
  320. To disable set autologin to ``false``.
  321. Set ``policy-rc.d`` on Debian-based systems. Action can be any available
  322. command in ``while true`` loop and ``case`` context.
  323. Following will disallow dpkg to stop/start services for the Cassandra
  324. package automatically:
  325. .. code-block:: yaml
  326. linux:
  327. system:
  328. policyrcd:
  329. - package: cassandra
  330. action: exit 101
  331. - package: '*'
  332. action: switch
  333. Set system locales:
  334. .. code-block:: yaml
  335. linux:
  336. system:
  337. locale:
  338. en_US.UTF-8:
  339. default: true
  340. "cs_CZ.UTF-8 UTF-8":
  341. enabled: true
  342. Systemd settings:
  343. .. code-block:: yaml
  344. linux:
  345. system:
  346. ...
  347. systemd:
  348. system:
  349. Manager:
  350. DefaultLimitNOFILE: 307200
  351. DefaultLimitNPROC: 307200
  352. user:
  353. Manager:
  354. DefaultLimitCPU: 2
  355. DefaultLimitNPROC: 4
  356. Ensure presence of directory:
  357. .. code-block:: yaml
  358. linux:
  359. system:
  360. directory:
  361. /tmp/test:
  362. user: root
  363. group: root
  364. mode: 700
  365. makedirs: true
  366. Ensure presence of file by specifying its source:
  367. .. code-block:: yaml
  368. linux:
  369. system:
  370. file:
  371. /tmp/test.txt:
  372. source: http://example.com/test.txt
  373. user: root #optional
  374. group: root #optional
  375. mode: 700 #optional
  376. dir_mode: 700 #optional
  377. encoding: utf-8 #optional
  378. hash: <<hash>> or <<URI to hash>> #optional
  379. makedirs: true #optional
  380. linux:
  381. system:
  382. file:
  383. test.txt:
  384. name: /tmp/test.txt
  385. source: http://example.com/test.txt
  386. linux:
  387. system:
  388. file:
  389. test2:
  390. name: /tmp/test2.txt
  391. source: http://example.com/test2.jinja
  392. template: jinja
  393. Ensure presence of file by specifying its contents:
  394. .. code-block:: yaml
  395. linux:
  396. system:
  397. file:
  398. /tmp/test.txt:
  399. contents: |
  400. line1
  401. line2
  402. linux:
  403. system:
  404. file:
  405. /tmp/test.txt:
  406. contents_pillar: linux:network:hostname
  407. linux:
  408. system:
  409. file:
  410. /tmp/test.txt:
  411. contents_grains: motd
  412. Ensure presence of file to be serialized through one of the
  413. serializer modules (see:
  414. https://docs.saltstack.com/en/latest/ref/serializers/all/index.html):
  415. .. code-block:: yaml
  416. linux:
  417. system:
  418. file:
  419. /tmp/test.json:
  420. serialize: json
  421. contents:
  422. foo: 1
  423. bar: 'bar'
  424. Kernel
  425. ~~~~~~
  426. Install always up to date LTS kernel and headers from Ubuntu Trusty:
  427. .. code-block:: yaml
  428. linux:
  429. system:
  430. kernel:
  431. type: generic
  432. lts: trusty
  433. headers: true
  434. Load kernel modules and add them to ``/etc/modules``:
  435. .. code-block:: yaml
  436. linux:
  437. system:
  438. kernel:
  439. modules:
  440. - nf_conntrack
  441. - tp_smapi
  442. - 8021q
  443. Configure or blacklist kernel modules with additional options to
  444. ``/etc/modprobe.d`` following example will add
  445. ``/etc/modprobe.d/nf_conntrack.conf`` file with line
  446. ``options nf_conntrack hashsize=262144``:
  447. 'option' can be a mapping (with 'enabled' and 'value' keys) or a scalar.
  448. Example for 'scalar' option value:
  449. .. code-block:: yaml
  450. linux:
  451. system:
  452. kernel:
  453. module:
  454. nf_conntrack:
  455. option:
  456. hashsize: 262144
  457. Example for 'mapping' option value:
  458. .. code-block:: yaml
  459. linux:
  460. system:
  461. kernel:
  462. module:
  463. nf_conntrack:
  464. option:
  465. hashsize:
  466. enabled: true
  467. value: 262144
  468. NOTE: 'enabled' key is optional and is True by default.
  469. Blacklist a module:
  470. .. code-block:: yaml
  471. linux:
  472. system:
  473. kernel:
  474. module:
  475. nf_conntrack:
  476. blacklist: true
  477. A module can have a number of aliases, wildcards are allowed.
  478. Define an alias for a module:
  479. .. code-block:: yaml
  480. linux:
  481. system:
  482. kernel:
  483. module:
  484. nf_conntrack:
  485. alias:
  486. nfct:
  487. enabled: true
  488. "nf_conn*":
  489. enabled: true
  490. NOTE: 'enabled' key is mandatory as there are no other keys exist.
  491. Execute custom command instead of 'insmod' when inserting a module:
  492. .. code-block:: yaml
  493. linux:
  494. system:
  495. kernel:
  496. module:
  497. nf_conntrack:
  498. install:
  499. enabled: true
  500. command: /bin/true
  501. NOTE: 'enabled' key is optional and is True by default.
  502. Execute custom command instead of 'rmmod' when removing a module:
  503. .. code-block:: yaml
  504. linux:
  505. system:
  506. kernel:
  507. module:
  508. nf_conntrack:
  509. remove:
  510. enabled: true
  511. command: /bin/true
  512. NOTE: 'enabled' key is optional and is True by default.
  513. Define module dependencies:
  514. .. code-block:: yaml
  515. linux:
  516. system:
  517. kernel:
  518. module:
  519. nf_conntrack:
  520. softdep:
  521. pre:
  522. 1:
  523. enabled: true
  524. value: a
  525. 2:
  526. enabled: true
  527. value: b
  528. 3:
  529. enabled: true
  530. value: c
  531. post:
  532. 1:
  533. enabled: true
  534. value: x
  535. 2:
  536. enabled: true
  537. value: y
  538. 3:
