Support 'relenv' option in roster file

[Querela]

I wanted to ask if you can add support to specify the relenv (--relenv) flag per host in the roster file for salt-ssh? Suggested code changes to support this are in the comment below.

I manage multiple server, some with legacy python (3.8) which fail due to newer language features being used:

TypeError: 'type' object is not subscriptable

full error stacktrace

Traceback (most recent call last):
  File "/var/tmp/.user_31e1f6_salt/salt-call", line 27, in <module>
    salt_call()
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/scripts.py", line 436, in salt_call
    import salt.cli.call
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/cli/call.py", line 3, in <module>
    import salt.cli.caller
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/cli/caller.py", line 12, in <module>
    import salt.channel.client
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/channel/client.py", line 12, in <module>
    import tornado.gen
  File "/var/tmp/.user_31e1f6_salt/py3/tornado/gen.py", line 444, in <module>
    ) -> Future[List]: ...
TypeError: 'type' object is not subscriptable
[ERROR   ] An un-handled exception was caught by Salt's global exception handler:
TypeError: 'type' object is not subscriptable
Traceback (most recent call last):
  File "/var/tmp/.user_31e1f6_salt/salt-call", line 27, in <module>
    salt_call()
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/scripts.py", line 436, in salt_call
    import salt.cli.call
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/cli/call.py", line 3, in <module>
    import salt.cli.caller
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/cli/caller.py", line 12, in <module>
    import salt.channel.client
  File "/var/tmp/.user_31e1f6_salt/pyall/salt/channel/client.py", line 12, in <module>
    import tornado.gen
  File "/var/tmp/.user_31e1f6_salt/py3/tornado/gen.py", line 444, in <module>
    ) -> Future[List]: ...
TypeError: 'type' object is not subscriptable

I know that I can specify relenv: True in the Saltfile or provide --relenv via CLI for salt-ssh calls. However, this means that if I select servers via wildcard expressions, either some fail or all need to download the relenv (onedir, Python+Salt distribution) which is not really necessary for most of the servers. A size comparison also shows the client difference:

23M     .user_31e1f6_salt
238M    .user_31e1f6_salt_relenv

With ssh_wipe: False it will at least cache the client but it feels a bit unnecessary to have 200MB overhead for most servers when it is only required for a few ones. Due to reasons, some of the servers can't be updated for now.

So calls like: salt-ssh 'server*' test.ping do not work for servers with legacy Python, requiring --relenv flag or the relenv: True setting. Using raw commands salt-ssh 'server*' -r 'uname -v' is no problem since it doesn't seem to require the Python client.

Follow-up question: Or is there a ways that I can install the salt-minion in a kind of master-less way, so that salt-ssh will pick use this instead of the thin/relenv client? I found it convenient to keep it disconnected, so multiple salt-ssh masters (different admins) can manage the servers but the minions do not need to be aware of them. I'm unsure whether trying to install the salt-minion will even work on the legacy system (Ubuntu 20.04.6 LTS). So if that is an alternative.
My salt-master is using 3008.0rc2.

I'm currently evaluating Salt for our use-cases but checks and mitigations for recent vulnerabilities like CopyFail/DirtyFrag seem to be easier to handle with some Salt automation compared to manually SSH-ing into each server.

[Querela]

I also tried to look into the minion_opts of the roster file but it was not clear whether relenv can be specified in any of the nested fields. A code search on Github showed me the default options etc. but without anything related to relenv. But I'm unsure if I overlooked something.

[Querela]

After extending my setup I also noticed that I get multiple warning entries for each server when using relenv: True (does not seem to change with ssh_wipe option). So for each server there will be 1 warning about Detected and cached OS/arch and 1+ Reusing cached OS/arch when using any salt-ssh '*' state.apply ... or ... -r ... calls. (Another reason why I would like to only use relenv for where it necessary.)

