diff --git a/dockerfiles/Dockerfile.focal b/dockerfiles/Dockerfile.focal index ecd41c7b..35227f95 100644 --- a/dockerfiles/Dockerfile.focal +++ b/dockerfiles/Dockerfile.focal @@ -47,9 +47,12 @@ EXPOSE 22 RUN /usr/sbin/sshd # Setup Salt Common +RUN mkdir -p /etc/apt/keyrings +RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2024.pgp https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public +RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch=$(dpkg --print-architecture)] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" > /etc/apt/sources.list.d/salt.list -RUN wget --quiet -O /usr/share/keyrings/salt-archive-keyring.gpg https://repo.saltproject.io/py3/ubuntu/20.04/$(dpkg --print-architecture)/3004/salt-archive-keyring.gpg -RUN echo "deb [signed-by=/usr/share/keyrings/salt-archive-keyring.gpg arch=$(dpkg --print-architecture)] https://repo.saltproject.io/py3/ubuntu/20.04/$(dpkg --print-architecture)/3004 focal main" > /etc/apt/sources.list.d/salt.list +# Pin to Salt 3006 LTS +RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001 RUN apt-get update -y && apt-get install -y --no-install-recommends salt-minion # Start Systemd (systemctl) diff --git a/dockerfiles/Dockerfile.jammy b/dockerfiles/Dockerfile.jammy index 303bb4ad..119f1474 100644 --- a/dockerfiles/Dockerfile.jammy +++ b/dockerfiles/Dockerfile.jammy @@ -47,8 +47,13 @@ EXPOSE 22 RUN /usr/sbin/sshd # Setup Salt Common -RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2023.gpg https://repo.saltproject.io/salt/py3/ubuntu/22.04/$(dpkg --print-architecture)/SALT-PROJECT-GPG-PUBKEY-2023.gpg -RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=$(dpkg --print-architecture)] https://repo.saltproject.io/salt/py3/ubuntu/22.04/$(dpkg --print-architecture)/3006 jammy main" > /etc/apt/sources.list.d/salt.list +RUN mkdir -p /etc/apt/keyrings +RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2024.pgp https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public +RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch=$(dpkg --print-architecture)] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" > /etc/apt/sources.list.d/salt.list + +# Pin to Salt 3006 LTS +RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001 + RUN apt-get update -y && apt-get install -y --no-install-recommends salt-minion # Start Systemd (systemctl) diff --git a/dockerfiles/Dockerfile.noble b/dockerfiles/Dockerfile.noble index 944a0d47..8700fb74 100644 --- a/dockerfiles/Dockerfile.noble +++ b/dockerfiles/Dockerfile.noble @@ -47,9 +47,13 @@ EXPOSE 22 RUN /usr/sbin/sshd # Setup Salt Common -RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring.gpg https://repo.saltproject.io/salt/py3/ubuntu/24.04/$(dpkg --print-architecture)/SALT-PROJECT-GPG-PUBKEY-2023.gpg -RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring.gpg arch=$(dpkg --print-architecture)] https://repo.saltproject.io/salt/py3/ubuntu/24.04/$(dpkg --print-architecture)/3007 noble main" > /etc/apt/sources.list.d/saltstack.list -RUN apt-get update -y && apt-get install -y --no-install-recommends salt-minion +RUN mkdir -p /etc/apt/keyrings +RUN wget --quiet -O /etc/apt/keyrings/salt-archive-keyring-2024.pgp https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public +RUN echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch=$(dpkg --print-architecture)] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" > /etc/apt/sources.list.d/salt.list + +# Pin to Salt 3006 LTS +RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001 + # Start Systemd (systemctl) CMD ["/lib/systemd/systemd"] diff --git