Saltstack Official Salt Formula
No puede seleccionar más de 25 temas Los temas deben comenzar con una letra o número, pueden incluir guiones ('-') y pueden tener hasta 35 caracteres de largo.

1321 líneas
50KB

  1. # This file managed by Salt, do not edit by hand!!
  2. # Based on salt version 2015.8.7 default config
  3. {% set reserved_keys = ['master', 'minion', 'cloud', 'salt_cloud_certs'] -%}
  4. {% set cfg_salt = pillar.get('salt', {}) -%}
  5. {% set cfg_master = cfg_salt.get('master', {}) -%}
  6. {%- macro get_config(configname, default_value) -%}
  7. {%- if configname in cfg_master -%}
  8. {{ configname }}: {{ cfg_master[configname] }}
  9. {%- elif configname in cfg_salt and configname not in reserved_keys -%}
  10. {{ configname }}: {{ cfg_salt[configname] }}
  11. {%- else -%}
  12. #{{ configname }}: {{ default_value }}
  13. {%- endif -%}
  14. {%- endmacro -%}
  15. {%- from 'salt/formulas.jinja' import file_roots, formulas with context -%}
  16. ##### Primary configuration settings #####
  17. ##########################################
  18. # This configuration file is used to manage the behavior of the Salt Master.
  19. # Values that are commented out but have an empty line after the comment are
  20. # defaults that do not need to be set in the config. If there is no blank line
  21. # after the comment then the value is presented as an example and is not the
  22. # default.
  23. # Per default, the master will automatically include all config files
  24. # from master.d/*.conf (master.d is a directory in the same directory
  25. # as the main master config file).
  26. {{ get_config('default_include', 'master.d/*.conf') }}
  27. # The address of the interface to bind to:
  28. {{ get_config('interface', '0.0.0.0') }}
  29. # Whether the master should listen for IPv6 connections. If this is set to True,
  30. # the interface option must be adjusted, too. (For example: "interface: '::'")
  31. {{ get_config('ipv6', 'False') }}
  32. # The tcp port used by the publisher:
  33. {{ get_config('publish_port', '4505') }}
  34. # The user under which the salt master will run. Salt will update all
  35. # permissions to allow the specified user to run the master. The exception is
  36. # the job cache, which must be deleted if this user is changed. If the
  37. # modified files cause conflicts, set verify_env to False.
  38. {{ get_config('user', 'root') }}
  39. # The port used by the communication interface. The ret (return) port is the
  40. # interface used for the file server, authentication, job returns, etc.
  41. {{ get_config('ret_port', '4506') }}
  42. # Specify the location of the daemon process ID file:
  43. {{ get_config('pidfile', '/var/run/salt-master.pid') }}
  44. # The root directory prepended to these options: pki_dir, cachedir,
  45. # sock_dir, log_file, autosign_file, autoreject_file, extension_modules,
  46. # key_logfile, pidfile:
  47. {{ get_config('root_dir', '/') }}
  48. # Directory used to store public key data:
  49. {{ get_config('pki_dir', '/etc/salt/pki/master') }}
  50. # Directory to store job and cache data:
  51. # This directory may contain sensitive data and should be protected accordingly.
  52. #
  53. {{ get_config('cachedir', '/var/cache/salt/master') }}
  54. # Directory for custom modules. This directory can contain subdirectories for
  55. # each of Salt's module types such as "runners", "output", "wheel", "modules",
  56. # "states", "returners", etc.
  57. {{ get_config('extension_modules', '<no default>') }}
  58. # Directory for custom modules. This directory can contain subdirectories for
  59. # each of Salt's module types such as "runners", "output", "wheel", "modules",
  60. # "states", "returners", etc.
  61. # Like 'extension_modules' but can take an array of paths
  62. {% if 'module_dirs' in cfg_master -%}
  63. module_dirs:
  64. {%- for dir in cfg_master['module_dirs'] %}
  65. - {{ dir}}
  66. {%- endfor -%}
  67. {% elif 'module_dirs' in cfg_salt -%}
  68. module_dirs:
  69. {%- for dir in cfg_salt['module_dirs'] %}
  70. - {{ dir}}
  71. {%- endfor -%}
  72. {% else -%}
  73. #module_dirs: <no default>
  74. # - /var/cache/salt/minion/extmods
  75. {% endif %}
  76. # Verify and set permissions on configuration directories at startup:
  77. {{ get_config('verify_env', 'True') }}
  78. # Set the number of hours to keep old job information in the job cache:
  79. {{ get_config('keep_jobs', '24') }}
  80. # Set the default timeout for the salt command and api. The default is 5
  81. # seconds.
  82. {{ get_config('timeout', '5') }}
  83. # The loop_interval option controls the seconds for the master's maintenance
  84. # process check cycle. This process updates file server backends, cleans the
  85. # job cache and executes the scheduler.
  86. {{ get_config('loop_interval', '60') }}
  87. # Set the default outputter used by the salt command. The default is "nested".
  88. {{ get_config('output', 'nested') }}
  89. # Return minions that timeout when running commands like test.ping
  90. {{ get_config('show_timeout', 'True') }}
  91. # By default, output is colored. To disable colored output, set the color value
  92. # to False.
  93. {{ get_config('color', 'True') }}
  94. # Do not strip off the colored output from nested results and state outputs
  95. # (true by default).
  96. {{ get_config('strip_colors', 'False') }}
  97. # Set the directory used to hold unix sockets:
  98. {{ get_config('sock_dir', '/var/run/salt/master') }}
  99. # The master can take a while to start up when lspci and/or dmidecode is used
  100. # to populate the grains for the master. Enable if you want to see GPU hardware
  101. # data for your master.
  102. {{ get_config('enable_gpu_grains', 'False') }}
  103. # The master maintains a job cache. While this is a great addition, it can be
  104. # a burden on the master for larger deployments (over 5000 minions).
  105. # Disabling the job cache will make previously executed jobs unavailable to
  106. # the jobs system and is not generally recommended.
  107. {{ get_config('job_cache', 'True') }}
  108. # Cache minion grains and pillar data in the cachedir.
  109. {{ get_config('minion_data_cache', 'True') }}
  110. # Store all returns in the given returner.
  111. # Setting this option requires that any returner-specific configuration also
  112. # be set. See various returners in salt/returners for details on required
  113. # configuration values. (See also, event_return_queue below.)
  114. {{ get_config('event_return', 'mysql') }}
  115. # On busy systems, enabling event_returns can cause a considerable load on
  116. # the storage system for returners. Events can be queued on the master and
  117. # stored in a batched fashion using a single transaction for multiple events.
  118. # By default, events are not queued.