  539. enabled: true
  540. value: z
  541. NOTE: 'enabled' key is optional and is True by default.
  542. Install specific kernel version and ensure all other kernel packages are
  543. not present. Also install extra modules and headers for this kernel:
  544. .. code-block:: yaml
  545. linux:
  546. system:
  547. kernel:
  548. type: generic
  549. extra: true
  550. headers: true
  551. version: 4.2.0-22
  552. Systcl kernel parameters:
  553. .. code-block:: yaml
  554. linux:
  555. system:
  556. kernel:
  557. sysctl:
  558. net.ipv4.tcp_keepalive_intvl: 3
  559. net.ipv4.tcp_keepalive_time: 30
  560. net.ipv4.tcp_keepalive_probes: 8
  561. Configure kernel boot options:
  562. .. code-block:: yaml
  563. linux:
  564. system:
  565. kernel:
  566. boot_options:
  567. - elevator=deadline
  568. - spectre_v2=off
  569. - nopti
  570. CPU
  571. ~~~
  572. Enable cpufreq governor for every cpu:
  573. .. code-block:: yaml
  574. linux:
  575. system:
  576. cpu:
  577. governor: performance
  578. CGROUPS
  579. ~~~~~~~
  580. Setup linux cgroups:
  581. .. code-block:: yaml
  582. linux:
  583. system:
  584. cgroup:
  585. enabled: true
  586. group:
  587. ceph_group_1:
  588. controller:
  589. cpu:
  590. shares:
  591. value: 250
  592. cpuacct:
  593. usage:
  594. value: 0
  595. cpuset:
  596. cpus:
  597. value: 1,2,3
  598. memory:
  599. limit_in_bytes:
  600. value: 2G
  601. memsw.limit_in_bytes:
  602. value: 3G
  603. mapping:
  604. subjects:
  605. - '@ceph'
  606. generic_group_1:
  607. controller:
  608. cpu:
  609. shares:
  610. value: 250
  611. cpuacct:
  612. usage:
  613. value: 0
  614. mapping:
  615. subjects:
  616. - '*:firefox'
  617. - 'student:cp'
  618. Shared libraries
  619. ~~~~~~~~~~~~~~~~
  620. Set additional shared library to Linux system library path:
  621. .. code-block:: yaml
  622. linux:
  623. system:
  624. ld:
  625. library:
  626. java:
  627. - /usr/lib/jvm/jre-openjdk/lib/amd64/server
  628. - /opt/java/jre/lib/amd64/server
  629. Certificates
  630. ~~~~~~~~~~~~
  631. Add certificate authority into system trusted CA bundle:
  632. .. code-block:: yaml
  633. linux:
  634. system:
  635. ca_certificates:
  636. mycert: |
  637. -----BEGIN CERTIFICATE-----
  638. MIICPDCCAaUCEHC65B0Q2Sk0tjjKewPMur8wDQYJKoZIhvcNAQECBQAwXzELMAkG
  639. A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz
  640. cyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2
  641. MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV
  642. BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmlt
  643. YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN
  644. ADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhAwL0TPZ2RHP7gJYHyX3KqhE
  645. BarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lwdd8KkMaOIG+YD/is
  646. I19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpwIDAQABMA0G
  647. CSqGSIb3DQEBAgUAA4GBALtMEivPLCYATxQT3ab7/AoRhIzzKBxnki98tsX63/Do
  648. lbwdj2wsqFHMc9ikwFPwTtYmwHYBV4GSXiHx0bH/59AhWM1pF+NEHJwZRDmJXNyc
  649. AA9WjQKZ7aKQRUzkuxCkPfAyAw7xzvjoyVGM5mKf5p/AfbdynMk2OmufTqj/ZA1k
  650. -----END CERTIFICATE-----
  651. Sysfs
  652. ~~~~~
  653. Install sysfsutils and set sysfs attributes:
  654. .. code-block:: yaml
  655. linux:
  656. system:
  657. sysfs:
  658. scheduler:
  659. block/sda/queue/scheduler: deadline
  660. power:
  661. mode:
  662. power/state: 0660
  663. owner:
  664. power/state: "root:power"
  665. devices/system/cpu/cpu0/cpufreq/scaling_governor: powersave
  666. Optional: You can also use list that will ensure order of items.
  667. .. code-block:: yaml
  668. linux:
  669. system:
  670. sysfs:
  671. scheduler:
  672. block/sda/queue/scheduler: deadline
  673. power:
  674. - mode:
  675. power/state: 0660
  676. - owner:
  677. power/state: "root:power"
  678. - devices/system/cpu/cpu0/cpufreq/scaling_governor: powersave
  679. Sysfs definition with disabled automatic write. Attributes are saved
  680. to configuration, but are not applied during the run.
  681. Thay will be applied automatically after the reboot.
  682. .. code-block:: yaml
  683. linux:
  684. system:
  685. sysfs:
  686. enable_apply: false
  687. scheduler:
  688. block/sda/queue/scheduler: deadline
  689. .. note:: The `enable_apply` parameter defaults to `True` if not defined.
  690. Huge Pages
  691. ~~~~~~~~~~~~
  692. Huge Pages give a performance boost to applications that intensively deal
  693. with memory allocation/deallocation by decreasing memory fragmentation:
  694. .. code-block:: yaml
  695. linux:
  696. system:
  697. kernel:
  698. hugepages:
  699. small:
  700. size: 2M
  701. count: 107520
  702. mount_point: /mnt/hugepages_2MB
  703. mount: false/true # default is true (mount immediately) / false (just save in the fstab)
  704. large:
  705. default: true # default automatically mounted
  706. size: 1G
  707. count: 210
  708. mount_point: /mnt/hugepages_1GB
  709. .. note:: Not recommended to use both pagesizes concurrently.
  710. Intel SR-IOV
  711. ~~~~~~~~~~~~
  712. PCI-SIG Single Root I/O Virtualization and Sharing (SR-IOV)
  713. specification defines a standardized mechanism to virtualize
  714. PCIe devices. The mechanism can virtualize a single PCIe
  715. Ethernet controller to appear as multiple PCIe devices:
  716. .. code-block:: yaml
  717. linux:
  718. system:
  719. kernel:
  720. sriov: True
  721. unsafe_interrupts: False # Default is false. for older platforms and AMD we need to add interrupt remapping workaround
  722. rc:
  723. local: |
  724. #!/bin/sh -e
  725. # Enable 7 VF on eth1
  726. echo 7 > /sys/class/net/eth1/device/sriov_numvfs; sleep 2; ifup -a
  727. exit 0
  728. Isolate CPU options
  729. ~~~~~~~~~~~~~~~~~~~
  730. Remove the specified CPUs, as defined by the cpu_number values, from
  731. the general kernel SMP balancing and scheduler algroithms. The only
  732. way to move a process onto or off an *isolated* CPU is via the CPU
  733. affinity syscalls. ``cpu_number begins`` at ``0``, so the
  734. maximum value is ``1`` less than the number of CPUs on the system.:
  735. .. code-block:: yaml
  736. linux:
  737. system:
  738. kernel:
  739. isolcpu: 1,2,3,4,5,6,7 # isolate first cpu 0
  740. Repositories
  741. ~~~~~~~~~~~~
  742. RedHat-based Linux with additional OpenStack repo:
  743. .. code-block:: yaml
  744. linux:
  745. system:
  746. ...
  747. repo:
  748. rdo-icehouse:
  749. enabled: true
  750. source: 'http://repos.fedorapeople.org/repos/openstack/openstack-icehouse/epel-6/'
  751. pgpcheck: 0
  752. Ensure system repository to use czech Debian mirror (``default: true``)
  753. Also pin it's packages with priority ``900``:
  754. .. code-block:: yaml
  755. linux:
  756. system:
  757. repo:
  758. debian:
  759. default: true
  760. source: "deb http://ftp.cz.debian.org/debian/ jessie main contrib non-free"
  761. # Import signing key from URL if needed
  762. key_url: "http://dummy.com/public.gpg"
  763. pin:
  764. - pin: 'origin "ftp.cz.debian.org"'
  765. priority: 900
  766. package: '*'
  767. If you need to add multiple pin rules for one repo, please use new,ordered definition format
  768. ('pinning' definition will be in priotity to use):
  769. .. code-block:: yaml
  770. linux:
  771. system:
  772. repo:
  773. mcp_saltstack:
  774. source: "deb [arch=amd64] http://repo.saltstack.com/apt/ubuntu/16.04/amd64/2017.7/ xenial main"
  775. architectures: amd64
  776. clean_file: true
  777. pinning:
  778. 10:
  779. enabled: true
  780. pin: 'release o=SaltStack'
  781. priority: 50
  782. package: 'libsodium18'
  783. 20:
  784. enabled: true
  785. pin: 'release o=SaltStack'
  786. priority: 1100
  787. package: '*'
  788. .. note:: For old Ubuntu releases (<xenial)
  789. extra packages for apt transport, like ``apt-transport-https``
  790. may be required to be installed manually.
