Salt 2016.3.0 Release Notes - Codename Boron¶

Known Issues¶

• issue #33516: When upgrading from 2015.8.10 to 2016.3.0 on centos7/redhat7 salt-minion must be restarted twice.

• issue #33517: SPM does not work on amazon linux 2015 in 2016.3.0.

Backwards-incompatible Changes¶

• The default path for the extension_modules master config option has been changed. Prior to this release, the location was a directory named extmods in the Salt cachedir. On most platforms, this would put the extension_modules directory in /var/cache/salt/extmods. It has been moved one directory down, into the master cachedir. On most platforms, this is /var/cache/salt/master/extmods. Most users won't have to worry about this, but those who have been manually placing custom runners into /var/cache/salt/extmods/runners, or outputters into /var/cache/salt/extmods/output, etc. will be affected by this. To transition, it is recommended not to simply move the extmods directory into /var/cache/salt/master, but to copy the custom modules into the salt fileserver under salt://_runners, salt://_output, etc. and sync them using the functions in the new saltutil runner.

• The pkg.check_db function has been removed for yum/dnf.

Core Changes¶

• The onchanges requisite now fires if any watched state changes. issue #19592.

• The ext_pillar functions must now accept a minion ID as the first argument. This stops the deprecation path started in Salt 0.17.x. Before this minion ID first argument was introduced, the minion ID could be retrieved accessing __opts__['id'] losing the reference to the master ID initially set in opts. This is no longer the case, __opts__['id'] will be kept as the master ID.

• Custom types can now be synced to the master using the new saltutil runner. Before, these needed to manually be placed under the extension_modules directory. This allows custom modules to easily be synced to the master to make them available when compiling Pillar data. Just place custom runners into salt://_runners, custom outputters into salt://_output, etc. and use the functions from the saltutil runner to sync them.

• The client_acl configuration options were renamed to publisher_acl.

• Added a new --config-dump option (issue #26639).

• TCP Transport presence events were updated to work with a NAT (PR #30629).

• A minion_pillar_cache setting was added to save rendered pillar data to cachedir for later use when file_client is set to local (PR #30428).

• Added the ability for binary data (such as a license key) to be distributed via pillar using the file.managed (issue #9569).

• Scheduled jobs now include success and retcode (issue #24237).

• The saltversioninfo grain was changed from a string to a list to enable reading values by index. (PR #30082).

• A pillar_merge_lists option was added to enable recursively merging pillar lists by aggregating them instead of replacing them (PR #30062).

• Grain values reported by Debian 8 (jessie) when lsb-release is installed were updated for consistency (PR #28649).

• A new option for minions called master_tries has been added. This specifies the number of times a minion should attempt to contact a master to attempt a connection. This allows better handling of occasional master downtime in a multi-master topology.

• The default directory for deploying the salt-thin tarball has changed for salt-ssh. It is now /var/tmp instead of /tmp. Users may also wish to delete any directories in /tmp ending with _salt/. (issue #32771)

External Module Packaging¶

Modules may now be packaged via entry-points in setuptools. See external module packaging tutorial for more information.

Cloud Changes¶

• Refactored the OpenNebula driver and added numerous --function and --action commands to enhance Salt support for image, template, security group, virtual network and virtual machine management in OpenNebula.

• Added execution/state modules to support the deployment of AWS cognito identity pools (PR #31094).

• Added ability to set tags and listener policies on a AWS ELB (PR #27552).

Platform Changes¶

• Renamed modules related to macOS. The following module filenames were changed. The virtual name remained unchanged.

• PR ##30558: renamed osxdesktop.py to mac_desktop.py

• PR ##30557: renamed macports.py to mac_ports.py

• PR ##30556: renamed darwin_sysctl.py to mac_sysctl.py

• PR ##30555: renamed brew.py to mac_brew.py

• PR ##30552: renamed darwin_pkgutil.py to mac_pkgutil.py

Package Support¶

• Ubuntu Xenial: Packages for Ubuntu Xenial (16.04) are available for 2016.3.0 and onwards. See repo.saltstack.com for more information. Note that Xenial comes with Debian's packaged version of Salt 2015.8.8 and official repo.saltstack.com packages are available for 2015.8 releases beginning with Salt 2015.8.11.

Proxy Minion Changes¶

The deprecated config option enumerate_proxy_minions has been removed.

As mentioned in earlier documentation, the add_proxymodule_to_opts configuration variable defaults to False in this release. This means if you have proxymodules or other code looking in __opts__['proxymodule'] you will need to set this variable in your /etc/salt/proxy file, or modify your code to use the __proxy__ injected variable.