  119. {{ get_config('event_return_queue', '0') }}
  120. # Only events returns matching tags in a whitelist
  121. {% if 'event_return_whitelist' in cfg_master -%}
  122. event_return_whitelist:
  123. {%- for event_return in cfg_master['event_return_whitelist'] %}
  124. - {{ event_return }}
  125. {%- endfor -%}
  126. {% elif 'event_return_whitelist' in cfg_salt -%}
  127. event_return_whitelist:
  128. {%- for event_return in cfg_salt['event_return_whitelist'] %}
  129. - {{ event_return }}
  130. {%- endfor -%}
  131. {% else -%}
  132. # event_return_whitelist:
  133. # - salt/master/a_tag
  134. # - salt/master/another_tag
  135. {% endif %}
  136. # Store all event returns _except_ the tags in a blacklist
  137. {% if 'event_return_blacklist' in cfg_master -%}
  138. event_return_blacklist:
  139. {%- for event_return in cfg_master['event_return_blacklist'] %}
  140. - {{ event_return }}
  141. {%- endfor -%}
  142. {% elif 'event_return_blacklist' in cfg_salt -%}
  143. event_return_blacklist:
  144. {%- for event_return in cfg_salt['event_return_blacklist'] %}
  145. - {{ event_return }}
  146. {%- endfor -%}
  147. {% else -%}
  148. # event_return_blacklist:
  149. # - salt/master/not_this_tag
  150. # - salt/master/or_this_one
  151. {% endif %}
  152. # Passing very large events can cause the minion to consume large amounts of
  153. # memory. This value tunes the maximum size of a message allowed onto the
  154. # master event bus. The value is expressed in bytes.
  155. {{ get_config('max_event_size', '1048576') }}
  156. # By default, the master AES key rotates every 24 hours. The next command
  157. # following a key rotation will trigger a key refresh from the minion which may
  158. # result in minions which do not respond to the first command after a key refresh.
  159. #
  160. # To tell the master to ping all minions immediately after an AES key refresh, set
  161. # ping_on_rotate to True. This should mitigate the issue where a minion does not
  162. # appear to initially respond after a key is rotated.
  163. #
  164. # Note that ping_on_rotate may cause high load on the master immediately after
  165. # the key rotation event as minions reconnect. Consider this carefully if this
  166. # salt master is managing a large number of minions.
  167. #
  168. # If disabled, it is recommended to handle this event by listening for the
  169. # 'aes_key_rotate' event with the 'key' tag and acting appropriately.
  170. {{ get_config('ping_on_rotate', 'False') }}
  171. # By default, the master deletes its cache of minion data when the key for that
  172. # minion is removed. To preserve the cache after key deletion, set
  173. # 'preserve_minion_cache' to True.
  174. #
  175. # WARNING: This may have security implications if compromised minions auth with
  176. # a previous deleted minion ID.
  177. {{ get_config('preserve_minion_cache', 'False') }}
  178. # If max_minions is used in large installations, the master might experience
  179. # high-load situations because of having to check the number of connected
  180. # minions for every authentication. This cache provides the minion-ids of
  181. # all connected minions to all MWorker-processes and greatly improves the
  182. # performance of max_minions.
  183. {{ get_config('con_cache', 'False') }}
  184. # The master can include configuration from other files. To enable this,
  185. # pass a list of paths to this option. The paths can be either relative or
  186. # absolute; if relative, they are considered to be relative to the directory
  187. # the main master configuration file lives in (this file). Paths can make use
  188. # of shell-style globbing. If no files are matched by a path passed to this
  189. # option, then the master will log a warning message.
  190. #
  191. # Include a config file from some other path:
  192. # include: /etc/salt/extra_config
  193. #
  194. # Include config from several files and directories:
  195. # include:
  196. # - /etc/salt/extra_config
  197. {{ get_config('include', '[]') }}
  198. ##### Large-scale tuning settings #####
  199. ##########################################
  200. # Max open files
  201. #
  202. # Each minion connecting to the master uses AT LEAST one file descriptor, the
  203. # master subscription connection. If enough minions connect you might start
  204. # seeing on the console (and then salt-master crashes):
  205. # Too many open files (tcp_listener.cpp:335)
  206. # Aborted (core dumped)
  207. #
  208. # By default this value will be the one of `ulimit -Hn`, ie, the hard limit for
  209. # max open files.
  210. #
  211. # If you wish to set a different value than the default one, uncomment and
  212. # configure this setting. Remember that this value CANNOT be higher than the
  213. # hard limit. Raising the hard limit depends on your OS and/or distribution,
  214. # a good way to find the limit is to search the internet. For example:
  215. # raise max open files hard limit debian
  216. #
  217. {{ get_config('max_open_files', '100000') }}
  218. # The number of worker threads to start. These threads are used to manage
  219. # return calls made from minions to the master. If the master seems to be
  220. # running slowly, increase the number of threads. This setting can not be
  221. # set lower than 3.
  222. {{ get_config('worker_threads', '5') }}
  223. # Set the ZeroMQ high water marks
  224. # http://api.zeromq.org/3-2:zmq-setsockopt
  225. # The publisher interface ZeroMQPubServerChannel
  226. {{ get_config('pub_hwm', '1000') }}
  227. # These two ZMQ HWM settings, salt_event_pub_hwm and event_publisher_pub_hwm
  228. # are significant for masters with thousands of minions. When these are
  229. # insufficiently high it will manifest in random responses missing in the CLI
  230. # and even missing from the job cache. Masters that have fast CPUs and many
  231. # cores with appropriate worker_threads will not need these set as high.
  232. # On deployment with 8,000 minions, 2.4GHz CPUs, 24 cores, 32GiB memory has
  233. # these settings:
  234. #
  235. # salt_event_pub_hwm: 128000
  236. # event_publisher_pub_hwm: 64000
  237. # ZMQ high-water-mark for SaltEvent pub socket
  238. {{ get_config('salt_event_pub_hwm', '20000') }}
  239. # ZMQ high-water-mark for EventPublisher pub socket
  240. {{ get_config('event_publisher_pub_hwm', '10000') }}
  241. ##### Security settings #####
  242. ##########################################
  243. # Enable "open mode", this mode still maintains encryption, but turns off
  244. # authentication, this is only intended for highly secure environments or for
  245. # the situation where your keys end up in a bad state. If you run in open mode
  246. # you do so at your own risk!
  247. {{ get_config('open_mode', 'False') }}
  248. # Enable auto_accept, this setting will automatically accept all incoming
  249. # public keys from the minions. Note that this is insecure.
  250. {{ get_config('auto_accept', 'False') }}
  251. # Time in minutes that a incoming public key with a matching name found in
  252. # pki_dir/minion_autosign/keyid is automatically accepted. Expired autosign keys
  253. # are removed when the master checks the minion_autosign directory.
  254. # 0 equals no timeout
  255. {{ get_config('autosign_timeout', '120') }}
  256. # If the autosign_file is specified, incoming keys specified in the
  257. # autosign_file will be automatically accepted. This is insecure. Regular
  258. # expressions as well as globing lines are supported.
  259. {{ get_config('autosign_file', '/etc/salt/autosign.conf') }}
  260. # Works like autosign_file, but instead allows you to specify minion IDs for
  261. # which keys will automatically be rejected. Will override both membership in
  262. # the autosign_file and the auto_accept setting.
  263. {{ get_config('autoreject_file', '/etc/salt/autoreject.conf') }}
  264. # Enable permissive access to the salt keys. This allows you to run the
  265. # master or minion as root, but have a non-root group be given access to
  266. # your pki_dir. To make the access explicit, root must belong to the group
  267. # you've given access to. This is potentially quite insecure. If an autosign_file
  268. # is specified, enabling permissive_pki_access will allow group access to that
  269. # specific file.