  791. (Chicken-eggs issue: we need to install packages to
  792. reach repo from where they should be installed)
  793. Otherwise, you still can try 'fortune' and install prereq.packages before
  794. any repo configuration, using list of requires in map.jinja.
  795. Disabling any prerequisite packages installation:
  796. You can simply drop any package pre-installation (before system.linux.repo
  797. will be processed) via cluster lvl:
  798. .. code-block:: yaml
  799. linux:
  800. system:
  801. pkgs: ~
  802. Package manager proxy global setup:
  803. .. code-block:: yaml
  804. linux:
  805. system:
  806. ...
  807. repo:
  808. apt-mk:
  809. source: "deb http://apt-mk.mirantis.com/ stable main salt"
  810. ...
  811. proxy:
  812. pkg:
  813. enabled: true
  814. ftp: ftp://ftp-proxy-for-apt.host.local:2121
  815. ...
  816. # NOTE: Global defaults for any other componet that configure proxy on the system.
  817. # If your environment has just one simple proxy, set it on linux:system:proxy.
  818. #
  819. # fall back system defaults if linux:system:proxy:pkg has no protocol specific entries
  820. # as for https and http
  821. ftp: ftp://proxy.host.local:2121
  822. http: http://proxy.host.local:3142
  823. https: https://proxy.host.local:3143
  824. Package manager proxy setup per repository:
  825. .. code-block:: yaml
  826. linux:
  827. system:
  828. ...
  829. repo:
  830. debian:
  831. source: "deb http://apt-mk.mirantis.com/ stable main salt"
  832. ...
  833. apt-mk:
  834. source: "deb http://apt-mk.mirantis.com/ stable main salt"
  835. # per repository proxy
  836. proxy:
  837. enabled: true
  838. http: http://maas-01:8080
  839. https: http://maas-01:8080
  840. ...
  841. proxy:
  842. # package manager fallback defaults
  843. # used if linux:system:repo:apt-mk:proxy has no protocol specific entries
  844. pkg:
  845. enabled: true
  846. ftp: ftp://proxy.host.local:2121
  847. #http: http://proxy.host.local:3142
  848. #https: https://proxy.host.local:3143
  849. ...
  850. # global system fallback system defaults
  851. ftp: ftp://proxy.host.local:2121
  852. http: http://proxy.host.local:3142
  853. https: https://proxy.host.local:3143
  854. Remove all repositories:
  855. .. code-block:: yaml
  856. linux:
  857. system:
  858. purge_repos: true
  859. Refresh repositories metada, after configuration:
  860. .. code-block:: yaml
  861. linux:
  862. system:
  863. refresh_repos_meta: true
  864. Setup custom apt config options:
  865. .. code-block:: yaml
  866. linux:
  867. system:
  868. apt:
  869. config:
  870. compression-workaround:
  871. "Acquire::CompressionTypes::Order": "gz"
  872. docker-clean:
  873. "DPkg::Post-Invoke":
  874. - "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"
  875. "APT::Update::Post-Invoke":
  876. - "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"
  877. RC
  878. ~~
  879. rc.local example
  880. .. code-block:: yaml
  881. linux:
  882. system:
  883. rc:
  884. local: |
  885. #!/bin/sh -e
  886. #
  887. # rc.local
  888. #
  889. # This script is executed at the end of each multiuser runlevel.
  890. # Make sure that the script will "exit 0" on success or any other
  891. # value on error.
  892. #
  893. # In order to enable or disable this script just change the execution
  894. # bits.
  895. #
  896. # By default this script does nothing.
  897. exit 0
  898. Prompt
  899. ~~~~~~
  900. Setting prompt is implemented by creating ``/etc/profile.d/prompt.sh``.
  901. Every user can have different prompt:
  902. .. code-block:: yaml
  903. linux:
  904. system:
  905. prompt:
  906. root: \\n\\[\\033[0;37m\\]\\D{%y/%m/%d %H:%M:%S} $(hostname -f)\\[\\e[0m\\]\\n\\[\\e[1;31m\\][\\u@\\h:\\w]\\[\\e[0m\\]
  907. default: \\n\\D{%y/%m/%d %H:%M:%S} $(hostname -f)\\n[\\u@\\h:\\w]
  908. On Debian systems, to set prompt system-wide, it's necessary to
  909. remove setting PS1 in ``/etc/bash.bashrc`` and ``~/.bashrc``,
  910. which comes from ``/etc/skel/.bashrc``. This formula will do
  911. this automatically, but will not touch existing user's
  912. ``~/.bashrc`` files except root.
  913. Bash
  914. ~~~~
  915. Fix bash configuration to preserve history across sessions
  916. like ZSH does by default:
  917. .. code-block:: yaml
  918. linux:
  919. system:
  920. bash:
  921. preserve_history: true
  922. Login banner message
  923. ~~~~~~~~~~~~~~~~~~~~
  924. ``/etc/issue`` is a text file which contains a message or system
  925. identification to be printed before the login prompt. It may contain
  926. various @char and \char sequences, if supported by the getty-type
  927. program employed on the system.
  928. Setting logon banner message is easy:
  929. .. code-block:: yaml
  930. liunx:
  931. system:
  932. banner:
  933. enabled: true
  934. contents: |
  935. UNAUTHORIZED ACCESS TO THIS SYSTEM IS PROHIBITED
  936. You must have explicit, authorized permission to access or configure this
  937. device. Unauthorized attempts and actions to access or use this system may
  938. result in civil and/or criminal penalties.
  939. All activities performed on this system are logged and monitored.
  940. Message of the day
  941. ~~~~~~~~~~~~~~~~~~
  942. ``pam_motd`` from package ``libpam-modules`` is used for dynamic
  943. messages of the day. Setting custom ``motd`` will clean up existing ones.
  944. Setting static ``motd`` will replace existing ``/etc/motd`` and remove
  945. scripts from ``/etc/update-motd.d``.
  946. Setting static ``motd``:
  947. .. code-block:: yaml
  948. linux:
  949. system:
  950. motd: |
  951. UNAUTHORIZED ACCESS TO THIS SYSTEM IS PROHIBITED
  952. You must have explicit, authorized permission to access or configure this
  953. device. Unauthorized attempts and actions to access or use this system may
  954. result in civil and/or criminal penalties.
  955. All activities performed on this system are logged and monitored.
  956. Setting dynamic ``motd``:
  957. .. code-block:: yaml
  958. linux:
  959. system:
  960. motd:
  961. - release: |
  962. #!/bin/sh
  963. [ -r /etc/lsb-release ] && . /etc/lsb-release
  964. if [ -z "$DISTRIB_DESCRIPTION" ] && [ -x /usr/bin/lsb_release ]; then
  965. # Fall back to using the very slow lsb_release utility
  966. DISTRIB_DESCRIPTION=$(lsb_release -s -d)
  967. fi
  968. printf "Welcome to %s (%s %s %s)\n" "$DISTRIB_DESCRIPTION" "$(uname -o)" "$(uname -r)" "$(uname -m)"
  969. - warning: |
  970. #!/bin/sh
  971. printf "This is [company name] network.\n"
  972. printf "Unauthorized access strictly prohibited.\n"
  973. Services
  974. ~~~~~~~~
  975. Stop and disable the ``linux`` service:
  976. .. code-block:: yaml
  977. linux:
  978. system:
  979. service:
  980. apt-daily.timer:
  981. status: dead
  982. Possible statuses are ``dead`` (disable service by default), ``running``
  983. (enable service by default), ``enabled``, ``disabled``:
  984. Linux with the ``atop`` service:
  985. .. code-block:: yaml
  986. linux:
  987. system:
  988. atop:
  989. enabled: true
  990. interval: 20
  991. logpath: "/var/log/atop"
  992. outfile: "/var/log/atop/daily.log"
  993. Linux with the ``mcelog`` service:
  994. .. code-block:: yaml
  995. linux:
  996. system:
  997. mcelog:
  998. enabled: true
  999. logging:
  1000. syslog: true
  1001. syslog_error: true
  1002. RHEL / CentOS
  1003. ^^^^^^^^^^^^^
  1004. Currently, ``update-motd`` is not available
  1005. for RHEL. So there is no native support for dynamic ``motd``.
