Salt 2015.8.0 Release Notes - Codename Beryllium¶

New SaltStack Installation Repositories¶

SaltStack now provides installation repositories for several platforms, with more to come. See the following links for instructions:

• Red Hat / CentOS 5, 6, 7
• Debian 8
• Windows
• FreeBSD

Send Event on State Completion¶

A fire_event global state keyword argument was added that allows any state to send an event upon completion. Useful for custom progress bars and checking in on long state runs. See fire_event.

ZeroMQ socket monitoring¶

If zmq_monitor is enabled, log all ZMQ events for socket monitoring purposes. Verbose, but useful.

SPM (Salt Package Manager)¶

Allows Salt formulas to be packaged for ease of deployment. See spm.

Specify a Single Environment for Top Files¶

A new default_top option was added to load the state top file from a single, specific environment, rather than merging top data across all environments. Additionally, new top_file_merge_strategy and env_order options were added for more control over top file merging. See The Top File.

Tornado TCP Transport¶

Implemented a pure-TCP transport, in addition to ZeroMQ and RAET. The new transport uses Tornado, which allows Salt to use a standardized set of libraries for asynchronous behavior, which should greatly improve reliability and performance.

Proxy Minion Enhancements¶

Proxy Minions have undergone a significant overhaul in 2015.8, see Proxy Minion Enhancements.

Engines¶

Salt engines are long-running, external processes that leverage Salt. See Salt Engines.

Core Changes¶

• Add system version info to versions_report, which appears in both salt --versions-report and salt '*' test.versions_report. Also added is an alias test.versions to test.versions_report. (issue 21906)
• Add colorized console logging support. This is activated by using %(colorlevel)s, %(colorname)s, %(colorprocess)s, %(colormsg)s in log_fmt_console in the config file for any of salt-master, salt-minion, and salt-cloud.

Git Pillar¶

The git external pillar has been rewritten to bring it up to feature parity with gitfs. Support for pygit2_ has been added, bringing with it the ability to access authenticated repositories.

Using the new features will require updates to the git ext_pillar configuration, further details can be found in the pillar.git_pillar docs.

Salt Cloud Improvements¶

• Pricing data from several cloud providers (GCE, DigitalOcean, SoftLayer_HW, EC2)
• All cloud providers now use standardized bootstrapping code.
• Modified the Linode Salt Cloud driver to use Linode's native API instead of depending on apache-libcloud or linode-python.

State and Execution Module Improvements¶

• New and improved Docker state and execution modules (state and execution module).

• OpenStack Glance API V2 execution module
• Amazon VPC state module
• RallyDev execution module
• BambooHR execution module
• Stormpath execution, state modules
• Remove unused argument timeout in jboss7.status.
• Deprecate enabled argument in pkgrepo.managed in favor of disabled.
• Archive module changes: In the archive.tar and archive.cmd_unzip module functions, remove the arbitrary prefixing of the options string with -. An options string beginning with a --long-option, would have uncharacteristically needed its first - removed under the former scheme. Also, tar will parse its options differently if short options are used with or without a preceding -, so it is better to not confuse the user into thinking they're using the non- - format, when really they are using the with- - format.
• Added __states__ to state modules, for cross-calling states. This enables using existing states when writing custom states. See cross calling states.

Windows Improvements¶

• Enhanced the windows minion silent installation with command line parameters to configure the salt master and minion name. See Silent Installer Options.
• Improved user management with additional capabilities in the user module for Windows.
• Improved patch management with a new module for managing windows updates (win_wua).
• Turned on multi-processing by default for windows in minion configuration.

Other Improvements¶

• Sanitize sensitive fields in http.query
• Allow authorization to be read from Django and eauth
• Add templating to SMTP returner
• New REST module for SDB
• Added rest_timeout config option and timeout argument to jobs api call
• Provide config options for Raet lane and road buffer count. (Useful for BSD kernels)
• Implemented ZeroMQ socket monitor for master and minion
• Add end time to master job cache for jobs (optional, off by default)
• Tornado is now the default backend for http.request
• Support pillarenv selection as it's done for saltenv
• salt was updated to use python-crypto version 2.6.1, which removes the dependency on python-m2crypto.