  270. {{ get_config('permissive_pki_access', 'False') }}
  271. # Allow users on the master access to execute specific commands on minions.
  272. # This setting should be treated with care since it opens up execution
  273. # capabilities to non root users. By default this capability is completely
  274. # disabled.
  275. {% if 'client_acl' in cfg_master -%}
  276. client_acl:
  277. {%- for name, user in cfg_master['client_acl']|dictsort %}
  278. {{ name}}:
  279. {%- for command in user %}
  280. - {% raw %}'{% endraw %}{{ command }}{% raw %}'{% endraw %}
  281. {%- endfor -%}
  282. {%- endfor -%}
  283. {% elif 'client_acl' in cfg_salt -%}
  284. client_acl:
  285. {%- for name, user in cfg_salt['client_acl']|dictsort %}
  286. {{ name }}:
  287. {%- for command in user %}
  288. - {% raw %}'{% endraw %}{{ command }}{% raw %}'{% endraw %}
  289. {%- endfor -%}
  290. {%- endfor -%}
  291. {% else -%}
  292. #client_acl:
  293. # larry:
  294. # - test.ping
  295. # - network.*
  296. {%- endif %}
  297. # Blacklist any of the following users or modules
  298. #
  299. # This example would blacklist all non sudo users, including root from
  300. # running any commands. It would also blacklist any use of the "cmd"
  301. # module. This is completely disabled by default.
  302. {% if 'client_acl_blacklist' in cfg_master %}
  303. client_acl_blacklist:
  304. users:
  305. {% for user in cfg_master['client_acl_blacklist'].get('users', []) %}
  306. - {{ user }}
  307. {% endfor %}
  308. modules:
  309. {% for mod in cfg_master['client_acl_blacklist'].get('modules', []) %}
  310. - {{ mod }}
  311. {% endfor %}
  312. {% elif 'client_acl_blacklist' in cfg_salt %}
  313. client_acl_blacklist:
  314. users:
  315. {% for user in cfg_salt['client_acl_blacklist'].get('users', []) %}
  316. - {{ user }}
  317. {% endfor %}
  318. modules:
  319. {% for mod in cfg_salt['client_acl_blacklist'].get('modules', []) %}
  320. - {{ mod }}
  321. {% endfor %}
  322. {% else %}
  323. #client_acl_blacklist:
  324. # users:
  325. # - root
  326. # - '^(?!sudo_).*$' # all non sudo users
  327. # modules:
  328. # - cmd
  329. {% endif %}
  330. # Enforce client_acl & client_acl_blacklist when users have sudo
  331. # access to the salt command.
  332. {{ get_config('sudo_acl', 'False') }}
  333. # The external auth system uses the Salt auth modules to authenticate and
  334. # validate users to access areas of the Salt system.
  335. #external_auth:
  336. # pam:
  337. # fred:
  338. # - test.*
  339. {{ get_config('external_auth', '{}') }}
  340. # Time (in seconds) for a newly generated token to live. Default: 12 hours
  341. {{ get_config('token_expire', '43200') }}
  342. # Allow minions to push files to the master. This is disabled by default, for
  343. # security purposes.
  344. {{ get_config('file_recv', 'False') }}
  345. # Set a hard-limit on the size of the files that can be pushed to the master.
  346. # It will be interpreted as megabytes. Default: 100
  347. {{ get_config('file_recv_max_size', '100') }}
  348. # Signature verification on messages published from the master.
  349. # This causes the master to cryptographically sign all messages published to its event
  350. # bus, and minions then verify that signature before acting on the message.
  351. #
  352. # This is False by default.
  353. #
  354. # Note that to facilitate interoperability with masters and minions that are different
  355. # versions, if sign_pub_messages is True but a message is received by a minion with
  356. # no signature, it will still be accepted, and a warning message will be logged.
  357. # Conversely, if sign_pub_messages is False, but a minion receives a signed
  358. # message it will be accepted, the signature will not be checked, and a warning message
  359. # will be logged. This behavior went away in Salt 2014.1.0 and these two situations
  360. # will cause minion to throw an exception and drop the message.
  361. {{ get_config('sign_pub_message', 'False') }}
  362. # Sign the master auth-replies with a cryptographic signature of the masters public key.
  363. # Please see the tutorial how to use these settings in the Multimaster-PKI with Failover Tutorial
  364. {{ get_config('master_sign_pubkey', 'False') }}
  365. # The customizable name of the signing-key-pair without suffix.
  366. # master_sign_key_name: <filename_without_suffix>
  367. {{ get_config('master_sign', '{}') }}
  368. # The name of the file in the masters pki-directory that holds the pre-calculated
  369. # signature of the masters public-key.
  370. # master_pubkey_signature: <filename>
  371. {{ get_config('master_pubkey_signature', '{}') }}
  372. # Instead of computing the signature for each auth-reply, use a pre-calculated signature.
  373. # The master_pubkey_signature must also be set for this.
  374. {{ get_config('master_use_pubkey_signature', 'False') }}
  375. # Rotate the salt-masters AES-key when a minion-public is deleted with salt-key.
  376. # This is a very important security-setting. Disabling it will enable deleted minions to still
  377. # listen in on the messages published by the salt-master.
  378. # Do not disable this unless it is absolutely clear what this does.
  379. {{ get_config('rotate_aes_key', 'True') }}
  380. ##### Salt-SSH Configuration #####
  381. ##########################################
  382. # Pass in an alternative location for the salt-ssh roster file
  383. {{ get_config('roster_file', '/etc/salt/roster') }}
  384. # Pass in minion option overrides that will be inserted into the SHIM for
  385. # salt-ssh calls. The local minion config is not used for salt-ssh. Can be
  386. # overridden on a per-minion basis in the roster (`minion_opts`)
  387. #ssh_minion_opts:
  388. # gpg_keydir: /root/gpg
  389. {{ get_config('ssh_minion_opts', '{}') }}
  390. ##### Master Module Management #####
  391. ##########################################
  392. # Manage how master side modules are loaded.
  393. # Add any additional locations to look for master runners:
  394. {{ get_config('runner_dirs', '[]') }}
  395. # Enable Cython for master side modules:
  396. {{ get_config('cython_enable', 'False') }}
  397. ##### State System settings #####
  398. ##########################################
  399. # The state system uses a "top" file to tell the minions what environment to
  400. # use and what modules to use. The state_top file is defined relative to the
  401. # root of the base environment as defined in "File Server settings" below.
  402. {{ get_config('state_top', 'top.sls') }}
  403. # The master_tops option replaces the external_nodes option by creating
  404. # a plugable system for the generation of external top data. The external_nodes
  405. # option is deprecated by the master_tops option.
  406. #
  407. # To gain the capabilities of the classic external_nodes system, use the
  408. # following configuration:
  409. # master_tops:
  410. # ext_nodes: <Shell command which returns yaml>
  411. #
  412. #master_tops: {}
  413. {% if 'master_tops' in cfg_master %}
  414. master_tops:
  415. {%- for master in cfg_master['master_tops'] -%}
  416. {%- if cfg_master['master_tops'][master] is string %}
  417. {{ master }}: {{ cfg_master['master_tops'][master] }}
  418. {%- else %}
  419. {{ master}}:
  420. {%- for parameter in cfg_master['master_tops'][master] %}
  421. {{ parameter }}: {{ cfg_master['master_tops'][master][parameter] }}
  422. {%- endfor -%}
  423. {%- endif -%}
  424. {%- endfor %}
  425. {% endif %}
  426. # The external_nodes option allows Salt to gather data that would normally be
  427. # placed in a top file. The external_nodes option is the executable that will
  428. # return the ENC data. Remember that Salt will look for external nodes AND top
  429. # files and combine the results if both are enabled!