  1006. You can still set a static one, with a different pillar structure:
  1007. .. code-block:: yaml
  1008. linux:
  1009. system:
  1010. motd: |
  1011. This is [company name] network.
  1012. Unauthorized access strictly prohibited.
  1013. Haveged
  1014. ~~~~~~~
  1015. If you are running headless server and are low on entropy,
  1016. you may set up Haveged:
  1017. .. code-block:: yaml
  1018. linux:
  1019. system:
  1020. haveged:
  1021. enabled: true
  1022. Linux network
  1023. -------------
  1024. Linux with network manager:
  1025. .. code-block:: yaml
  1026. linux:
  1027. network:
  1028. enabled: true
  1029. network_manager: true
  1030. Linux with default static network interfaces, default gateway
  1031. interface and DNS servers:
  1032. .. code-block:: yaml
  1033. linux:
  1034. network:
  1035. enabled: true
  1036. interface:
  1037. eth0:
  1038. enabled: true
  1039. type: eth
  1040. address: 192.168.0.102
  1041. netmask: 255.255.255.0
  1042. gateway: 192.168.0.1
  1043. name_servers:
  1044. - 8.8.8.8
  1045. - 8.8.4.4
  1046. mtu: 1500
  1047. Linux with bonded interfaces and disabled ``NetworkManager``:
  1048. .. code-block:: yaml
  1049. linux:
  1050. network:
  1051. enabled: true
  1052. interface:
  1053. eth0:
  1054. type: eth
  1055. ...
  1056. eth1:
  1057. type: eth
  1058. ...
  1059. bond0:
  1060. enabled: true
  1061. type: bond
  1062. address: 192.168.0.102
  1063. netmask: 255.255.255.0
  1064. mtu: 1500
  1065. use_in:
  1066. - interface: ${linux:interface:eth0}
  1067. - interface: ${linux:interface:eth0}
  1068. network_manager:
  1069. disable: true
  1070. Linux with VLAN ``interface_params``:
  1071. .. code-block:: yaml
  1072. linux:
  1073. network:
  1074. enabled: true
  1075. interface:
  1076. vlan69:
  1077. type: vlan
  1078. use_interfaces:
  1079. - interface: ${linux:interface:bond0}
  1080. Linux with wireless interface parameters:
  1081. .. code-block:: yaml
  1082. linux:
  1083. network:
  1084. enabled: true
  1085. gateway: 10.0.0.1
  1086. default_interface: eth0
  1087. interface:
  1088. wlan0:
  1089. type: eth
  1090. wireless:
  1091. essid: example
  1092. key: example_key
  1093. security: wpa
  1094. priority: 1
  1095. Linux networks with routes defined:
  1096. .. code-block:: yaml
  1097. linux:
  1098. network:
  1099. enabled: true
  1100. gateway: 10.0.0.1
  1101. default_interface: eth0
  1102. interface:
  1103. eth0:
  1104. type: eth
  1105. route:
  1106. default:
  1107. address: 192.168.0.123
  1108. netmask: 255.255.255.0
  1109. gateway: 192.168.0.1
  1110. Native Linux Bridges:
  1111. .. code-block:: yaml
  1112. linux:
  1113. network:
  1114. interface:
  1115. eth1:
  1116. enabled: true
  1117. type: eth
  1118. proto: manual
  1119. up_cmds:
  1120. - ip address add 0/0 dev $IFACE
  1121. - ip link set $IFACE up
  1122. down_cmds:
  1123. - ip link set $IFACE down
  1124. br-ex:
  1125. enabled: true
  1126. type: bridge
  1127. address: ${linux:network:host:public_local:address}
  1128. netmask: 255.255.255.0
  1129. use_interfaces:
  1130. - eth1
  1131. Open vSwitch Bridges:
  1132. .. code-block:: yaml
  1133. linux:
  1134. network:
  1135. bridge: openvswitch
  1136. interface:
  1137. eth1:
  1138. enabled: true
  1139. type: eth
  1140. proto: manual
  1141. up_cmds:
  1142. - ip address add 0/0 dev $IFACE
  1143. - ip link set $IFACE up
  1144. down_cmds:
  1145. - ip link set $IFACE down
  1146. br-ex:
  1147. enabled: true
  1148. type: bridge
  1149. address: ${linux:network:host:public_local:address}
  1150. netmask: 255.255.255.0
  1151. use_interfaces:
  1152. - eth1
  1153. br-prv:
  1154. enabled: true
  1155. type: ovs_bridge
  1156. mtu: 65000
  1157. br-ens7:
  1158. enabled: true
  1159. name: br-ens7
  1160. type: ovs_bridge
  1161. proto: manual
  1162. mtu: 9000
  1163. use_interfaces:
  1164. - ens7
  1165. patch-br-ens7-br-prv:
  1166. enabled: true
  1167. name: ens7-prv
  1168. ovs_type: ovs_port
  1169. type: ovs_port
  1170. bridge: br-ens7
  1171. port_type: patch
  1172. peer: prv-ens7
  1173. tag: 109 # [] to unset a tag
  1174. mtu: 65000
  1175. patch-br-prv-br-ens7:
  1176. enabled: true
  1177. name: prv-ens7
  1178. bridge: br-prv
  1179. ovs_type: ovs_port
  1180. type: ovs_port
  1181. port_type: patch
  1182. peer: ens7-prv
  1183. tag: 109
  1184. mtu: 65000
  1185. ens7:
  1186. enabled: true
  1187. name: ens7
  1188. proto: manual
  1189. ovs_port_type: OVSPort
  1190. type: ovs_port
  1191. ovs_bridge: br-ens7
  1192. bridge: br-ens7
  1193. Debian manual proto interfaces
  1194. When you are changing interface proto from static in up state
  1195. to manual, you may need to flush ip addresses. For example,
  1196. if you want to use the interface and the ip on the bridge.
  1197. This can be done by setting the ``ipflush_onchange`` to true.
  1198. .. code-block:: yaml
  1199. linux:
  1200. network:
  1201. interface:
  1202. eth1:
  1203. enabled: true
  1204. type: eth
  1205. proto: manual
  1206. mtu: 9100
  1207. ipflush_onchange: true
  1208. Debian static proto interfaces
  1209. When you are changing interface proto from dhcp in up state to
  1210. static, you may need to flush ip addresses and restart interface
  1211. to assign ip address from a managed file. For example, if you wantto
  1212. use the interface and the ip on the bridge. This can be done by
  1213. setting the ``ipflush_onchange`` with combination ``restart_on_ipflush``
  1214. param set to true.
