diff --git a/CHANGELOG.md b/CHANGELOG.md index 29f6b44..36b1f77 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ for the list of changes in SaltStack. - Upgrade `salt-master` to `3007.1` _Chlorine_. - Change Docker base image to `ubuntu:noble-20240429`. +- Change Supervisor's user to `root` for `salt-master` and `salt-api` services. **3007.0_2** diff --git a/assets/build/install.sh b/assets/build/install.sh index 5df645d..e46ec72 100755 --- a/assets/build/install.sh +++ b/assets/build/install.sh @@ -30,7 +30,7 @@ useradd --home-dir "${SALT_HOME}" --create-home \ --groups shadow # Set PATH -exec_as_salt cat >> "${SALT_HOME}/.profile" <>"${SALT_HOME}/.profile" <> /etc/ssh/ssh_config +} >>/etc/ssh/ssh_config SUPERVISOR_CONFIG_FILE=/etc/supervisor/supervisord.conf @@ -73,13 +73,13 @@ else fi # configure supervisord to start salt-master -cat > /etc/supervisor/conf.d/salt-master.conf </etc/supervisor/conf.d/salt-master.conf < /etc/supervisor/conf.d/cron.conf </etc/supervisor/conf.d/cron.conf <&2 echo "[WARN] - $*") + (echo >&2 "[WARN] - $*") } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: log_error # DESCRIPTION: Echo errors to stderr. #---------------------------------------------------------------------------------------------------------------------- -function log_error() -{ - (>&2 echo "[ERROR] - $*") +function log_error() { + (echo >&2 "[ERROR] - $*") } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: map_uidgid # DESCRIPTION: Map salt user with host user. #---------------------------------------------------------------------------------------------------------------------- -function map_uidgid() -{ +function map_uidgid() { ORIG_PUID=$(id -u "${SALT_USER}") ORIG_PGID=$(id -g "${SALT_USER}") PGID=${PGID:-${PUID:-$ORIG_PGID}} @@ -90,7 +81,6 @@ function map_uidgid() fi } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: update_template # DESCRIPTION: Replace placeholders with values. @@ -98,14 +88,13 @@ function map_uidgid() # - 1: Template file with placeholders to replace # - @: Placeholder values #---------------------------------------------------------------------------------------------------------------------- -function update_template() -{ +function update_template() { local FILE=${1?missing argument} shift [[ ! -f "${FILE}" ]] && return 1 - local VARIABLES=( "$@" ) + local VARIABLES=("$@") local USR=$(stat -c %U "${FILE}") local tmp_file=$(mktemp) cp -a "${FILE}" "${tmp_file}" @@ -118,19 +107,18 @@ function update_template() # Replace placeholders ( export "${VARIABLES[@]}" - local IFS=":"; sudo -HEu "${USR}" envsubst "${VARIABLES[*]/#/$}" < "${tmp_file}" > "${FILE}" + local IFS=":" + sudo -HEu "${USR}" envsubst "${VARIABLES[*]/#/$}" <"${tmp_file}" >"${FILE}" ) rm -f "${tmp_file}" } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: configure_timezone # DESCRIPTION: Configure containers timezone. #---------------------------------------------------------------------------------------------------------------------- -function configure_timezone() -{ +function configure_timezone() { log_info "Configuring container timezone ..." # Perform sanity check of provided timezone value @@ -141,20 +129,18 @@ function configure_timezone() ln -snf "/usr/share/zoneinfo/${TIMEZONE}" /etc/localtime # Set timezone - echo "${TIMEZONE}" > /etc/timezone + echo "${TIMEZONE}" >/etc/timezone else log_error "Timezone: '${TIMEZONE}' is not valid. Check available timezones at: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones" return 1 fi } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: gen_signed_keys # DESCRIPTION: Generate a master_sign key pair and its signature. #---------------------------------------------------------------------------------------------------------------------- -function gen_signed_keys() -{ +function gen_signed_keys() { local output_dir="$1" if [[ ! -f "${SALT_KEYS_DIR}/master.pub" ]]; then @@ -175,9 +161,9 @@ function gen_signed_keys() # Create keys salt-key --gen-signature --auto-create --user "${SALT_USER}" \ - --config-dir "${generated_keys_dir}" \ - --pub "${SALT_KEYS_DIR}/master.pub" \ - --signature-path "${generated_keys_dir}" > /dev/null 2>&1 + --config-dir "${generated_keys_dir}" \ + --pub "${SALT_KEYS_DIR}/master.pub" \ + --signature-path "${generated_keys_dir}" >/dev/null 2>&1 # Move keys exec_as_salt mkdir -p "${output_dir}" @@ -190,7 +176,6 @@ function gen_signed_keys() echo -n "${output_dir}" } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: _check_key_pair_exists # DESCRIPTION: Check whether the given key-pair files exist. @@ -198,8 +183,7 @@ function gen_signed_keys() # - 1: The path to the key-pair file # #---------------------------------------------------------------------------------------------------------------------- -function _check_key_pair_exists() -{ +function _check_key_pair_exists() { local key_pair_file="$1" if [[ ! -f "${key_pair_file}.pem" || ! -f "${key_pair_file}.pub" ]]; then [[ -f "${key_pair_file}.pem" ]] || log_error "'${key_pair_file}.pem' doesn't exist" @@ -209,7 +193,6 @@ function _check_key_pair_exists() return 0 } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: _symlink_key_pair_files # DESCRIPTION: Create symlinks for the given key-pair files. @@ -218,8 +201,7 @@ function _check_key_pair_exists() # - 2: The target key-pair file # #---------------------------------------------------------------------------------------------------------------------- -function _symlink_key_pair_files() -{ +function _symlink_key_pair_files() { local source_key_pair="$1" local target_key_pair="$2" @@ -227,7 +209,6 @@ function _symlink_key_pair_files() ln -sfn "${source_key_pair}.pub" "${target_key_pair}.pub" } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: setup_keys_for_service # DESCRIPTION: Setup keys for the given service. @@ -239,8 +220,7 @@ function _symlink_key_pair_files() # - 3: The keys directory: SALT_KEYS_DIR, SALT_MINION_KEYS_DIR # #---------------------------------------------------------------------------------------------------------------------- -function setup_keys_for_service() -{ +function setup_keys_for_service() { local service="$1" local key_file_env_var="$2" local keys_dir="$3" @@ -265,7 +245,7 @@ function setup_keys_for_service() log_info " Creating new keys ..." # Fix issue #226 local tmp_keys_dir="$(exec_as_salt mktemp -d)" - salt-key --gen-keys "${service}" --gen-keys-dir "${tmp_keys_dir}" --user "${SALT_USER}" > /dev/null 2>&1 + salt-key --gen-keys "${service}" --gen-keys-dir "${tmp_keys_dir}" --user "${SALT_USER}" >/dev/null 2>&1 mv "${tmp_keys_dir}"/"${service}".{pem,pub} "${keys_dir}/" rm -rf "${tmp_keys_dir}" fi @@ -274,7 +254,7 @@ function setup_keys_for_service() if [[ -n "${key_pair_file}" ]]; then # If a key is provided via key_pair_file, check whether it is the same as the one in the keys directory if ! cmp -s "${key_pair_file}.pem" "${keys_dir}/${service}.pem" || - ! cmp -s "${key_pair_file}.pub" "${keys_dir}/${service}.pub"; then + ! cmp -s "${key_pair_file}.pub" "${keys_dir}/${service}.pub"; then log_error " ${key_file_env_var} is set to '${key_pair_file}' but keys don't match the ${service} keys inside '${keys_dir}'." return 1 fi @@ -282,13 +262,11 @@ function setup_keys_for_service() fi } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: _setup_master_sign_keys # DESCRIPTION: Setup salt-master sign keys. #---------------------------------------------------------------------------------------------------------------------- -function _setup_master_sign_keys() -{ +function _setup_master_sign_keys() { log_info " ==> Setting up master_sign keys ..." if [[ -n "${SALT_MASTER_SIGN_KEY_FILE}" ]]; then @@ -304,13 +282,13 @@ function _setup_master_sign_keys() _symlink_key_pair_files "${SALT_MASTER_SIGN_KEY_FILE}" "${target_key_pair}" else log_info " Generating signed keys ..." - gen_signed_keys "${SALT_KEYS_DIR}" > /dev/null + gen_signed_keys "${SALT_KEYS_DIR}" >/dev/null fi else if [[ -n "${SALT_MASTER_SIGN_KEY_FILE}" ]]; then # If a master_sign key-pair is provided via SALT_MASTER_SIGN_KEY_FILE, check it is the same as the one in the keys directory if ! cmp -s "${SALT_MASTER_SIGN_KEY_FILE}.pem" "${SALT_KEYS_DIR}/${SALT_MASTER_SIGN_KEY_NAME}.pem" || - ! cmp -s "${SALT_MASTER_SIGN_KEY_FILE}.pub" "${SALT_KEYS_DIR}/${SALT_MASTER_SIGN_KEY_NAME}.pub"; then + ! cmp -s "${SALT_MASTER_SIGN_KEY_FILE}.pub" "${SALT_KEYS_DIR}/${SALT_MASTER_SIGN_KEY_NAME}.pub"; then log_error " SALT_MASTER_SIGN_KEY_FILE is set to '${SALT_MASTER_SIGN_KEY_FILE}' but keys don't match the master_sign keys inside '${SALT_KEYS_DIR}'." return 1 fi @@ -336,7 +314,6 @@ function _setup_master_sign_keys() fi } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: _check_and_link_gpgkey # DESCRIPTION: Check and link a gpgkey if env variable is set. @@ -367,13 +344,11 @@ function _check_and_link_gpgkey() { ln -sfn "${SOURCE_GPGKEY}" "${TARGET_GPGKEY}" } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: _setup_gpgkeys # DESCRIPTION: Setup GPG