  430. {{ get_config('external_nodes', 'None') }}
  431. # The renderer to use on the minions to render the state data
  432. {{ get_config('renderer', 'yaml_jinja') }}
  433. # The Jinja renderer can strip extra carriage returns and whitespace
  434. # See http://jinja.pocoo.org/docs/api/#high-level-api
  435. #
  436. # If this is set to True the first newline after a Jinja block is removed
  437. # (block, not variable tag!). Defaults to False, corresponds to the Jinja
  438. # environment init variable "trim_blocks".
  439. {{ get_config('jinja_trim_blocks', 'False') }}
  440. # If this is set to True leading spaces and tabs are stripped from the start
  441. # of a line to a block. Defaults to False, corresponds to the Jinja
  442. # environment init variable "lstrip_blocks".
  443. {{ get_config('jinja_lstrip_blocks', 'False') }}
  444. # The failhard option tells the minions to stop immediately after the first
  445. # failure detected in the state execution, defaults to False
  446. {{ get_config('failhard', 'False') }}
  447. # The state_verbose and state_output settings can be used to change the way
  448. # state system data is printed to the display. By default all data is printed.
  449. # The state_verbose setting can be set to True or False, when set to False
  450. # all data that has a result of True and no changes will be suppressed.
  451. {{ get_config('state_verbose', 'True') }}
  452. # The state_output setting changes if the output is the full multi line
  453. # output for each changed state if set to 'full', but if set to 'terse'
  454. # the output will be shortened to a single line. If set to 'mixed', the output
  455. # will be terse unless a state failed, in which case that output will be full.
  456. # If set to 'changes', the output will be full unless the state didn't change.
  457. {{ get_config('state_output', 'full') }}
  458. # Automatically aggregate all states that have support for mod_aggregate by
  459. # setting to 'True'. Or pass a list of state module names to automatically
  460. # aggregate just those types.
  461. #
  462. # state_aggregate:
  463. # - pkg
  464. #
  465. #state_aggregate: False
  466. {{ get_config('state_aggregate', '{}') }}
  467. # Send progress events as each function in a state run completes execution
  468. # by setting to 'True'. Progress events are in the format
  469. # 'salt/job/<JID>/prog/<MID>/<RUN NUM>'.
  470. {{ get_config('state_events', 'False') }}
  471. ##### File Server settings #####
  472. ##########################################
  473. # Salt runs a lightweight file server written in zeromq to deliver files to
  474. # minions. This file server is built into the master daemon and does not
  475. # require a dedicated port.
  476. # The file server works on environments passed to the master, each environment
  477. # can have multiple root directories, the subdirectories in the multiple file
  478. # roots cannot match, otherwise the downloaded files will not be able to be
  479. # reliably ensured. A base environment is required to house the top file.
  480. # Example:
  481. # file_roots:
  482. # base:
  483. # - /srv/salt/
  484. # dev:
  485. # - /srv/salt/dev/services
  486. # - /srv/salt/dev/states
  487. # prod:
  488. # - /srv/salt/prod/services
  489. # - /srv/salt/prod/states
  490. #
  491. {% if 'file_roots' in cfg_master -%}
  492. {{ file_roots(cfg_master['file_roots']) }}
  493. {%- elif 'file_roots' in cfg_salt -%}
  494. {{ file_roots(cfg_salt['file_roots']) }}
  495. {%- elif formulas|length -%}
  496. {{ file_roots({'base': ['/srv/salt']}) }}
  497. {%- else -%}
  498. #file_roots:
  499. # base:
  500. # - /srv/salt
  501. {%- endif %}
  502. # When using multiple environments, each with their own top file, the
  503. # default behaviour is an unordered merge. To prevent top files from
  504. # being merged together and instead to only use the top file from the
  505. # requested environment, set this value to 'same'.
  506. {{ get_config('top_file_merging_stragety', 'merge') }}
  507. # To specify the order in which environments are merged, set the ordering
  508. # in the env_order option. Given a conflict, the last matching value will
  509. # win.
  510. {{ get_config('env_order', '["base", "dev", "prod"]') }}
  511. # If top_file_merging_strategy is set to 'same' and an environment does not
  512. # contain a top file, the top file in the environment specified by default_top
  513. # will be used instead.
  514. {{ get_config('default_top', 'base') }}
  515. # The hash_type is the hash to use when discovering the hash of a file on
  516. # the master server. The default is md5, but sha1, sha224, sha256, sha384
  517. # and sha512 are also supported.
  518. #
  519. # Prior to changing this value, the master should be stopped and all Salt
  520. # caches should be cleared.
  521. {{ get_config('hash_type', 'md5') }}
  522. # The buffer size in the file server can be adjusted here:
  523. {{ get_config('file_buffer_size', '1048576') }}
  524. # A regular expression (or a list of expressions) that will be matched
  525. # against the file path before syncing the modules and states to the minions.
  526. # This includes files affected by the file.recurse state.
  527. # For example, if you manage your custom modules and states in subversion
  528. # and don't want all the '.svn' folders and content synced to your minions,
  529. # you could set this to '/\.svn($|/)'. By default nothing is ignored.
  530. {% if 'file_ignore_regex' in cfg_master %}
  531. file_ignore_regex:
  532. {% for regex in cfg_master['file_ignore_regex'] %}
  533. - {{ regex }}
  534. {% endfor %}
  535. {% elif 'file_ignore_regex' in cfg_salt %}
  536. file_ignore_regex:
  537. {% for regex in cfg_salt['file_ignore_regex'] %}
  538. - {{ regex }}
  539. {% endfor %}
  540. {% else %}
  541. #file_ignore_regex:
  542. # - '/\.svn($|/)'
  543. # - '/\.git($|/)'
  544. {% endif %}
  545. # A file glob (or list of file globs) that will be matched against the file
  546. # path before syncing the modules and states to the minions. This is similar
  547. # to file_ignore_regex above, but works on globs instead of regex. By default
  548. # nothing is ignored.
  549. {% if 'file_ignore_glob' in cfg_master %}
  550. file_ignore_glob:
  551. {% for glob in cfg_master['file_ignore_glob'] %}
  552. - {{ glob }}
  553. {% endfor %}
  554. {% elif 'file_ignore_glob' in cfg_salt %}
  555. file_ignore_glob:
  556. {% for glob in cfg_salt['file_ignore_glob'] %}
  557. - {{ glob }}
  558. {% endfor %}
  559. {% else %}
  560. # file_ignore_glob:
  561. # - '*.pyc'
  562. # - '*/somefolder/*.bak'
  563. # - '*.swp'
  564. {% endif %}
  565. # File Server Backend
  566. #
  567. # Salt supports a modular fileserver backend system, this system allows
  568. # the salt master to link directly to third party systems to gather and
  569. # manage the files available to minions. Multiple backends can be
  570. # configured and will be searched for the requested file in the order in which
  571. # they are defined here. The default setting only enables the standard backend
  572. # "roots" which uses the "file_roots" option.
