allow using proxy minion from cli by gtmanfred · Pull Request #48344 · saltstack/salt

gtmanfred · 2018-06-27T20:05:06Z

What does this PR do?

This allows using proxy minions from the minion box, for troubleshooting, and also not needing a master.

[root@salt salt]# tail -c +0 /etc/salt/proxy /srv/pillar/*
==> /etc/salt/proxy <==
master: localhost

==> /srv/pillar/proxy.sls <==
proxy:
  proxytype: docker
  name: {{grains.id}}

==> /srv/pillar/top.sls <==
base:
  '*':
    - proxy
[root@salt salt]# salt-call --local grains.get virtual_subtype
local:
[root@salt salt]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES
f0b4c86881cb        centos              "/usr/lib/systemd/sy…"   3 hours ago         Up 3 hours                              quirky_edison
[root@salt salt]# salt-call --local grains.get virtual_subtype --proxyid quirky_edison
local:
    Docker

Tests written?

Not Yet

Commits signed with GPG?

Yes

gtmanfred · 2018-06-27T20:05:24Z

@mirceaulinic you will be interested in this.

isbm

@gtmanfred great work! And tests?.. 😉

isbm · 2018-06-28T09:12:39Z

salt/cli/caller.py

+            allow_missing_funcs = any([
+                self.minion.executors['{0}.allow_missing_func'.format(executor)](function_name)
+                for executor in executors
+                if '{0}.allow_missing_func' in self.minion.executors


Nitpick: I would still put this into one line with for loop, as it looks a bit odd, sort of wrong syntax. 😉

Yeah, most of this still needs to be cleaned up, a lot of it is copied from elsewhere, and just needs to be made into functions in salt.utils, so they can be used in both places.

isbm · 2018-06-28T09:19:03Z

salt/minion.py

+
+        if 'proxy' not in self.opts['pillar'] and 'proxy' not in self.opts:
+            errmsg = 'No proxy key found in pillar or opts for id ' + self.opts['id'] + '. ' + \
+                     'Check your pillar/opts configuration and contents.  Salt-proxy aborted.'


Ermm... why not:

errmsg = 'No proxy key found in pillar or opts for id {id}. ' \ 'Check your pillar/options configuration and contents. ' \ 'Salt-proxy aborted.'.format(id=self.opts['id'])

But this is about formatting. The message itself is cryptic and misleading. Users, who has no idea of the Salt internals and programming will start thinking about AES keys. Please rephrase it for them.

isbm · 2018-06-28T09:24:05Z

salt/minion.py

+                     'Check your pillar/opts configuration and contents.  Salt-proxy aborted.'
+            log.error(errmsg)
+            self._running = False
+            raise SaltSystemExit(code=-1, msg=errmsg)


What is -1? We have our own exit codes and we should stick to that, reusing constants.

import salt.defaults.exitcodes raise SaltSystemExit(salt.defaults.exitcodes.EX_GENERIC, msg=errmsg)

Or add to exit codes new constant and reuse it above, e.g.:

EX_PROXY_RELOAD = 200 # All proxy-related errors can be 200-255, for example

isbm · 2018-06-28T10:12:57Z

salt/minion.py

+            raise SaltSystemExit(code=-1, msg=errmsg)
+
+        if 'proxy' not in self.opts:
+            self.opts['proxy'] = self.opts['pillar']['proxy']


Hmm, this check if... will make __opts__ more important than pillars, which isn't right thing. Meaning, you cannot push proxy data to the running minion without it being restarted.

@terminalmage we wanted to change that also in config getter, right?

The proxy block into the Pillar is mandatory for the Proxy Minion to start (i.e., it won't be able to start without). With this in mind, the Proxy Minion startup is different than the regular Minion, as the data is compiled twice: once to be able to get it up and running, then to make it available and re-compiled after the Grains are collected. It's a very complex process, as the Grains require the Proxy to be up (which needs the Pillar data in order to know where to connect to), and some other Pillars may require Grains. So please bear in mind that this is a different story.

isbm · 2018-06-28T10:19:29Z

salt/minion.py

+            self.opts = salt.utils.dictupdate.merge(self.opts,
+                                                    self.opts['pillar'],
+                                                    strategy=self.opts.get('proxy_merge_pillar_in_opts_strategy'),
+                                                    merge_lists=self.opts.get('proxy_deep_merge_pillar_in_opts', False))


I actually never understand why static, firm, rigid, rarely changed opts are over dynamic, volatile, flexible, often changed pillars. It just makes no sense. Imagine you could just push temporarily to your minion's config, do something and return back to the default state. But here now you have it totally stuck, unless you reconfigure it and restart it.