  1215. .. code-block:: yaml
  1216. linux:
  1217. network:
  1218. interface:
  1219. eth1:
  1220. enabled: true
  1221. type: eth
  1222. proto: static
  1223. address: 10.1.0.22
  1224. netmask: 255.255.255.0
  1225. ipflush_onchange: true
  1226. restart_on_ipflush: true
  1227. Concatinating and removing interface files
  1228. Debian based distributions have ``/etc/network/interfaces.d/``
  1229. directory, where you can store configuration of network
  1230. interfaces in separate files. You can concatinate the files
  1231. to the defined destination when needed, this operation removes
  1232. the file from the ``/etc/network/interfaces.d/``. If you just need
  1233. to remove iface files, you can use the ``remove_iface_files`` key.
  1234. .. code-block:: yaml
  1235. linux:
  1236. network:
  1237. concat_iface_files:
  1238. - src: '/etc/network/interfaces.d/50-cloud-init.cfg'
  1239. dst: '/etc/network/interfaces'
  1240. remove_iface_files:
  1241. - '/etc/network/interfaces.d/90-custom.cfg'
  1242. Configure DHCP client
  1243. None of the keys is mandatory, include only those you really need.
  1244. For full list of available options under send, supersede, prepend,
  1245. append refer to dhcp-options(5).
  1246. .. code-block:: yaml
  1247. linux:
  1248. network:
  1249. dhclient:
  1250. enabled: true
  1251. backoff_cutoff: 15
  1252. initial_interval: 10
  1253. reboot: 10
  1254. retry: 60
  1255. select_timeout: 0
  1256. timeout: 120
  1257. send:
  1258. - option: host-name
  1259. declaration: "= gethostname()"
  1260. supersede:
  1261. - option: host-name
  1262. declaration: "spaceship"
  1263. - option: domain-name
  1264. declaration: "domain.home"
  1265. #- option: arp-cache-timeout
  1266. # declaration: 20
  1267. prepend:
  1268. - option: domain-name-servers
  1269. declaration:
  1270. - 8.8.8.8
  1271. - 8.8.4.4
  1272. - option: domain-search
  1273. declaration:
  1274. - example.com
  1275. - eng.example.com
  1276. #append:
  1277. #- option: domain-name-servers
  1278. # declaration: 127.0.0.1
  1279. # ip or subnet to reject dhcp offer from
  1280. reject:
  1281. - 192.33.137.209
  1282. - 10.0.2.0/24
  1283. request:
  1284. - subnet-mask
  1285. - broadcast-address
  1286. - time-offset
  1287. - routers
  1288. - domain-name
  1289. - domain-name-servers
  1290. - domain-search
  1291. - host-name
  1292. - dhcp6.name-servers
  1293. - dhcp6.domain-search
  1294. - dhcp6.fqdn
  1295. - dhcp6.sntp-servers
  1296. - netbios-name-servers
  1297. - netbios-scope
  1298. - interface-mtu
  1299. - rfc3442-classless-static-routes
  1300. - ntp-servers
  1301. require:
  1302. - subnet-mask
  1303. - domain-name-servers
  1304. # if per interface configuration required add below
  1305. interface:
  1306. ens2:
  1307. initial_interval: 11
  1308. reject:
  1309. - 192.33.137.210
  1310. ens3:
  1311. initial_interval: 12
  1312. reject:
  1313. - 192.33.137.211
  1314. Linux network systemd settings:
  1315. .. code-block:: yaml
  1316. linux:
  1317. network:
  1318. ...
  1319. systemd:
  1320. link:
  1321. 10-iface-dmz:
  1322. Match:
  1323. MACAddress: c8:5b:67:fa:1a:af
  1324. OriginalName: eth0
  1325. Link:
  1326. Name: dmz0
  1327. netdev:
  1328. 20-bridge-dmz:
  1329. match:
  1330. name: dmz0
  1331. network:
  1332. mescription: bridge
  1333. bridge: br-dmz0
  1334. network:
  1335. # works with lowercase, keys are by default capitalized
  1336. 40-dhcp:
  1337. match:
  1338. name: '*'
  1339. network:
  1340. DHCP: yes
  1341. Configure global environment variables
  1342. Use ``/etc/environment`` for static system wide variable assignment
  1343. after boot. Variable expansion is frequently not supported.
  1344. .. code-block:: yaml
  1345. linux:
  1346. system:
  1347. env:
  1348. BOB_VARIABLE: Alice
  1349. ...
  1350. BOB_PATH:
  1351. - /srv/alice/bin
  1352. - /srv/bob/bin
  1353. ...
  1354. ftp_proxy: none
  1355. http_proxy: http://global-http-proxy.host.local:8080
  1356. https_proxy: ${linux:system:proxy:https}
  1357. no_proxy:
  1358. - 192.168.0.80
  1359. - 192.168.1.80
  1360. - .domain.com
  1361. - .local
  1362. ...
  1363. # NOTE: global defaults proxy configuration.
  1364. proxy:
  1365. ftp: ftp://proxy.host.local:2121
  1366. http: http://proxy.host.local:3142
  1367. https: https://proxy.host.local:3143
  1368. noproxy:
  1369. - .domain.com
  1370. - .local
  1371. Configure the ``profile.d`` scripts
  1372. The ``profile.d`` scripts are being sourced during ``.sh`` execution
  1373. and support variable expansion in opposite to /etc/environment global
  1374. settings in ``/etc/environment``.
  1375. .. code-block:: yaml
  1376. linux:
  1377. system:
  1378. profile:
  1379. locales: |
  1380. export LANG=C
  1381. export LC_ALL=C
  1382. ...
  1383. vi_flavors.sh: |
  1384. export PAGER=view
  1385. export EDITOR=vim
  1386. alias vi=vim
  1387. shell_locales.sh: |
  1388. export LANG=en_US
  1389. export LC_ALL=en_US.UTF-8
  1390. shell_proxies.sh: |
  1391. export FTP_PROXY=ftp://127.0.3.3:2121
  1392. export NO_PROXY='.local'
  1393. Configure login.defs parameters
  1394. -------------------------------
  1395. .. code-block:: yaml
  1396. linux:
  1397. system:
  1398. login_defs:
  1399. <opt_name>:
  1400. enabled: true
  1401. value: <opt_value>
  1402. <opt_name> is a configurational option defined in 'man login.defs'.
  1403. <opt_name> is case sensitive, should be UPPERCASE only!
  1404. Linux with hosts
  1405. Parameter ``purge_hosts`` will enforce whole ``/etc/hosts file``,
  1406. removing entries that are not defined in model except defaults
  1407. for both IPv4 and IPv6 localhost and hostname as well as FQDN.
  1408. We recommend using this option to verify that ``/etc/hosts``
  1409. is always in a clean state. However it is not enabled by default
  1410. for security reasons.
  1411. .. code-block:: yaml
  1412. linux:
  1413. network:
  1414. purge_hosts: true
  1415. host:
  1416. # No need to define this one if purge_hosts is true
  1417. hostname:
  1418. address: 127.0.1.1
  1419. names:
  1420. - ${linux:network:fqdn}
  1421. - ${linux:network:hostname}
  1422. node1:
  1423. address: 192.168.10.200
  1424. names:
  1425. - node2.domain.com
  1426. - service2.domain.com
  1427. node2:
  1428. address: 192.168.10.201
  1429. names:
  1430. - node2.domain.com
  1431. - service2.domain.com
  1432. Linux with hosts collected from mine
  1433. All DNS records defined within infrastrucuture
  1434. are passed to the local hosts records or any DNS server. Only
  1435. hosts with the ``grain`` parameter set to ``true`` will be propagated
  1436. to the mine.
