CODEWITHSUNDEEP
salt-project
peterrus
peterrus

Reputation: 651

Mounting a git repository in Salt's gitfs without it being searched for state modules

I am trying to mount a repository with server config files (think nginx, mysql, etc) inside my salt fileserver in order to be able to distribute these files to my minions (Without having to do a checkout of the full repository on all my minions).

If I've understood correctly: All gitfs_remotes will be 'flattened' into one filesystem structure (I can confirm this when I run salt-run fileserver.file_list.

What worries me is that, as far as I know, this 'config file only' repository is now also being searched by Salt for state modules.

Is there some way to either:

I stand open to the possibility that this is a wrong approach entirely of course, my only requirement is that the server config files (again, nginx, mysql, etc) live in a separate repository, and that the entire high state (state modules, top file) lives in git.

master config:

    fileserver_backend:
      - gitfs
    gitfs_remotes:
      - [email protected]:MyOrg/salt-configs.git:
      - [email protected]:MyOrg/server-config-files.git:
        - mountpoint: config-files

Upvotes: 0

Views: 468

Answers (1)

rnickle
rnickle

Reputation: 41

Have you considered storing your configuration file in a pillar?

For example:

HostFiles:
  LinuxBasic: |
    192.168.1.1 server1
    192.168.1.2 server2

And then in your state file, when you want to render the hostfile:

LinuxBasicHostFile:
  file.managed:
    - name: /etc/hosts
    - contents_pillar: {{ HostFiles:LinuxBasic }}

You could also GPG that file if it was sensitive using the keys on your Salt master's server:

$ cat nginx.hostfile | sudo gpg --armor --batch --trust-model always --encrypt --homedir <salthomdir> -r <keyname>

Paste the output of that into your pillar:

HostFiles:
  LinuxBasic: |
    -----BEGIN PGP MESSAGE-----
    Xks383...a bunch of encrypted text...BjAs0
    -----END PGP MESSAGE-----

And inform your salt master that HostFiles contains GPG encrypted content in your master.conf, or better yet, in a local conf file in /etc/salt/master.d/decrypt.conf:

decrypt_pillar:
  - 'HostFiles': gpg

Upvotes: 1

Related Questions