I would propose here to do the other way around: always merge pillars over opts. And add a special opt (again, you can deliver it over pillars and even control that remotely!!!) that would disable that.

But this is probably a subject to discuss...

isbm · 2018-06-28T10:43:49Z

salt/minion.py

+            if not HAS_PSUTIL:
+                log.error('Unable to enforce modules_max_memory because psutil is missing')
+            if not HAS_RESOURCE:
+                log.error('Unable to enforce modules_max_memory because resource is missing')


Can we rephrase these messages to be user-compatible? ".....psutil Python package dependency is not installed". Same to "resource".

Yeah, this isn't going to survive the cleanup, because it is a one off process, and this stuff is not needed.

isbm · 2018-06-28T10:45:58Z

salt/client/__init__.py

+        }
+        data.update(kwargs)
+        executors = getattr(self.sminion, 'module_executors', []) or \
+                    opts.get('module_executors', ['direct_call'])


It also can be cleaner here as well:

executors = getattr(self.sminion, 'module_executors', opts.get('module_executors', ['direct_call']))

UPDATE:
Ah, I wasn't correct. This won't work (as the other place too) if there is module_executors attribute to the sminion, but is empty. However, your version will also omit module_executors from opts, if there are any in both cases.

So just pointing this out, the rest is up to you. 😉

So, there are certain instances when module_executors is specified on the proxy minion, and that is the module_executor that needs to be used. If that is not specified, then the user is free to specify their own module_executors.

So this is in the correct order.

That's clear, but if module_executor is specified in both places, then the opts are discarded. Shouldn't we have to merge that instead (simply + instead of or)?

isbm · 2018-06-28T10:47:09Z

salt/client/__init__.py

+        if mopts:
+            self.opts = mopts
+        else:
+            self.opts = salt.config.proxy_config(c_path)


You use this idiom already, so why not here too:

self.opts = mopts or salt.config.proxy_config(c_path)

isbm · 2018-06-28T10:48:22Z

salt/cli/caller.py

+            }
+            data.update(kwargs)
+            executors = getattr(self.minion, 'module_executors', []) or \
+                        self.opts.get('module_executors', ['direct_call'])


See this comment.

Same as #48344 (comment)

isbm · 2018-06-28T10:49:23Z

salt/client/__init__.py

+        allow_missing_funcs = any([
+            self.sminion.executors['{0}.allow_missing_func'.format(executor)](function_name)
+            for executor in executors
+            if '{0}.allow_missing_func' in self.sminion.executors


Maybe one line.

This actually shouldn't be needed at all, just a result of copying everything over.

gtmanfred · 2018-06-28T18:53:43Z

       ================================================================================
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       Starting Proxy Tests
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       test_can_it_ping (integration.proxy.test_shell.ProxyCallerSimpleTestCase)
       [CPU:73.5%|MEM:73.7%]  ...  ok
       test_grains_items (integration.proxy.test_shell.ProxyCallerSimpleTestCase)
       [CPU:46.3%|MEM:73.5%]  ...  ok
       test_list_pkgs (integration.proxy.test_shell.ProxyCallerSimpleTestCase)
       [CPU:27.1%|MEM:74.7%]  ...  ok
       test_service_get_all (integration.proxy.test_shell.ProxyCallerSimpleTestCase)
       [CPU:33.2%|MEM:76.5%]  ...  ok
       test_service_list (integration.proxy.test_shell.ProxyCallerSimpleTestCase)
       [CPU:31.5%|MEM:76.7%]  ...  ok
       test_service_start (integration.proxy.test_shell.ProxyCallerSimpleTestCase)
       [CPU:51.9%|MEM:78.9%]  ...  ok
       test_upgrade (integration.proxy.test_shell.ProxyCallerSimpleTestCase)
       [CPU:38.4%|MEM:80.2%]  ...  ok
       test_can_it_ping (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:27.3%|MEM:80.4%]  ... ok
       test_grains_items (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:19.8%|MEM:80.4%]  ... ok
       test_install_pkgs (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:16.2%|MEM:80.4%]  ... ok
       test_list_pkgs (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:26.6%|MEM:80.5%]  ... ok
       test_remove_pkgs (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:25.6%|MEM:80.5%]  ... ok
       test_service_get_all (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:25.9%|MEM:80.5%]  ... ok
       test_service_list (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:16.7%|MEM:80.5%]  ... ok
       test_service_start (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:16.7%|MEM:80.5%]  ... ok
       test_service_stop (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:20.8%|MEM:80.5%]  ... ok
       test_state_apply (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:17.1%|MEM:80.5%]  ... ok
       test_state_highstate (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:20.1%|MEM:80.5%]  ... ok
       test_upgrade (integration.proxy.test_simple.ProxyMinionSimpleTestCase)
       [CPU:25.9%|MEM:80.5%]  ... ok