  1437. .. code-block:: yaml
  1438. linux:
  1439. network:
  1440. purge_hosts: true
  1441. mine_dns_records: true
  1442. host:
  1443. node1:
  1444. address: 192.168.10.200
  1445. grain: true
  1446. names:
  1447. - node2.domain.com
  1448. - service2.domain.com
  1449. Set up ``resolv.conf``, nameservers, domain and search domains:
  1450. .. code-block:: yaml
  1451. linux:
  1452. network:
  1453. resolv:
  1454. dns:
  1455. - 8.8.4.4
  1456. - 8.8.8.8
  1457. domain: my.example.com
  1458. search:
  1459. - my.example.com
  1460. - example.com
  1461. options:
  1462. - ndots: 5
  1463. - timeout: 2
  1464. - attempts: 2
  1465. Set up custom TX queue length for tap interfaces:
  1466. .. code-block:: yaml
  1467. linux:
  1468. network:
  1469. tap_custom_txqueuelen: 10000
  1470. DPDK OVS interfaces
  1471. **DPDK OVS NIC**
  1472. .. code-block:: yaml
  1473. linux:
  1474. network:
  1475. bridge: openvswitch
  1476. dpdk:
  1477. enabled: true
  1478. driver: uio/vfio
  1479. openvswitch:
  1480. pmd_cpu_mask: "0x6"
  1481. dpdk_socket_mem: "1024,1024"
  1482. dpdk_lcore_mask: "0x400"
  1483. memory_channels: 2
  1484. interface:
  1485. dpkd0:
  1486. name: ${_param:dpdk_nic}
  1487. pci: 0000:06:00.0
  1488. driver: igb_uio/vfio-pci
  1489. enabled: true
  1490. type: dpdk_ovs_port
  1491. n_rxq: 2
  1492. pmd_rxq_affinity: "0:1,1:2"
  1493. bridge: br-prv
  1494. mtu: 9000
  1495. br-prv:
  1496. enabled: true
  1497. type: dpdk_ovs_bridge
  1498. **DPDK OVS Bond**
  1499. .. code-block:: yaml
  1500. linux:
  1501. network:
  1502. bridge: openvswitch
  1503. dpdk:
  1504. enabled: true
  1505. driver: uio/vfio
  1506. openvswitch:
  1507. pmd_cpu_mask: "0x6"
  1508. dpdk_socket_mem: "1024,1024"
  1509. dpdk_lcore_mask: "0x400"
  1510. memory_channels: 2
  1511. interface:
  1512. dpdk_second_nic:
  1513. name: ${_param:primary_second_nic}
  1514. pci: 0000:06:00.0
  1515. driver: igb_uio/vfio-pci
  1516. bond: dpdkbond0
  1517. enabled: true
  1518. type: dpdk_ovs_port
  1519. n_rxq: 2
  1520. pmd_rxq_affinity: "0:1,1:2"
  1521. mtu: 9000
  1522. dpdk_first_nic:
  1523. name: ${_param:primary_first_nic}
  1524. pci: 0000:05:00.0
  1525. driver: igb_uio/vfio-pci
  1526. bond: dpdkbond0
  1527. enabled: true
  1528. type: dpdk_ovs_port
  1529. n_rxq: 2
  1530. pmd_rxq_affinity: "0:1,1:2"
  1531. mtu: 9000
  1532. dpdkbond0:
  1533. enabled: true
  1534. bridge: br-prv
  1535. type: dpdk_ovs_bond
  1536. mode: active-backup
  1537. br-prv:
  1538. enabled: true
  1539. type: dpdk_ovs_bridge
  1540. **DPDK OVS LACP Bond with vlan tag**
  1541. .. code-block:: yaml
  1542. linux:
  1543. network:
  1544. bridge: openvswitch
  1545. dpdk:
  1546. enabled: true
  1547. driver: uio
  1548. openvswitch:
  1549. pmd_cpu_mask: "0x6"
  1550. dpdk_socket_mem: "1024,1024"
  1551. dpdk_lcore_mask: "0x400"
  1552. memory_channels: "2"
  1553. interface:
  1554. eth3:
  1555. enabled: true
  1556. type: eth
  1557. proto: manual
  1558. name: ${_param:tenant_first_nic}
  1559. eth4:
  1560. enabled: true
  1561. type: eth
  1562. proto: manual
  1563. name: ${_param:tenant_second_nic}
  1564. dpdk0:
  1565. name: ${_param:tenant_first_nic}
  1566. pci: "0000:81:00.0"
  1567. driver: igb_uio
  1568. bond: bond1
  1569. enabled: true
  1570. type: dpdk_ovs_port
  1571. n_rxq: 2
  1572. dpdk1:
  1573. name: ${_param:tenant_second_nic}
  1574. pci: "0000:81:00.1"
  1575. driver: igb_uio
  1576. bond: bond1
  1577. enabled: true
  1578. type: dpdk_ovs_port
  1579. n_rxq: 2
  1580. bond1:
  1581. enabled: true
  1582. bridge: br-prv
  1583. type: dpdk_ovs_bond
  1584. mode: balance-slb
  1585. br-prv:
  1586. enabled: true
  1587. type: dpdk_ovs_bridge
  1588. tag: ${_param:tenant_vlan}
  1589. address: ${_param:tenant_address}
  1590. netmask: ${_param:tenant_network_netmask}
  1591. **DPDK OVS bridge for VXLAN**
  1592. If VXLAN is used as tenant segmentation, IP address must
  1593. be set on ``br-prv``.
  1594. .. code-block:: yaml
  1595. linux:
  1596. network:
  1597. ...
  1598. interface:
  1599. br-prv:
  1600. enabled: true
  1601. type: dpdk_ovs_bridge
  1602. address: 192.168.50.0
  1603. netmask: 255.255.255.0
  1604. tag: 101
  1605. mtu: 9000
  1606. **DPDK OVS bridge with Linux network interface**
  1607. .. code-block:: yaml
  1608. linux:
  1609. network:
  1610. ...
  1611. interface:
  1612. eth0:
  1613. type: eth
  1614. ovs_bridge: br-prv
  1615. ...
  1616. br-prv:
  1617. enabled: true
  1618. type: dpdk_ovs_bridge
  1619. ...
  1620. Linux storage
  1621. -------------
  1622. Linux with mounted Samba:
  1623. .. code-block:: yaml
  1624. linux:
  1625. storage:
  1626. enabled: true
  1627. mount:
  1628. samba1:
  1629. - enabled: true
  1630. - path: /media/myuser/public/
  1631. - device: //192.168.0.1/storage
  1632. - file_system: cifs
  1633. - options: guest,uid=myuser,iocharset=utf8,file_mode=0777,dir_mode=0777,noperm
  1634. NFS mount:
  1635. .. code-block:: yaml
  1636. linux:
  1637. storage:
  1638. enabled: true
  1639. mount:
  1640. nfs_glance:
  1641. enabled: true
  1642. path: /var/lib/glance/images
  1643. device: 172.16.10.110:/var/nfs/glance
  1644. file_system: nfs
  1645. opts: rw,sync
  1646. File swap configuration:
  1647. .. code-block:: yaml
  1648. linux:
  1649. storage:
  1650. enabled: true
  1651. swap:
  1652. file:
  1653. enabled: true
  1654. engine: file
  1655. device: /swapfile
  1656. size: 1024
  1657. Partition swap configuration:
  1658. .. code-block:: yaml
  1659. linux:
  1660. storage:
  1661. enabled: true
  1662. swap:
  1663. partition:
  1664. enabled: true
  1665. engine: partition
  1666. device: /dev/vg0/swap
  1667. LVM group ``vg1`` with one device and ``data`` volume mounted
  1668. into ``/mnt/data``.