  573. #fileserver_backend:
  574. # - roots
  575. #
  576. # To use multiple backends list them in the order they are searched:
  577. #fileserver_backend:
  578. # - git
  579. # - roots
  580. {% if 'fileserver_backend' in cfg_master -%}
  581. fileserver_backend:
  582. {%- for backend in cfg_master['fileserver_backend'] %}
  583. - {{ backend }}
  584. {%- endfor -%}
  585. {%- endif %}
  586. # Uncomment the line below if you do not want the file_server to follow
  587. # symlinks when walking the filesystem tree. This is set to True
  588. # by default. Currently this only applies to the default roots
  589. # fileserver_backend.
  590. {{ get_config('fileserver_followsymlinks', 'False') }}
  591. # Uncomment the line below if you do not want symlinks to be
  592. # treated as the files they are pointing to. By default this is set to
  593. # False. By uncommenting the line below, any detected symlink while listing
  594. # files on the Master will not be returned to the Minion.
  595. {{ get_config('fileserver_ignoresymlinks', 'True') }}
  596. # By default, the Salt fileserver recurses fully into all defined environments
  597. # to attempt to find files. To limit this behavior so that the fileserver only
  598. # traverses directories with SLS files and special Salt directories like _modules,
  599. # enable the option below. This might be useful for installations where a file root
  600. # has a very large number of files and performance is impacted. Default is False.
  601. {{ get_config('fileserver_limit_traversal', 'False') }}
  602. # The fileserver can fire events off every time the fileserver is updated,
  603. # these are disabled by default, but can be easily turned on by setting this
  604. # flag to True
  605. {{ get_config('fileserver_events', 'False') }}
  606. # Git File Server Backend Configuration
  607. #
  608. # Optional parameter used to specify the provider to be used for gitfs. Must
  609. # be one of the following: pygit2, gitpython, or dulwich. If unset, then each
  610. # will be tried in that same order, and the first one with a compatible
  611. # version installed will be the provider that is used.
  612. {{ get_config('gitfs_provider', 'pygit2') }}
  613. # Along with gitfs_password, is used to authenticate to HTTPS remotes.
  614. {{ get_config('gitfs_user', 'git') }}
  615. # Along with gitfs_user, is used to authenticate to HTTPS remotes.
  616. # This parameter is not required if the repository does not use authentication.
  617. {{ get_config('gitfs_password', '') }}
  618. # By default, Salt will not authenticate to an HTTP (non-HTTPS) remote.
  619. # This parameter enables authentication over HTTP. Enable this at your own risk.
  620. {{ get_config('gitfs_insecure_auth', 'False') }}
  621. # Along with gitfs_privkey (and optionally gitfs_passphrase), is used to
  622. # authenticate to SSH remotes. This parameter (or its per-remote counterpart)
  623. # is required for SSH remotes.
  624. {{ get_config('gitfs_pubkey', '') }}
  625. # Along with gitfs_pubkey (and optionally gitfs_passphrase), is used to
  626. # authenticate to SSH remotes. This parameter (or its per-remote counterpart)
  627. # is required for SSH remotes.
  628. {{ get_config('gitfs_privkey', '') }}
  629. # This parameter is optional, required only when the SSH key being used to
  630. # authenticate is protected by a passphrase.
  631. {{ get_config('gitfs_passphrase', '') }}
  632. # When using the git fileserver backend at least one git remote needs to be
  633. # defined. The user running the salt master will need read access to the repo.
  634. #
  635. # The repos will be searched in order to find the file requested by a client
  636. # and the first repo to have the file will return it.
  637. # When using the git backend branches and tags are translated into salt
  638. # environments.
  639. # Note: file:// repos will be treated as a remote, so refs you want used must
  640. # exist in that repo as *local* refs.
  641. {% if 'gitfs_remotes' in cfg_master -%}
  642. gitfs_remotes:
  643. {%- for remote in cfg_master['gitfs_remotes'] %}
  644. {%- if remote is iterable and remote is not string %}
  645. {%- for repo, children in remote.items() %}
  646. - {{ repo }}:
  647. {%- for child in children %}
  648. {%- for key, value in child.items() %}
  649. - {{ key }}: {{ value }}
  650. {%- endfor -%}
  651. {%- endfor -%}
  652. {%- endfor -%}
  653. {%- else %}
  654. - {{ remote }}
  655. {%- endif -%}
  656. {%- endfor -%}
  657. {%- endif %}
  658. #gitfs_remotes:
  659. # - git://github.com/saltstack/salt-states.git
  660. # - file:///var/git/saltmaster
  661. #
  662. # The gitfs_ssl_verify option specifies whether to ignore ssl certificate
  663. # errors when contacting the gitfs backend. You might want to set this to
  664. # false if you're using a git backend that uses a self-signed certificate but
  665. # keep in mind that setting this flag to anything other than the default of True
  666. # is a security concern, you may want to try using the ssh transport.
  667. {{ get_config('gitfs_ssl_verify', 'True') }}
  668. # The gitfs_root option gives the ability to serve files from a subdirectory
  669. # within the repository. The path is defined relative to the root of the
  670. # repository and defaults to the repository root.
  671. {{ get_config('gitfs_root', 'somefolder/otherfolder') }}
  672. # The gitfs_env_whitelist and gitfs_env_blacklist parameters allow for greater
  673. # control over which branches/tags are exposed as fileserver environments.
  674. {% if 'gitfs_env_whitelist' in cfg_master -%}
  675. gitfs_env_whitelist:
  676. {%- for git_env in cfg_master['gitfs_env_whitelist'] %}
  677. - {{ git_env }}
  678. {%- endfor -%}
  679. {% else -%}
  680. # gitfs_env_whitelist:
  681. # - base
  682. # - v1.*
  683. {% endif %}
  684. {% if 'gitfs_env_blacklist' in cfg_master -%}
  685. gitfs_env_blacklist:
  686. {%- for git_env in cfg_master['gitfs_env_blacklist'] %}
  687. - {{ git_env }}
  688. {%- endfor -%}
  689. {% else -%}
  690. # gitfs_env_blacklist:
  691. # - bug/*
  692. # - feature/*
  693. {% endif %}
  694. ##### Pillar settings #####
  695. ##########################################
  696. # Salt Pillars allow for the building of global data that can be made selectively
  697. # available to different minions based on minion grain filtering. The Salt
  698. # Pillar is laid out in the same fashion as the file server, with environments,
  699. # a top file and sls files. However, pillar data does not need to be in the
  700. # highstate format, and is generally just key/value pairs.