a/docs/guides/migration-recipe.md b/docs/guides/migration-recipe.md index 7563ec90..7b0aedc5 100644 --- a/docs/guides/migration-recipe.md +++ b/docs/guides/migration-recipe.md @@ -99,9 +99,11 @@ index 68387c9..7a8ace1 100644 CODENAME=$(cat /etc/os-release | grep VERSION_CODENAME | cut -d '=' -f 2) echo "Adding the SaltStack repository key for $UBUNTU_VERSION $CODENAME ($ARCH)..." - sudo curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg https://repo.saltproject.io/salt/py3/ubuntu/$UBUNTU_VERSION/$ARCH/SALT-PROJECT-GPG-PUBKEY-2023.gpg + sudo curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2024.gpg https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public echo "Adding the SaltStack repository for $UBUNTU_VERSION $CODENAME ($ARCH)..." - echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=$ARCH] https://repo.saltproject.io/salt/py3/ubuntu/$UBUNTU_VERSION/$ARCH/latest $CODENAME main" | sudo tee /etc/apt/sources.list.d/salt.list + echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.gpg arch=$ARCH] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main" | sudo tee /etc/apt/sources.list.d/salt.list + echo "Pinning Salt to v3006.*" + RUN printf "Package: salt-*\nPin: version 3006.*\nPin-Priority: 1001\n" > /etc/apt/preferences.d/salt-pin-1001 ``` 3. Install and configure the salt-minion. On `$new-host`, run the command ```console diff --git a/salt/base/salt.sls b/salt/base/salt.sls index 046ad82e..5327f794 100644 --- a/salt/base/salt.sls +++ b/salt/base/salt.sls @@ -33,25 +33,27 @@ remove_old_salt_repo: file.absent: - name: /etc/apt/sources.list.d/saltstack.list +{% if grains["oscodename"] in ["focal", "jammy", "noble"] %} +salt-pin-config: + file.managed: + - name: /etc/apt/preferences.d/salt-pin-1001 + - contents: | + Package: salt-* + Pin: version 3006.* + Pin-Priority: 1001 + - user: root + - group: root + - mode: "0644" +{% endif %} + salt-repo: pkgrepo.managed: - - humanname: repo.saltstack.org - {% if grains["oscodename"] == "focal" %} - - name: deb https://archive.repo.saltproject.io/py3/ubuntu/20.04/{{ grains["osarch"] }}/archive/3004 focal main - - key_url: https://archive.repo.saltproject.io/py3/ubuntu/20.04/{{ grains["osarch"] }}/archive/3004/salt-archive-keyring.gpg - {% elif grains["oscodename"] == "jammy" %} - - name: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring.gpg arch={{ grains["osarch"] }}] https://repo.saltproject.io/salt/py3/ubuntu/22.04/{{ grains["osarch"] }}/3007 jammy main - - key_url: https://repo.saltproject.io/salt/py3/ubuntu/22.04/{{ grains["osarch"] }}/SALT-PROJECT-GPG-PUBKEY-2023.gpg - - aptkey: False - {% elif grains["oscodename"] == "noble" %} - - name: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring.gpg arch={{ grains["osarch"] }}] https://repo.saltproject.io/salt/py3/ubuntu/24.04/{{ grains["osarch"] }}/3007 noble main - - key_url: https://repo.saltproject.io/salt/py3/ubuntu/24.04/{{ grains["osarch"] }}/SALT-PROJECT-GPG-PUBKEY-2023.gpg + {% if grains["oscodename"] in ["focal", "jammy", "noble"] %} + - name: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2024.pgp arch={{ grains["osarch"] }}] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main + - key_url: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public - aptkey: False - {% else %} - - name: deb http://archive.repo.saltstack.com/py3/ubuntu/{{ grains["osrelease"] }}/{{ grains["osarch"] }}/2018.3 {{ grains["oscodename"] }} main - - key_url: https://archive.repo.saltstack.com/py3/ubuntu/18.04/amd64/2018.3/SALTSTACK-GPG-KEY.pub - {% endif %} - file: /etc/apt/sources.list.d/salt.list + {% endif %} {% endif %}