  1669. .. code-block:: yaml
  1670. parameters:
  1671. linux:
  1672. storage:
  1673. mount:
  1674. data:
  1675. enabled: true
  1676. device: /dev/vg1/data
  1677. file_system: ext4
  1678. path: /mnt/data
  1679. lvm:
  1680. vg1:
  1681. enabled: true
  1682. devices:
  1683. - /dev/sdb
  1684. volume:
  1685. data:
  1686. size: 40G
  1687. mount: ${linux:storage:mount:data}
  1688. Create partitions on disk. Specify size in MB. It expects empty
  1689. disk without any existing partitions.
  1690. Set ``startsector=1`` if you want to start partitions from ``2048``.
  1691. .. code-block:: yaml
  1692. linux:
  1693. storage:
  1694. disk:
  1695. first_drive:
  1696. startsector: 1
  1697. name: /dev/loop1
  1698. type: gpt
  1699. partitions:
  1700. - size: 200 #size in MB
  1701. type: fat32
  1702. - size: 300 #size in MB
  1703. mkfs: True
  1704. type: xfs
  1705. /dev/vda1:
  1706. partitions:
  1707. - size: 5
  1708. type: ext2
  1709. - size: 10
  1710. type: ext4
  1711. Multipath with Fujitsu Eternus DXL:
  1712. .. code-block:: yaml
  1713. parameters:
  1714. linux:
  1715. storage:
  1716. multipath:
  1717. enabled: true
  1718. blacklist_devices:
  1719. - /dev/sda
  1720. - /dev/sdb
  1721. backends:
  1722. - fujitsu_eternus_dxl
  1723. Multipath with Hitachi VSP 1000:
  1724. .. code-block:: yaml
  1725. parameters:
  1726. linux:
  1727. storage:
  1728. multipath:
  1729. enabled: true
  1730. blacklist_devices:
  1731. - /dev/sda
  1732. - /dev/sdb
  1733. backends:
  1734. - hitachi_vsp1000
  1735. Multipath with IBM Storwize:
  1736. .. code-block:: yaml
  1737. parameters:
  1738. linux:
  1739. storage:
  1740. multipath:
  1741. enabled: true
  1742. blacklist_devices:
  1743. - /dev/sda
  1744. - /dev/sdb
  1745. backends:
  1746. - ibm_storwize
  1747. Multipath with multiple backends:
  1748. .. code-block:: yaml
  1749. parameters:
  1750. linux:
  1751. storage:
  1752. multipath:
  1753. enabled: true
  1754. blacklist_devices:
  1755. - /dev/sda
  1756. - /dev/sdb
  1757. - /dev/sdc
  1758. - /dev/sdd
  1759. backends:
  1760. - ibm_storwize
  1761. - fujitsu_eternus_dxl
  1762. - hitachi_vsp1000
  1763. PAM LDAP integration:
  1764. .. code-block:: yaml
  1765. parameters:
  1766. linux:
  1767. system:
  1768. auth:
  1769. enabled: true
  1770. mkhomedir:
  1771. enabled: true
  1772. umask: 0027
  1773. ldap:
  1774. enabled: true
  1775. binddn: cn=bind,ou=service_users,dc=example,dc=com
  1776. bindpw: secret
  1777. uri: ldap://127.0.0.1
  1778. base: ou=users,dc=example,dc=com
  1779. ldap_version: 3
  1780. pagesize: 65536
  1781. referrals: off
  1782. filter:
  1783. passwd: (&(&(objectClass=person)(uidNumber=*))(unixHomeDirectory=*))
  1784. shadow: (&(&(objectClass=person)(uidNumber=*))(unixHomeDirectory=*))
  1785. group: (&(objectClass=group)(gidNumber=*))
  1786. Disabled multipath (the default setup):
  1787. .. code-block:: yaml
  1788. parameters:
  1789. linux:
  1790. storage:
  1791. multipath:
  1792. enabled: false
  1793. Linux with local loopback device:
  1794. .. code-block:: yaml
  1795. linux:
  1796. storage:
  1797. loopback:
  1798. disk1:
  1799. file: /srv/disk1
  1800. size: 50G
  1801. External config generation
  1802. --------------------------
  1803. You are able to use config support metadata between formulas
  1804. and only generate configuration files for external use, for example, Docker, and so on.
  1805. .. code-block:: yaml
  1806. parameters:
  1807. linux:
  1808. system:
  1809. config:
  1810. pillar:
  1811. jenkins:
  1812. master:
  1813. home: /srv/volumes/jenkins
  1814. approved_scripts:
  1815. - method java.net.URL openConnection
  1816. credentials:
  1817. - type: username_password
  1818. scope: global
  1819. id: test
  1820. desc: Testing credentials
  1821. username: test
  1822. password: test
  1823. Netconsole Remote Kernel Logging
  1824. --------------------------------
  1825. Netconsole logger can be configured for the configfs-enabled kernels
  1826. (``CONFIG_NETCONSOLE_DYNAMIC`` must be enabled). The configuration
  1827. applies both in runtime (if network is already configured),
  1828. and on-boot after an interface initialization.
  1829. .. note::
  1830. * Receiver can be located only on the same L3 domain
  1831. (or you need to configure gateway MAC manually).
  1832. * The Receiver MAC is detected only on configuration time.
  1833. * Using broadcast MAC is not recommended.