The __proxyenabled__ directive now only applies to grains and proxy modules themselves. Standard execution modules and state modules are not prevented from loading for proxy minions.

Support has been added to Salt's loader allowing custom proxymodules to be placed in salt://_proxy. Proxy minions that need these modules will need to be restarted to pick up any changes. A corresponding utility function, saltutil.sync_proxymodules, has been added to sync these modules to minions.

Enhancements in grains processing have made the __proxyenabled__ directive somewhat redundant in dynamic grains code. It is still required, but best practices for the __virtual__ function in grains files have changed. It is now recommended that the __virtual__ functions check to make sure they are being loaded for the correct proxytype, example below:

def __virtual__():
    """
    Only work on proxy
    """
    try:
        if salt.utils.is_proxy() and __opts__["proxy"]["proxytype"] == "ssh_sample":
            return __virtualname__
    except KeyError:
        pass

    return False

The try/except block above exists because grains are processed very early in the proxy minion startup process, sometimes earlier than the proxy key in the __opts__ dictionary is populated.

Grains are loaded so early in startup that no dunder dictionaries are present, so __proxy__, __salt__, etc. are not available. Custom grains located in /srv/salt/_grains and in the salt install grains directory can now take a single argument, proxy, that is identical to __proxy__. This enables patterns like

def get_ip(proxy):
    """
    Ask the remote device what IP it has
    """
    return {"ip": proxy["proxymodulename.get_ip"]()}

Then the grain ip will contain the result of calling the get_ip() function in the proxymodule called proxymodulename.

Proxy modules now benefit from including a function called initialized(). This function should return True if the proxy's init() function has been successfully called. This is needed to make grains processing easier.

Finally, if there is a function called grains in the proxymodule, it will be executed on proxy-minion startup and its contents will be merged with the rest of the proxy's grains. Since older proxy-minions might have used other methods to call such a function and add its results to grains, this is config-gated by a new proxy configuration option called proxy_merge_grains_in_module. This defaults to False in this release. It will default to True in the release after next. The next release is codenamed Carbon, the following is Nitrogen.

The example proxy minions rest_sample and ssh_sample have been updated to reflect these changes.

Syndic Updates¶

A major performance and management issue was found and fixed in the syndic. This makes the Salt Syndic substantially more reliable and performant. Please make sure that the syndic and the master of masters which syndics attach to are updated, otherwise the syndic fixes alone can cause minor performance issues with older master of masters. Please update masters first, then syndics. Minions do not need to be updated for this fix to work.

Module Changes¶

• file execution module: show_diff is deprecated in favor of show_changes. (PR #30988)

• reg execution module:

  • Removed the following deprecated functions from the reg module (PR #30956):

    • read_key

    • set_key

    • create_key

    • delete_key

  • Removed force parameter from reg state module

  • Fixed virtual function in state

  • Improved error information for reg.delete_value function

• jboss7 execution module: deployed function was decoupled from Artifactory by removing Artifactory-specific functionality. Note that the changes in some of the function arguments break existing state files, see issue #30515 and PR #3080 for details.

• pkg state module: The wait function was removed, the functionality was replaced with the onchanges requisite (PR #30297).

• firewalld state module: A permanent argument was added add_port. Note that permanent defaults to True, which changes previous behavior (PR #30275). A bind function was also added that allows binding zones to interfaces and sources (PR #29497).

• journald beacon module: The event string was updated to include a tag. Note this might impact existing reactors based on this beacon. (PR #30116).

• postgres_privileges state module: The default value of the prepend argument was changed from None to public.

• zenoss execution module: The add_device function was updated with a default value of 1000 for prod_state to match the documentation (PR #28924).

• The etcd execution module, state module, returner module, and util module were refactor (PR #28599). This refactor changes error returns for several functions (primarily edge cases):

  • get: Used to return '' on key-not-found. Now returns None.

  • set: Used to return '' on issues setting keys. Now returns None.

  • ls: Used to return {path: {}} on key-not-found. Now returns None.

  • Tree: Used to return {} on key-not-found. Now returns None.

• smartos_virt execution module: Updated to use most of the new smartos_vmadm (PR #28284).

• apache_conf state module, apache_module state module, and apache_site state module: the enable and disable functions were renamed to enabled and disabled, respectively. In PR #33562, these functions were readded and properly deprecated and will be removed in Salt 2017.7.0. This fix will be available in 2016.3.1. As a workaround, try

  apache_module.enable{{ 'd' if grains.saltversioninfo == [2016, 3, 0] else '' }}
  

New Features¶

New Modules¶

The following list contains a link to the new modules added in this release.