Salt enforces configuration from /etc/network/interfaces.d/* to /etc/network/interface

[pjediny]

System: Ubuntu 16.04, saltstack 2016.3, but is present in current development branch see debian_ip.py#L1574

Salt reads configuration from /etc/network/interfaces and /etc/network/interfaces.d/* files and when writing configuration to the /etc/network/interfaces it includes interfaces in /etc/network/interfaces.d/* in the file.

This is dangerous behavior, as the files in interfaces.d directory are manually managed, can contain unknown options to the salt module and it can result in deconfigured interfaces in /etc/network/interface overriding any configuration in /etc/network/interfaces.d/*

[gtmanfred]

Thanks for reporting this.

@garethgreenaway when you get a minute if you could take a look at this concern?

Also @MTecknology I know you have been messing around in debian_ip?

Thanks!
Daniel

Thanks,
Daniel

[MTecknology]

I recall, when I was working through the template output issues, this concern popped into my head. The situation I was working with had all of the networking configuration in the same file and it fell off the table.

I can think of a few reasons why someone would want most networking configuration in one file and have a handful of states that manage another networking config file through {file,network}.managed. The workaround confuses me, but the problem doesn't. I definitely agree that this can be dangerous (and potentially destructive).

Thought Dump

• In states/network.managed:

  • Provide useful doc (Deb opts from modules/debian_ip @ 56-131,426-532 ..give or take)
  • Include a filename argument
  • It needs to pass the arg to ip.get_interface()
  • and ip.get_bond()? .. I'm not following that further
  • More?..

• In modules/debian_ip:

  • _parse_interfaces() already supports passing a list of file names
  • _parse_interfaces() SHOULD try to get all interfaces
  • _write_file_ifaces() needs to accept the file arg read/write from that file (default /etc/net/if)
  • _write_file_ifaces() needs to pass the arg as a list to _parse_interfaces()

Yikes... that blows up in complexity pretty quickly when you start looking at it. It still seems doable, though. We just need to (by default) only care about /etc/network/interfaces and read no other interface files. If a separate filename is passed, then care only about that filename. When something wants to get all interfaces, that /should/ parse all files.

I haven't even had time to test a feature I already wrote (auto batch) so it's incredibly unlikely I'll be able to take a swing at this in the next ~6 months (or so...).

[MTecknology]

This could be a naive approach, but would it be acceptable to just add some documentation?

Such as...

On Debian-based systems, networking configuration can be specified
in `/etc/network/interfaces` or via included files such as (by default)
`/etc/network/interfaces.d/*`. This can be problematic for configuration
management. It is recommended to use either `file.managed` *or*
`network.managed`.

If using `network.managed`, it can be useful to ensure `interfaces.d/`
is empty. This can be done using:

/etc/network/interfaces.d:
      file.directory:
        - clean: True

Every programatic option I come up requires assumptions and adds a lot of complicated logic. Updating documentation seems like the next best option.