  1834. .. code-block:: yaml
  1835. parameters:
  1836. linux:
  1837. system:
  1838. netconsole:
  1839. enabled: true
  1840. port: 514 (optional)
  1841. loglevel: debug (optional)
  1842. target:
  1843. 192.168.0.1:
  1844. interface: bond0
  1845. mac: "ff:ff:ff:ff:ff:ff" (optional)
  1846. Check network params on the environment
  1847. ---------------------------------------
  1848. Grab nics and nics states
  1849. .. code-block:: bash
  1850. salt osd001\* net_checks.get_nics
  1851. **Example of system output:**
  1852. .. code-block:: bash
  1853. osd001.domain.com:
  1854. |_
  1855. - bond0
  1856. - None
  1857. - 1e:c8:64:42:23:b9
  1858. - 0
  1859. - 1500
  1860. |_
  1861. - bond1
  1862. - None
  1863. - 3c:fd:fe:27:3b:00
  1864. - 1
  1865. - 9100
  1866. |_
  1867. - fourty1
  1868. - None
  1869. - 3c:fd:fe:27:3b:00
  1870. - 1
  1871. - 9100
  1872. |_
  1873. - fourty2
  1874. - None
  1875. - 3c:fd:fe:27:3b:02
  1876. - 1
  1877. - 9100
  1878. Grab 10G nics PCI addresses for hugepages setup
  1879. .. code-block:: bash
  1880. salt cmp001\* net_checks.get_ten_pci
  1881. **Example of system output:**
  1882. .. code-block:: bash
  1883. cmp001.domain.com:
  1884. |_
  1885. - ten1
  1886. - 0000:19:00.0
  1887. |_
  1888. - ten2
  1889. - 0000:19:00.1
  1890. |_
  1891. - ten3
  1892. - 0000:19:00.2
  1893. |_
  1894. - ten4
  1895. - 0000:19:00.3
  1896. Grab ip address for an interface
  1897. .. code-block:: bash
  1898. salt cmp001\* net_checks.get_ip iface=one4
  1899. **Example of system output:**
  1900. .. code-block:: bash
  1901. cmp001.domain.com:
  1902. 10.200.177.101
  1903. Grab ip addresses map
  1904. .. code-block:: bash
  1905. salt-call net_checks.nodes_addresses
  1906. **Example of system output:**
  1907. .. code-block:: bash
  1908. local:
  1909. |_
  1910. - cid01.domain.com
  1911. |_
  1912. |_
  1913. - pxe
  1914. - 10.200.177.91
  1915. |_
  1916. - control
  1917. - 10.200.178.91
  1918. |_
  1919. - cmn02.domain.com
  1920. |_
  1921. |_
  1922. - storage_access
  1923. - 10.200.181.67
  1924. |_
  1925. - pxe
  1926. - 10.200.177.67
  1927. |_
  1928. - control
  1929. - 10.200.178.67
  1930. |_
  1931. - cmp010.domain.com
  1932. |_
  1933. |_
  1934. - pxe
  1935. - 10.200.177.110
  1936. |_
  1937. - storage_access
  1938. - 10.200.181.110
  1939. |_
  1940. - control
  1941. - 10.200.178.110
  1942. |_
  1943. - vxlan
  1944. - 10.200.179.110
  1945. Verify full mesh connectivity
  1946. .. code-block:: bash
  1947. salt-call net_checks.ping_check
  1948. **Example of positive system output:**
  1949. .. code-block:: bash
  1950. ['PASSED']
  1951. [INFO ] ['PASSED']
  1952. local:
  1953. True
  1954. **Example of system output in case of failure:**
  1955. .. code-block:: bash
  1956. FAILED
  1957. [ERROR ] FAILED
  1958. ['control: 10.0.1.92 -> 10.0.1.224: Failed']
  1959. ['control: 10.0.1.93 -> 10.0.1.224: Failed']
  1960. ['control: 10.0.1.51 -> 10.0.1.224: Failed']
  1961. ['control: 10.0.1.102 -> 10.0.1.224: Failed']
  1962. ['control: 10.0.1.13 -> 10.0.1.224: Failed']
  1963. ['control: 10.0.1.81 -> 10.0.1.224: Failed']
  1964. local:
  1965. False
  1966. For this feature to work, please mark addresses with some role.
  1967. Otherwise 'default' role is assumed and mesh would consist of all
  1968. addresses on the environment.
  1969. Mesh mark is needed only for interfaces which are enabled and have
  1970. ip address assigned.
  1971. Checking dhcp pxe network meaningless, as it is used for salt
  1972. master vs minion communications, therefore treated as checked.
  1973. .. code-block:: yaml
  1974. parameters:
  1975. linux:
  1976. network:
  1977. interface:
  1978. ens3:
  1979. enabled: true
  1980. type: eth
  1981. proto: static
  1982. address: ${_param:deploy_address}
  1983. netmask: ${_param:deploy_network_netmask}
  1984. gateway: ${_param:deploy_network_gateway}
  1985. mesh: pxe
  1986. Check pillars for ip address duplicates
  1987. .. code-block:: bash
  1988. salt-call net_checks.verify_addresses
  1989. **Example of positive system output:**
  1990. .. code-block:: bash
  1991. ['PASSED']
  1992. [INFO ] ['PASSED']
  1993. local:
  1994. True
  1995. **Example of system output in case of failure:**
  1996. .. code-block:: bash
  1997. FAILED. Duplicates found
  1998. [ERROR ] FAILED. Duplicates found
  1999. ['gtw01.domain.com', 'gtw02.domain.com', '10.0.1.224']
  2000. [ERROR ] ['gtw01.domain.com', 'gtw02.domain.com', '10.0.1.224']
  2001. local:
  2002. False
  2003. Generate csv report for the env
  2004. .. code-block:: bash
  2005. salt -C 'kvm* or cmp* or osd*' net_checks.get_nics_csv \
  2006. | grep '^\ ' | sed 's/\ *//g' | grep -Ev ^server \
  2007. | sed '1 i\server,nic_name,ip_addr,mac_addr,link,mtu,chassis_id,chassis_name,port_mac,port_descr'
  2008. **Example of system output:**
  2009. .. code-block:: bash
  2010. server,nic_name,ip_addr,mac_addr,link,mtu,chassis_id,chassis_name,port_mac,port_descr
  2011. cmp010.domain.com,bond0,None,b4:96:91:10:5b:3a,1,1500,,,,
  2012. cmp010.domain.com,bond0.21,10.200.178.110,b4:96:91:10:5b:3a,1,1500,,,,
  2013. cmp010.domain.com,bond0.22,10.200.179.110,b4:96:91:10:5b:3a,1,1500,,,,
  2014. cmp010.domain.com,bond1,None,3c:fd:fe:34:ad:22,0,1500,,,,
  2015. cmp010.domain.com,bond1.24,10.200.181.110,3c:fd:fe:34:ad:22,0,1500,,,,
  2016. cmp010.domain.com,fourty5,None,3c:fd:fe:34:ad:20,0,9000,,,,
  2017. cmp010.domain.com,fourty6,None,3c:fd:fe:34:ad:22,0,9000,,,,
  2018. cmp010.domain.com,one1,None,b4:96:91:10:5b:38,0,1500,,,,
  2019. cmp010.domain.com,one2,None,b4:96:91:10:5b:39,1,1500,f0:4b:3a:8f:75:40,exnfvaa18-20,548,ge-0/0/22
  2020. cmp010.domain.com,one3,None,b4:96:91:10:5b:3a,1,1500,f0:4b:3a:8f:75:40,exnfvaa18-20,547,ge-0/0/21
  2021. cmp010.domain.com,one4,10.200.177.110,b4:96:91:10:5b:3b,1,1500,f0:4b:3a:8f:75:40,exnfvaa18-20,546,ge-0/0/20
  2022. cmp011.domain.com,bond0,None,b4:96:91:13:6c:aa,1,1500,,,,
  2023. cmp011.domain.com,bond0.21,10.200.178.111,b4:96:91:13:6c:aa,1,1500,,,,
  2024. cmp011.domain.com,bond0.22,10.200.179.111,b4:96:91:13:6c:aa,1,1500,,,,
  2025. ...
  2026. Usage
  2027. =====
  2028. Set MTU of the eth0 network interface to 1400:
  2029. .. code-block:: bash
  2030. ip link set dev eth0 mtu 1400
  2031. Read more
  2032. =========
  2033. * https://www.archlinux.org/
  2034. * http://askubuntu.com/questions/175172/how-do-i-configure-proxies-in-ubuntu-server-or-minimal-cli-ubuntu
  2035. Documentation and Bugs
  2036. ======================
  2037. * http://salt-formulas.readthedocs.io/
  2038. Learn how to install and update salt-formulas.
  2039. * https://github.com/salt-formulas/salt-formula-linux/issues
  2040. In the unfortunate event that bugs are discovered, report the issue to the
  2041. appropriate issue tracker. Use the Github issue tracker for a specific salt
  2042. formula.
  2043. * https://launchpad.net/salt-formulas
  2044. For feature requests, bug reports, or blueprints affecting the entire
  2045. ecosystem, use the Launchpad salt-formulas project.
  2046. * https://launchpad.net/~salt-formulas-users
  2047. Join the salt-formulas-users team and subscribe to mailing list if required.
  2048. * https://github.com/salt-formulas/salt-formula-linux
  2049. Develop the salt-formulas projects in the master branch and then submit pull
  2050. requests against a specific formula.
  2051. * #salt-formulas @ irc.freenode.net
  2052. Use this IRC channel in case of any questions or feedback which is always
  2053. welcome.