       ----------------------------------------------------------------------
       Ran 19 tests in 120.612s

       OK

       ============================  Overall Tests Report  ============================
       ***  No Problems Found While Running Tests  ************************************
       ================================================================================
       OK (total=19, skipped=0, passed=19, failures=0, errors=0)
       ============================  Overall Tests Report  ============================

This is the output of the added tests when running proxy tests.

isbm

Great cleanup! I still have few little nitpicks, if you don't mind.

isbm · 2018-06-29T08:27:01Z

salt/cli/caller.py

        # nasty sys.exit() and tick off our developer users
        try:
-            self.minion = salt.minion.SMinion(opts)
+            if self.opts.get('proxyid', None) is not None:


Let's hope nothing can set proxyid as 0 or "".

isbm · 2018-06-29T08:30:57Z

salt/client/__init__.py

+        executors = getattr(self.sminion, 'module_executors', []) or \
+                    opts.get('module_executors', ['direct_call'])
+        if isinstance(executors, six.string_types):
+            executors = [executors]


Well, that's an interesting question. Shouldn't we just disallow wrong syntax in config and also make sure that executors are always a list? The variable name suggests it though. Personally I am not very much into favour of auto-fixing shoddy configs, because it will also grow problems like "oh, I was writing config also in that way and it worked before, but now not, fixitpls!".

I'd propose to actually crash here and politely ask to write a proper config. 😉

This is here because it is easier to pass in --module-executors direct_call, then to have to pass it as a list on the commandline.

Also, this is the same format it is for the salt command.

Hmm, but you actually can pass a list in command line (comma-separated or so). That's why I would propose to always convert it to the list at the very beginning, even if it is just one element there. Otherwise we will have this kinda spaghetti everywhere.

isbm · 2018-06-29T08:32:43Z

salt/utils/platform.py

        # to support the testsuite's temp script that is called 'cli_salt_proxy'
-        if 'proxy' in main.__file__:
+        #
+        # (gtmanfred) Add '--proxyid' in sys.argv so that salt-call --proxyid


But Git blame says who wrote this comment, no need to extra-add it. 😉

isbm · 2018-06-29T08:33:09Z

tests/integration/proxy/test_shell.py

@@ -0,0 +1,65 @@
+# -*- coding: utf-8 -*-
+'''
+    :codeauthor: Thayne Harbaugh (tharbaug@adobe.com)


The test_proxy.py copypaste leftovers. 😉

rallytime

This is neat!

I have a couple of small requests.

rallytime · 2018-07-03T15:20:54Z

doc/ref/clients/index.rst

    :members: cmd

+Salt Proxy Caller
+-----------


The dashed line needs to match the length of the line above, or we'll get an RST warning.

rallytime · 2018-07-03T15:25:35Z

salt/minion.py

+class SProxyMinion(SMinion):
+    '''
+    Create an object that has loaded all of the minion module functions,
+    grains, modules, returners etc.  The SMinion allows developers to


Copy/Paste error? SMinion --> SProxyMinion?

rallytime · 2018-07-03T15:25:49Z

salt/minion.py

+
+        .. code-block:: bash
+
+            salt '*' sys.reload_modules


gen_modules here instead of reload_modules?

Nah, reload_modules is correct, let me fix the code so that gen_modules overwrites reload_modules like it does in the regular salt-call

mirceaulinic

That's awesome! Thanks @gtmanfred!

cachedout

Request for additional documentation before we merge this.

cachedout · 2018-07-18T23:34:36Z

salt/utils/parsers.py

+
+    def _mixin_setup(self):
+        self.add_option(
+            '--module-executors',


IMHO we need more documentation than this about what's happening here. I'm certain that I couldn't figure out what this does from the perspective of the average Salt user.