[WARNING ] RELENV: Detected and cached OS/arch: linux/x86_64
[WARNING ] RELENV: Reusing cached OS/arch: linux/x86_64
[WARNING ] RELENV: Reusing cached OS/arch: linux/x86_64

[Querela]

Changes to support this functionality seem to be minor:

diff --git a/salt/client/ssh/__init__.py b/salt/client/ssh/__init__.py
index 1a2f41c..0154c05 100644
--- a/salt/client/ssh/__init__.py
+++ b/salt/client/ssh/__init__.py
@@ -1128,6 +1128,7 @@ class Single:
         mods=None,
         fsclient=None,
         thin=None,
+        relenv=False,                                     # it is also possible to use the kwargs instead of clearly defining available options here
         mine=False,
         minion_opts=None,
         identities_only=False,
@@ -1153,6 +1154,8 @@ class Single:
             self.wipe = False
         else:
             self.wipe = bool(self.opts.get("ssh_wipe"))
+        if relenv:                                        # or kwargs.get("relenv", False) if no explicit "relenv" parameter is defined above
+            self.opts["relenv"] = True                    # overriding this here is the same as using `--relenv` CLI etc.
         if kwargs.get("thin_dir"):
             self.thin_dir = kwargs["thin_dir"]
         elif self.winrm:

If you include the schema stuff (I'm not really sure where this even is used outside of tests?)

diff --git a/salt/config/schemas/ssh.py b/salt/config/schemas/ssh.py
index 2123768..a51b3d8 100644
--- a/salt/config/schemas/ssh.py
+++ b/salt/config/schemas/ssh.py
@@ -85,6 +85,14 @@ class RosterEntryConfig(Schema):
             "components. Defaults to /tmp/salt-<hash>."
         ),
     )
+    relenv = BooleanItem(
+        title="Relenv",
+        description=(
+            "Deploy and use a relenv (Salt+Python bundled) environment on the "
+            "SSH target."
+        ),
+        default=False,
+    )
     minion_opts = DictItem(
         title="Minion Options",
         description="Dictionary of minion options",
diff --git a/tests/pytests/unit/config/schemas/test_ssh.py b/tests/pytests/unit/config/schemas/test_ssh.py
index 602b693..3c0cae8 100644
--- a/tests/pytests/unit/config/schemas/test_ssh.py
+++ b/tests/pytests/unit/config/schemas/test_ssh.py
@@ -98,6 +98,12 @@ def test_config():
                 ),
                 "title": "Thin Directory",
             },
+            "relenv": {
+                "default": False,
+                "type": "boolean",
+                "description": "Deploy and use a relenv (Salt+Python bundled) environment on the SSH target.",
+                "title": "Relenv",
+            },
             # The actuall representation of the minion options would make this HUGE!
             "minion_opts": ssh_schemas.DictItem(
                 title="Minion Options",
@@ -117,6 +123,7 @@ def test_config():
             "sudo",
             "timeout",
             "thin_dir",
+            "relenv",
             "minion_opts",
         ],
         "additionalProperties": False,

This then allows the following roster configs:

# Sample salt-ssh config file
web1:
  host: 192.168.42.1 # The IP addr or DNS hostname
  user: fred         # Remote executions will be executed as user fred
  passwd: foobarbaz  # The password to use for login, if omitted, keys are used
  sudo: True         # Whether to sudo to root, not enabled by default
  relenv: True       # **NEW** same as --relenv CLI option or `relenv: True` setting in Saltfile

This seemed to work on my installation (salt-ssh 3008.0rc2 (Argon)) with patching the local files (e.g., /opt/saltstack/salt/lib/python3.13/site-packages/salt/client/ssh/__init__.py).
Remarks: Following the CONTRIBUTING notes to start a PR seems a bit complicated. Setting up pyenv with Python 3.9.18 will quickly fail tests due to psutil. I had to switch to my system Python 3.12.10 which fails various nox tests. And installing base+pytest+(tornado) dependencies directly and running pytest still throws a few errors (all in a fresh git clone)... So if someone can simply add the few changes above, I would be happy. Otherwise I can at least try to start a PR but my whole dev setup is too wonky for now.

[dwoz]

I think this could be considered a bug in the new relenv feature.