Deprecations¶

• The digital_ocean.py Salt Cloud driver was removed in favor of the digital_ocean_v2.py driver as DigitalOcean has removed support for APIv1. The digital_ocean_v2.py was renamed to digital_ocean.py and supports DigitalOcean's APIv2.
• The vsphere.py Salt Cloud driver has been deprecated in favor of the vmware.py driver.
• The openstack.py Salt Cloud driver has been deprecated in favor of the nova.py driver.
• The use of provider in Salt Cloud provider files to define cloud drivers has been deprecated in favor of using driver. Both terms will work until the Nitrogen release of Salt. Example provider file:

my-ec2-cloud-config:
  id: 'HJGRYCILJLKJYG'
  key: 'kdjgfsgm;woormgl/aserigjksjdhasdfgn'
  private_key: /etc/salt/my_test_key.pem
  keyname: my_test_key
  securitygroup: default
  driver: ec2

• The use of lock has been deprecated and from salt.utils.fopen. salt.utils.flopen should be used instead.
• The following args have been deprecated from the rabbitmq_vhost.present state: user, owner, conf, write, read, and runas.
• The use of runas has been deprecated from the rabbitmq_vhost.absent state.
• Support for output in mine.get was removed. --out should be used instead.
• The use of delim was removed from the following functions in the match execution module: pillar_pcre, pillar, grain_pcre,

Security Fixes¶

CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log

Updated the Git state and execution modules to no longer display HTTPS basic authentication credentials in loglevel debug output on the Salt master. These credentials are now replaced with REDACTED in the debug output. Thanks to Andreas Stieger <asteiger@suse.com> for bringing this to our attention.

Major Bug Fixes¶

• Fixed minion failover to next master on DNS errors (issue 21082)
• Fixed memory consumption in SaltEvents (issue 25557)
• Don't lookup outside system path in which() util (issue 24085)
• Fixed broken jobs rest api call (issue 23408)
• Fixed stale grains data using in modules (issue 24073)
• Added ssh_identities_only config flag for ssh-agent configured environments (issue 24096)
• Fixed "object has no attribute" errors for Raet transport (issue 21640)
• Flush event returners before master exit (issue 22814)
• Fix CommandExecutionError in grains generation with lspci missing (issue 23342)
• Fix salt-ssh against CentOS 7 when python-zmq not installed (issue 23503)
• Fix salt-ssh issues related to out-of-date six module (issue 20949)
• Fix salt-ssh thin generation after previous run was interrupted (issue 24376)
• Use proper line endings on Windows with "file.managed" w/contents (issue 25675)
• Fixed broken comment/uncomment functions in file.py (issue 24620)
• Fixed problem with unicode when changing computer description (issue 12255)
• Fixed problem with chocolatey module not loading (issue 25717)
• Fixed problem adding users to groups with spaces in the name (issue 25144)
• Fixed problem adding full name to user account (issue 25206)
• Fixed gem module stack trace (issue 21041)
• Fixed problem with file.managed when test=True (issue 20441)
• Fixed problem with powershell hanging while waiting for user input (issue 13943)
• Fixed problem where the salt-minion service would not consistently start (issue 25272)
• Fixed problem where pkg.refresh_db would return True even when winrepo.p was not found (issue 18919)
• Could someone please provide end to end example for Proxy Minion with REST (issue 25500)
• Proxy minions stopped working between 2014.7 and 2015.5 (issue 25053)
• Proxy minion documentation includes outdated code sample (issue 24018)
• Proxy Minion documentation missing grains example (issue 18273)
• Improve process management in proxy minion (issue 12024)
• Proxy minion never comes up with message ' I am XXX and I am not supposed to start any proxies.' (issue 25908)
• Fixed an issue that caused an exception when using Salt mine from pillar. (issue 11509)