keys. #---------------------------------------------------------------------------------------------------------------------- -function _setup_gpgkeys() -{ +function _setup_gpgkeys() { log_info " ==> Setting up GPG keys ..." local private_key="${SALT_KEYS_GPGKEYS_DIR}/private.key" @@ -409,24 +384,26 @@ function _setup_gpgkeys() log_info " Setting trust level to ultimate ..." local key_id="$(exec_as_salt gpg "${GPG_COMMON_OPTS[@]}" --list-packets "${private_key}" | awk '/keyid:/{ print $2 }' | head -1)" - (echo trust & echo 5 & echo y & echo quit) | exec_as_salt gpg "${GPG_COMMON_OPTS[@]}" --command-fd 0 --edit-key "${key_id}" + ( + echo trust & + echo 5 & + echo y & + echo quit + ) | exec_as_salt gpg "${GPG_COMMON_OPTS[@]}" --command-fd 0 --edit-key "${key_id}" } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: setup_salt_keys # DESCRIPTION: Repair keys permissions and creates keys if needed. #---------------------------------------------------------------------------------------------------------------------- -function setup_salt_keys() -{ +function setup_salt_keys() { log_info "Setting up salt keys ..." setup_keys_for_service master SALT_MASTER_KEY_FILE "${SALT_KEYS_DIR}" [[ "${SALT_MASTER_SIGN_PUBKEY}" == True ]] && _setup_master_sign_keys _setup_gpgkeys log_info "Setting up salt keys permissions ..." - while IFS= read -r -d '' pub_key - do + while IFS= read -r -d '' pub_key; do if [[ "${pub_key}" =~ .*\.pem$ ]]; then chmod 400 "${pub_key}" else @@ -438,13 +415,11 @@ function setup_salt_keys() find "${SALT_HOME}" -path "${SALT_KEYS_DIR}/*" -print0 | xargs -0 chown -h "${SALT_USER}": } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: configure_salt_master # DESCRIPTION: Configure master service. #---------------------------------------------------------------------------------------------------------------------- -function configure_salt_master() -{ +function configure_salt_master() { log_info "Configuring salt-master service ..." # https://docs.saltstack.com/en/latest/ref/configuration/master.html @@ -471,13 +446,11 @@ function configure_salt_master() SALT_MASTER_USE_PUBKEY_SIGNATURE } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: configure_salt_api # DESCRIPTION: Configure salt-api if service is set to be enabled. #---------------------------------------------------------------------------------------------------------------------- -function configure_salt_api() -{ +function configure_salt_api() { rm -f /etc/supervisor/conf.d/salt-api.conf if [[ -n "${SALT_API_SERVICE_ENABLED}" ]]; then @@ -524,7 +497,7 @@ function configure_salt_api() salt-call --local tls.create_self_signed_cert cacert_path="${CERTS_PATH}" CN="${SALT_API_CERT_CN}" chown "${SALT_USER}": "${CERTS_PATH}/tls/certs/${SALT_API_CERT_CN}".{crt,key} - cat >> "${SALT_ROOT_DIR}/master" <>"${SALT_ROOT_DIR}/master" < /etc/supervisor/conf.d/salt-api.conf </etc/supervisor/conf.d/salt-api.conf < Configuring supervisord to start salt-minion ..." - cat > /etc/supervisor/conf.d/salt-minion.conf </etc/supervisor/conf.d/salt-minion.conf < "${tmp_file}" + } >"${tmp_file}" sed -i "/${begin_delim}/,/${end_delim}/!b;//!d;/${begin_delim}/r ${tmp_file}" "${SALT_ROOT_DIR}/master" rm "${tmp_file}" } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: initialize_datadir # DESCRIPTION: Initialize main directories. #---------------------------------------------------------------------------------------------------------------------- -function initialize_datadir() -{ +function initialize_datadir() { log_info "Configuring directories ..." # This symlink simplifies paths for loading sls files @@ -719,13 +685,11 @@ function initialize_datadir() chown -R "${SALT_USER}": "${SALT_LOGS_DIR}/salt" } - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: configure_logrotate # DESCRIPTION: Configure logrotate. #---------------------------------------------------------------------------------------------------------------------- -function configure_logrotate() -{ +function configure_logrotate() { log_info "Configuring logrotate ..." local LOGROTATE_CONFIG_DIR='/etc/logrotate.d/salt' local LOGROTATE_CONFIG_FILE="${LOGROTATE_CONFIG_DIR}/salt-common.logrotate" @@ -734,7 +698,7 @@ function configure_logrotate() mkdir -p "${LOGROTATE_CONFIG_DIR}" # configure supervisord log rotation - cat > /etc/logrotate.d/supervisord </etc/logrotate.d/supervisord < "${LOGROTATE_CONFIG_FILE}" <"${LOGROTATE_CONFIG_FILE}" < /etc/supervisor/conf.d/config-reloader.conf </etc/supervisor/conf.d/config-reloader.conf <