Re: [qubes-users] saltstack: user specific pillars in qubes

Mailing Lists qubes-users
1

Have you enabled the pillar in /srv/salt/user_pillar/top.sls?

Example:

In /srv/salt/user_pillar/top.sls I have a stanza:
user:
  'target':
    - get

In /srv/salt/user_pillar/get.sls, I set the pillar:
host: www.qubes-os.org

Then I have the state and top files, get.sls and get.top:
get file:
  cmd.run:
    - name: wget {{pillar['host'] }}

base:
  target:
    - get

qubesctl --skip-dom0 --targets=target state.apply get

2

Have you enabled the pillar in /srv/salt/user_pillar/top.sls?

Example:

In /srv/salt/user_pillar/top.sls I have a stanza:
user:
   'target':
     - get

In /srv/salt/user_pillar/get.sls, I set the pillar:
host: www.qubes-os.org

Then I have the state and top files, get.sls and get.top:
get file:
   cmd.run:
     - name: wget {{pillar['host'] }}

base:
   target:
     - get

qubesctl --skip-dom0 --targets=target state.apply get

First of all I'd like to thank you for your answer unman.

I've tried your example (and after modifying it to be able to run it) I get exact the same error as before.

Here's the setup:

Have you enabled the pillar in /srv/salt/user_pillar/top.sls?

As far as I know, I have only to enable state.top files. But I have a file like you suggest located in /srv/salt/user_pillar/:

In /srv/salt/user_pillar/top.sls I have a stanza:
user:
   'target':
     - get

Ok!

In /srv/salt/user_pillar/get.sls, I set the pillar:
host: www.qubes-os.org

Ok!

/srv/salt/user_salt/get.sls
get file:
   cmd.run:
     - name: wget {{pillar['host'] }}

Ok!

/srv/salt/user_salt/get.top
base:
   target:
     - user_salt.get

This one I had to modify as the get.sls is located in "/srv/salt/user_salt/". Above is already the modified version (user_salt is prefixed). I also enabled this top file by executing:
sudo qubesctl top.enable user_salt.get

Now, let's run this:

qubesctl --skip-dom0 --targets=target state.apply get

When I'm executing this, I get the error logged in /var/log/qubes/mgmt-target.log:
calling 'state.apply'...
2020-09-13 10:08:14,729 output: target:
2020-09-13 10:08:14,730 output: - Rendering SLS 'base:user_salt.get' failed: Jinja variable 'salt.utils.context.NamespacedDictWrapper object' has no attribute 'host'

When I'm executing this (additional parameter --pillar-root=/srv/salt/user_pillar/):
sudo qubesctl --skip-dom0 --targets=target state.apply --pillar-root=/srv/salt/user_pillar/

The result is the same as I described before:
target: ERROR (exception list index out of range)

I also tried to modify the pillar top file to meet the different location:

In /srv/salt/user_pillar/top.sls I have a stanza:
user:
   'target':
     - user_pillar.get

But this haven't changed the results.

Any further suggestions to investigate are highly appreciated.

Best. P.

3

OK, it might have been better if you had NOT modified my example, as you
should then have been able to verify that user pillars can be referenced
in this way.
I always find it better to take one small step at a time when
troubleshooting or trying to learn something new.

In the new case, you are using the user environment. I would try the
following:
/srv/salt/user_salt/get.top
user:
   target:
     - get

/srv/salt/user_salt/get.sls
get file:
   cmd.run:
     - name: wget {{pillar['host'] }}

qubesctl --skip-dom0 --targets=target state.apply saltenv=user get

You might like to look at:
https://docs.saltstack.com/en/latest/ref/states/top.html#environments

New environments can be defined in
`/etc/salt/minions.d/f_defaults.conf`, but I rarely do this in Qubes.

4

OK, it might have been better if you had NOT modified my example, as you
should then have been able to verify that user pillars can be referenced
in this way.
I always find it better to take one small step at a time when
troubleshooting or trying to learn something new.

In the new case, you are using the user environment. I would try the
following:
/srv/salt/user_salt/get.top
user:
    target:
      - get

/srv/salt/user_salt/get.sls
get file:
    cmd.run:
      - name: wget {{pillar['host'] }}

qubesctl --skip-dom0 --targets=target state.apply saltenv=user get

You might like to look at:
The Top File

New environments can be defined in
`/etc/salt/minions.d/f_defaults.conf`, but I rarely do this in Qubes.

unman, as always you pointed me into the right direction. The whole reason it was not working as I missed up with the directories.

Instead of using:
/srv/user_salt

I was using:
/srv/salt/user_salt

That's why your first example didn't work in my environment and I had to adjust it.

Now everything is running perfectly with user defined pillars!

Thank you very much!

5

I also got this running, thanks!

However when I run

qubesctl --all --show-output state.highstate saltenv=user

I get for my states:
State 'qvm.present' was not found in SLS 'mysls'
Reason: 'qvm.present' is not available.

I guess the custom qvm.* states are not available in the /srv/user_salt folder, but only in /srv/salt?

Is there any way to make them available in /srv/user_salt as well?

Side Note: I ran `qubesctl --show-output state.sls qubes.user-dirs` to obtain the folders.

6

P.S.: I also noticed that right after I did
sudo qubesctl --all --show-output state.highstate saltenv=user
I get

sudo qubesctl top.enabled
[CRITICAL] Specified ext_pillar interface qvm_prefs is unavailable
'top.enabled' is not available.
DOM0 configuration failed, not continuing

(It did work right before.) It doesn't change after a reboot, only reinstalling the salt packages helps.
I guess that's not normal?

7

For reference I got it running with symlinks this way:

#!/bin/bash