  701. {% if 'pillar_roots' in cfg_master -%}
  702. pillar_roots:
  703. {%- for name, roots in cfg_master['pillar_roots']|dictsort %}
  704. {{ name }}:
  705. {%- for dir in roots %}
  706. - {{ dir }}
  707. {%- endfor -%}
  708. {%- endfor -%}
  709. {% elif 'pillar_roots' in cfg_salt -%}
  710. pillar_roots:
  711. {%- for name, roots in cfg_salt['pillar_roots']|dictsort %}
  712. {{ name }}:
  713. {%- for dir in roots %}
  714. - {{ dir }}
  715. {%- endfor -%}
  716. {%- endfor -%}
  717. {%- else -%}
  718. #pillar_roots:
  719. # base:
  720. # - /srv/pillar
  721. {%- endif %}
  722. {% if 'ext_pillar' in cfg_master %}
  723. ext_pillar:
  724. {%- for pillar in cfg_master['ext_pillar'] -%}
  725. {%- for key in pillar -%}
  726. {%- if pillar[key] is string %}
  727. - {{ key }}: {{ pillar[key] }}
  728. {%- elif pillar[key] is iterable and pillar[key] is not mapping %}
  729. - {{ key }}:
  730. {%- for parameter in pillar[key] %}
  731. - {{ parameter }}
  732. {%- endfor -%}
  733. {%- elif pillar[key] is mapping and pillar[key] is not string %}
  734. - {{ key }}:
  735. {%- for parameter in pillar[key] %}
  736. {{ parameter }}: {{pillar[key][parameter]}}
  737. {%- endfor %}
  738. {%- else %}
  739. # Error in rendering {{ key }}, please read https://docs.saltstack.com/en/latest/topics/development/external_pillars.html#configuration
  740. {% endif %}
  741. {%- endfor -%}
  742. {%- endfor %}
  743. {% elif 'ext_pillar' in cfg_salt %}
  744. ext_pillar:
  745. {% for pillar in cfg_salt['ext_pillar'] %}
  746. - {{ pillar.items()[0][0] }}: {{ pillar.items()[0][1] }}
  747. {% endfor %}
  748. {% else %}
  749. #ext_pillar:
  750. # - hiera: /etc/hiera.yaml
  751. # - cmd_yaml: cat /etc/salt/yaml
  752. {% endif %}
  753. # The ext_pillar_first option allows for external pillar sources to populate
  754. # before file system pillar. This allows for targeting file system pillar from
  755. # ext_pillar.
  756. {{ get_config('ext_pillar_first', 'False') }}
  757. # The pillar_gitfs_ssl_verify option specifies whether to ignore ssl certificate
  758. # errors when contacting the pillar gitfs backend. You might want to set this to
  759. # false if you're using a git backend that uses a self-signed certificate but
  760. # keep in mind that setting this flag to anything other than the default of True
  761. # is a security concern, you may want to try using the ssh transport.
  762. {{ get_config('pillar_gitfs_ssl_verify', 'True') }}
  763. # The pillar_opts option adds the master configuration file data to a dict in
  764. # the pillar called "master". This is used to set simple configurations in the
  765. # master config file that can then be used on minions.
  766. {{ get_config('pillar_opts', 'True') }}
  767. # The pillar_safe_render_error option prevents the master from passing pillar
  768. # render errors to the minion. This is set on by default because the error could
  769. # contain templating data which would give that minion information it shouldn't
  770. # have, like a password! When set true the error message will only show:
  771. # Rendering SLS 'my.sls' failed. Please see master log for details.
  772. {{ get_config('pillar_safe_render_error', 'True') }}
  773. # The pillar_source_merging_strategy option allows you to configure merging strategy
  774. # between different sources. It accepts four values: recurse, aggregate, overwrite,
  775. # or smart. Recurse will merge recursively mapping of data. Aggregate instructs
  776. # aggregation of elements between sources that use the #!yamlex renderer. Overwrite
  777. # will verwrite elements according the order in which they are processed. This is
  778. # behavior of the 2014.1 branch and earlier. Smart guesses the best strategy based
  779. # on the "renderer" setting and is the default value.
  780. {{ get_config('pillar_source_merging_strategy', 'smart') }}
  781. # Recursively merge lists by aggregating them instead of replacing them.
  782. {{ get_config('pillar_merge_lists', False) }}
  783. # Git External Pillar (git_pillar) Configuration Options
  784. #
  785. # Specify the provider to be used for git_pillar. Must be either pygit2 or
  786. # gitpython. If unset, then both will be tried in that same order, and the
  787. # first one with a compatible version installed will be the provider that
  788. # is used.
  789. {{ get_config('git_pillar_provider', 'pygit2') }}
  790. # If the desired branch matches this value, and the environment is omitted
  791. # from the git_pillar configuration, then the environment for that git_pillar
  792. # remote will be base.
  793. {{ get_config('git_pillar_base', 'master') }}
  794. # If the branch is omitted from a git_pillar remote, then this branch will
  795. # be used instead.
  796. {{ get_config('git_pillar_branch', 'master') }}
  797. # Environment to use for git_pillar remotes. This is normally derived from
  798. # the branch/tag (or from a per-remote env parameter), but if set this will
  799. # override the process of deriving the env from the branch/tag name.
  800. {{ get_config('git_pillar_env', '') }}
  801. # Path relative to the root of the repository where the git_pillar top file
  802. # and SLS files are located.
  803. {{ get_config('git_pillar_root', 'pillar') }}
  804. # Specifies whether or not to ignore SSL certificate errors when contacting
  805. # the remote repository.
  806. {{ get_config('git_pillar_ssl_verify', True) }}
  807. # When set to False, if there is an update/checkout lock for a git_pillar
  808. # remote and the pid written to it is not running on the master, the lock
  809. # file will be automatically cleared and a new lock will be obtained.
  810. {{ get_config('git_pillar_global_lock', False) }}
  811. # Git External Pillar Authentication Options
  812. #
  813. # Along with git_pillar_password, is used to authenticate to HTTPS remotes.
  814. {{ get_config('git_pillar_user', '') }}
  815. # Along with git_pillar_user, is used to authenticate to HTTPS remotes.
  816. # This parameter is not required if the repository does not use authentication.
  817. {{ get_config('git_pillar_password', '') }}
  818. # By default, Salt will not authenticate to an HTTP (non-HTTPS) remote.
  819. # This parameter enables authentication over HTTP.
  820. {{ get_config('git_pillar_insecure_auth', False) }}
  821. # Along with git_pillar_privkey (and optionally git_pillar_passphrase),
  822. # is used to authenticate to SSH remotes.
  823. {{ get_config('git_pillar_pubkey', '') }}
  824. # Along with git_pillar_pubkey (and optionally git_pillar_passphrase),
  825. # is used to authenticate to SSH remotes.
  826. {{ get_config('git_pillar_privkey', '') }}
  827. # This parameter is optional, required only when the SSH key being used
  828. # to authenticate is protected by a passphrase.
  829. {{ get_config('git_pillar_passphrase', '') }}
  830. ##### Syndic settings #####
  831. ##########################################
  832. # The Salt syndic is used to pass commands through a master from a higher
  833. # master. Using the syndic is simple. If this is a master that will have
  834. # syndic servers(s) below it, then set the "order_masters" setting to True.
  835. #
  836. # If this is a master that will be running a syndic daemon for passthrough, then
  837. # the "syndic_master" setting needs to be set to the location of the master server
  838. # to receive commands from.
  839. # Set the order_masters setting to True if this master will command lower
  840. # masters' syndic interfaces.
  841. {{ get_config('order_masters', 'False') }}
  842. # If this master will be running a salt syndic daemon, syndic_master tells
  843. # this master where to receive commands from.