This is already documented for the salt command, it would be the same thing.

https://docs.saltstack.com/en/latest/ref/executors/index.html

I can add an example with salt-call --module-executors in here?

Looking for feedback on my response.

That's fine. We can rethink this down the road because it's a larger problem than just this particular flag.

Pull saltstack#48344 added logic to salt-call which runs the desired function using all of the executors, or just the direct_call one if none are configured. However, the previous code which ran the function was not removed, which results in the function being run twice. This removes the (now) redundant function call.

gtmanfred added the needs-testcase PR needs test cases written, or the issue is about a bug/feature that needs test cases label Jun 27, 2018

gtmanfred requested a review from a team as a code owner June 27, 2018 20:05

ghost self-requested a review June 27, 2018 20:05

gtmanfred force-pushed the proxycaller branch from 9168fdb to 981cab6 Compare June 27, 2018 20:06

gtmanfred requested a review from cro June 27, 2018 20:23

allow using proxy minion from cli

5dfcf7c

gtmanfred force-pushed the proxycaller branch from 981cab6 to 5dfcf7c Compare June 27, 2018 20:49

isbm suggested changes Jun 28, 2018

View reviewed changes

gtmanfred added 5 commits June 28, 2018 10:33

add integration tests for proxycall

19e68dd

move proxy call shell test into proxy tests

181cc16

clean up ProxyCaller and remove unnecessary loader calls

f137b1f

remove unused allow_missing_funcs

aebc9f7

clean up errmsg and add retcode

9a3d3f3

gtmanfred removed the needs-testcase PR needs test cases written, or the issue is about a bug/feature that needs test cases label Jun 28, 2018

add more tests

a21aacb

gtmanfred force-pushed the proxycaller branch from ed0fa86 to 9925bd7 Compare June 28, 2018 18:37

add notes to the docs

068cc84

gtmanfred force-pushed the proxycaller branch from 9925bd7 to 068cc84 Compare June 28, 2018 18:38

isbm suggested changes Jun 29, 2018

View reviewed changes

gtmanfred added 2 commits June 29, 2018 13:58

clean up

450767d

fix pylint

f4df69b

rallytime suggested changes Jul 3, 2018

View reviewed changes

rallytime requested a review from mirceaulinic July 3, 2018 15:29

isbm approved these changes Jul 3, 2018

View reviewed changes

hopefully the last few changes.

8df59d6

rallytime approved these changes Jul 3, 2018

View reviewed changes

cro approved these changes Jul 3, 2018

View reviewed changes

gtmanfred changed the title ~~[WIP] allow using proxy minion from cli~~ allow using proxy minion from cli Jul 3, 2018

rallytime requested a review from cachedout July 3, 2018 17:38

mirceaulinic approved these changes Jul 11, 2018

View reviewed changes

Merge branch 'develop' into proxycaller

b0a2963

cachedout suggested changes Jul 18, 2018

View reviewed changes

rallytime requested a review from cachedout July 27, 2018 13:46

Merge branch 'develop' into proxycaller

c936aaa

cachedout approved these changes Jul 27, 2018

View reviewed changes

Merge branch 'develop' into proxycaller

ed3d85b

rallytime added the Fluorine label Jul 31, 2018

rallytime merged commit 60bbdee into saltstack:develop Aug 1, 2018

gtmanfred deleted the proxycaller branch August 1, 2018 18:40

terminalmage mentioned this pull request Sep 6, 2018

Remove redundant execution in salt-call #49552

Merged

max-arnold mentioned this pull request Dec 24, 2018

[Fluorine] Unify salt-call/salt executor arguments #50974

Merged

Conversation

gtmanfred commented Jun 27, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Tests written?

Commits signed with GPG?

Uh oh!

gtmanfred commented Jun 27, 2018

Uh oh!

isbm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mirceaulinic Jun 28, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

isbm Jun 28, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

isbm Jun 28, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gtmanfred commented Jun 28, 2018

Uh oh!

isbm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rallytime left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gtmanfred commented Jun 27, 2018 •

edited

Loading

mirceaulinic Jun 28, 2018 •

edited

Loading

isbm Jun 28, 2018 •

edited

Loading

isbm Jun 28, 2018 •

edited

Loading

gtmanfred Jul 18, 2018 •

edited

Loading