  844. {{ get_config('syndic_master', 'masterofmaster') }}
  845. # This is the 'ret_port' of the MasterOfMaster:
  846. {{ get_config('syndic_master_port', '4506') }}
  847. # PID file of the syndic daemon:
  848. {{ get_config('syndic_pidfile', '/var/run/salt-syndic.pid') }}
  849. # LOG file of the syndic daemon:
  850. {{ get_config('syndic_log_file', 'syndic.log') }}
  851. ##### Peer Publish settings #####
  852. ##########################################
  853. # Salt minions can send commands to other minions, but only if the minion is
  854. # allowed to. By default "Peer Publication" is disabled, and when enabled it
  855. # is enabled for specific minions and specific commands. This allows secure
  856. # compartmentalization of commands based on individual minions.
  857. # The configuration uses regular expressions to match minions and then a list
  858. # of regular expressions to match functions. The following will allow the
  859. # minion authenticated as foo.example.com to execute functions from the test
  860. # and pkg modules.
  861. #peer:
  862. # foo.example.com:
  863. # - test.*
  864. # - pkg.*
  865. #
  866. # This will allow all minions to execute all commands:
  867. #peer:
  868. # .*:
  869. # - .*
  870. #
  871. # This is not recommended, since it would allow anyone who gets root on any
  872. # single minion to instantly have root on all of the minions!
  873. {% if 'peer' in cfg_master %}
  874. peer:
  875. {% for name, roots in cfg_master['peer'].items() %}
  876. {{ name }}:
  877. {% for mod in roots %}
  878. - {{ mod }}
  879. {% endfor %}
  880. {% endfor %}
  881. {% elif 'peer' in cfg_salt %}
  882. peer:
  883. {% for name, roots in cfg_salt['peer'].items() %}
  884. {{ name }}:
  885. {% for mod in roots %}
  886. - {{ mod }}
  887. {% endfor %}
  888. {% endfor %}
  889. {% endif %}
  890. # Minions can also be allowed to execute runners from the salt master.
  891. # Since executing a runner from the minion could be considered a security risk,
  892. # it needs to be enabled. This setting functions just like the peer setting
  893. # except that it opens up runners instead of module functions.
  894. #
  895. # All peer runner support is turned off by default and must be enabled before
  896. # using. This will enable all peer runners for all minions:
  897. #peer_run:
  898. # .*:
  899. # - .*
  900. #
  901. # To enable just the manage.up runner for the minion foo.example.com:
  902. #peer_run:
  903. # foo.example.com:
  904. # - manage.up
  905. {% if 'peer_run' in cfg_master %}
  906. peer_run:
  907. {% for name, roots in cfg_master['peer_run'].items() %}
  908. {{ name }}:
  909. {% for mod in roots %}
  910. - {{ mod }}
  911. {% endfor %}
  912. {% endfor %}
  913. {% elif 'peer_run' in cfg_salt %}
  914. peer_run:
  915. {% for name, roots in cfg_salt['peer_run'].items() %}
  916. {{ name }}:
  917. {% for mod in roots %}
  918. - {{ mod }}
  919. {% endfor %}
  920. {% endfor %}
  921. {% endif %}
  922. ##### Mine settings #####
  923. #####################################
  924. # Restrict mine.get access from minions. By default any minion has a full access
  925. # to get all mine data from master cache. In acl definion below, only pcre matches
  926. # are allowed.
  927. # mine_get:
  928. # .*:
  929. # - .*
  930. #
  931. # The example below enables minion foo.example.com to get 'network.interfaces' mine
  932. # data only, minions web* to get all network.* and disk.* mine data and all other
  933. # minions won't get any mine data.
  934. {% if 'mine_get' in cfg_master -%}
  935. mine_get:
  936. {%- for minion, data in cfg_master['mine_get']|dictsort %}
  937. {{ minion }}:
  938. {%- for command in data %}
  939. - {% raw %}'{% endraw %}{{ command }}{% raw %}'{% endraw %}
  940. {%- endfor -%}
  941. {%- endfor -%}
  942. {% elif 'mine_get' in cfg_salt -%}
  943. mine_get:
  944. {%- for minion, data in cfg_salt['mine_get']|dictsort %}
  945. {{ minion }}:
  946. {%- for command in data %}
  947. - {% raw %}'{% endraw %}{{ command }}{% raw %}'{% endraw %}
  948. {%- endfor -%}
  949. {%- endfor -%}
  950. {% else -%}
  951. # mine_get:
  952. # foo.example.com:
  953. # - network.interfaces
  954. # web.*:
  955. # - network.*
  956. # - disk.*
  957. {%- endif %}
  958. ##### Logging settings #####
  959. ##########################################
  960. # The location of the master log file
  961. # The master log can be sent to a regular file, local path name, or network
  962. # location. Remote logging works best when configured to use rsyslogd(8) (e.g.:
  963. # ``file:///dev/log``), with rsyslogd(8) configured for network logging. The URI
  964. # format is: <file|udp|tcp>://<host|socketpath>:<port-if-required>/<log-facility>
  965. #log_file: /var/log/salt/master
  966. #log_file: file:///dev/log
  967. #log_file: udp://loghost:10514
  968. {{ get_config('log_file', '/var/log/salt/master') }}
  969. {{ get_config('key_logfile', '/var/log/salt/key') }}
  970. # The level of messages to send to the console.
  971. # One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'.
  972. #
  973. # The following log levels are considered INSECURE and may log sensitive data:
  974. # ['garbage', 'trace', 'debug']
  975. #
  976. {{ get_config('log_level', 'warning') }}
  977. # The level of messages to send to the log file.
  978. # One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'.
  979. # If using 'log_granular_levels' this must be set to the highest desired level.
  980. {{ get_config('log_level_logfile', 'warning') }}
  981. # The date and time format used in log messages. Allowed date/time formating
  982. # can be seen here: http://docs.python.org/library/time.html#time.strftime
  983. {{ get_config('log_datefmt', "'%H:%M:%S'") }}
  984. {{ get_config('log_datefmt_logfile', "'%Y-%m-%d %H:%M:%S'") }}
  985. # The format of the console logging messages. Allowed formatting options can
  986. # be seen here: http://docs.python.org/library/logging.html#logrecord-attributes
  987. #
  988. # Console log colors are specified by these additional formatters:
  989. #
  990. # %(colorlevel)s
  991. # %(colorname)s
  992. # %(colorprocess)s
  993. # %(colormsg)s
  994. #
  995. # Since it is desirable to include the surrounding brackets, '[' and ']', in
  996. # the coloring of the messages, these color formatters also include padding as
  997. # well. Color LogRecord attributes are only available for console logging.
  998. #
  999. {{ get_config('log_fmt_console', "'%(colorlevel)s %(colormsg)s'") }}
  1000. {{ get_config('log_fmt_console', "'[%(levelname)-8s] %(message)s'") }}
  1001. {{ get_config('log_fmt_logfile', "'%(asctime)s,%(msecs)03.0f [%(name)-17s][%(levelname)-8s] %(message)s'") }}
  1002. # This can be used to control logging levels more specificically. This
  1003. # example sets the main salt library at the 'warning' level, but sets
  1004. # 'salt.modules' to log at the 'debug' level:
  1005. # log_granular_levels:
  1006. # 'salt': 'warning'
  1007. # 'salt.modules': 'debug'
  1008. #
  1009. {% if 'log_granular_levels' in cfg_master %}
  1010. log_granular_levels:
  1011. {% for name, lvl in cfg_master['log_granular_levels'].items() %}
  1012. {{ name }}: {{ lvl }}
  1013. {% endfor %}
  1014. {% elif 'log_granular_levels' in cfg_salt %}
  1015. log_granular_levels:
  1016. {% for name, lvl in cfg_salt['log_granular_levels'].items() %}
  1017. {{ name }}: {{ lvl }}
  1018. {% endfor %}
  1019. {% else %}
  1020. #log_granular_levels: {}
  1021. {% endif %}
  1022. ##### Node Groups ######
  1023. ##########################################
  1024. # Node groups allow for logical groupings of minion nodes. A group consists of a group
  1025. # name and a compound target.
  1026. #nodegroups:
  1027. # group1: 'L@foo.domain.com,bar.domain.com,baz.domain.com and bl*.domain.com'
  1028. # group2: 'G@os:Debian and foo.domain.com'
  1029. {% if 'nodegroups' in cfg_master %}
  1030. nodegroups:
  1031. {% for name, lvl in cfg_master['nodegroups'].items() %}
  1032. {{ name }}: {{ lvl }}
  1033. {% endfor %}
  1034. {% elif 'nodegroups' in cfg_salt %}
  1035. nodegroups:
  1036. {% for name, lvl in cfg_salt['nodegroups'].items() %}
  1037. {{ name }}: {{ lvl }}
  1038. {% endfor %}
  1039. {% endif %}
  1040. ##### Range Cluster settings #####
  1041. ##########################################
  1042. # The range server (and optional port) that serves your cluster information
  1043. # https://github.com/ytoolshed/range/wiki/%22yamlfile%22-module-file-spec
  1044. #
  1045. {{ get_config('range_server', 'range:80') }}
  1046. ##### Windows Software Repo settings #####
  1047. ###########################################
  1048. # Repo settings for 2015.8+ master used with 2015.8+ Windows minions
  1049. #
  1050. # Location of the repo on the master:
  1051. {{ get_config('winrepo_dir_ng', '/srv/salt/win/repo-ng') }}
  1052. # List of git repositories to include with the local repo:
  1053. {% if 'winrepo_remotes_ng' in cfg_master %}
  1054. winrepo_remotes_ng:
  1055. {% for repo in cfg_master['winrepo_remotes_ng'] %}
  1056. - {{ repo }}
  1057. {% endfor %}
  1058. {% elif 'winrepo_remotes_ng' in cfg_salt %}
  1059. winrepo_remotes_ng:
  1060. {% for repo in cfg_salt['winrepo_remotes_ng'] %}
  1061. - {{ repo }}
  1062. {% endfor %}
  1063. {% else %}
  1064. #winrepo_remotes_ng:
  1065. # - 'https://github.com/saltstack/salt-winrepo-ng.git'
  1066. {% endif %}
  1067. # Repo settings for 2015.8+ master used with pre-2015.8 Windows minions
  1068. #
  1069. # Location of the repo on the master:
  1070. {{ get_config('winrepo_dir', '/srv/salt/win/repo') }}
  1071. # Location of the master's repo cache file:
  1072. {{ get_config('winrepo_cachefile', 'winrepo.p') }}
  1073. # List of git repositories to include with the local repo:
  1074. {% if 'winrepo_remotes' in cfg_master %}
  1075. winrepo_remotes:
  1076. {% for repo in cfg_master['winrepo_remotes'] %}
  1077. - {{ repo }}
  1078. {% endfor %}
  1079. {% elif 'winrepo_remotes' in cfg_salt %}
  1080. winrepo_remotes:
  1081. {% for repo in cfg_salt['winrepo_remotes'] %}
  1082. - {{ repo }}
  1083. {% endfor %}
  1084. {% else %}
  1085. #winrepo_remotes:
  1086. # - 'https://github.com/saltstack/salt-winrepo.git'
  1087. {% endif %}
  1088. ##### Windows Software Repo settings - Pre 2015.8 #####
  1089. ########################################################
  1090. # Legacy repo settings for pre-2015.8 Windows minions.
  1091. #
  1092. # Location of the repo on the master:
  1093. {{ get_config('win_repo', '/srv/salt/win/repo') }}
  1094. # Location of the master's repo cache file:
  1095. {{ get_config('win_repo_mastercachefile', '/srv/salt/win/repo/winrepo.p') }}
  1096. # List of git repositories to include with the local repo:
  1097. {% if 'win_gitrepos' in cfg_master %}
  1098. win_gitrepos:
  1099. {% for repo in cfg_master['win_gitrepos'] %}
  1100. - {{ repo }}
  1101. {% endfor %}
  1102. {% elif 'win_gitrepos' in cfg_salt %}
  1103. win_gitrepos:
  1104. {% for repo in cfg_salt['win_gitrepos'] %}
  1105. - {{ repo }}
  1106. {% endfor %}
  1107. {% else %}
  1108. #winrepo_remotes:
  1109. # - 'https://github.com/saltstack/salt-winrepo.git'
  1110. {% endif %}
  1111. ##### Returner settings ######
  1112. ############################################
  1113. # Which returner(s) will be used for minion's result:
  1114. #return: mysql
  1115. {{ get_config('return', '')}}
  1116. ###### Miscellaneous settings ######
  1117. ############################################
  1118. # Default match type for filtering events tags: startswith, endswith, find, regex, fnmatch
  1119. {{ get_config('event_match_type', 'startswith') }}
  1120. {%- if 'halite' in cfg_master %}
  1121. ##### Halite #####
  1122. ##########################################
  1123. halite:
  1124. {%- for name, value in cfg_master['halite'].items() %}
  1125. {{ name }}: {{ value }}
  1126. {%- endfor %}
  1127. {%- endif %}
  1128. {%- if 'rest_cherrypy' in cfg_master %}
  1129. ##### rest_cherrypy #####
  1130. ##########################################
  1131. rest_cherrypy:
  1132. {%- for name, value in cfg_master['rest_cherrypy'].items() %}
  1133. {{ name }}: {{ value }}
  1134. {%- endfor %}
  1135. {%- endif %}
  1136. {%- if 'rest_tornado' in cfg_master %}
  1137. ##### rest_tornado #####
  1138. ###########################################
  1139. rest_tornado:
  1140. {%- for name, value in cfg_master['rest_tornado'].items() %}
  1141. {{ name }}: {{ value }}
  1142. {%- endfor %}
  1143. {%- endif %}
  1144. {%- if 'presence_events' in cfg_master %}
  1145. ##### presence events #####
  1146. ##########################################
  1147. {{ get_config('presence_events', 'False') }}
  1148. {%- endif %}
  1149. {%- if 'consul_config' in cfg_master %}
  1150. ##### consul_config #####
  1151. ##########################################
  1152. consul_config:
  1153. {%- for name, value in cfg_master['consul_config'].items() %}
  1154. {{ name }}: {{ value }}
  1155. {%- endfor %}
  1156. {%- endif %}