Skip to content

Commit 523a2d2

Browse files
author
nb
committed
feat(TOFS): ssh sshd configs known_host and banner
1 parent 14966e9 commit 523a2d2

File tree

11 files changed

+172
-13
lines changed

11 files changed

+172
-13
lines changed

‎openssh/banner.sls‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,21 @@
1-
{% from "openssh/map.jinja" import openssh with context %}
1+
{% set tplroot = tpldir.split('/')[0] %}
2+
{% from tplroot ~ "/map.jinja" import openssh with context %}
3+
{% from tplroot ~ "/libtofs.jinja" import files_switch %}
24
35
include:
46
- openssh
57
68
sshd_banner:
79
file.managed:
810
- name: {{ openssh.banner }}
9-
{% if openssh.banner_string is defined %}
11+
{% if openssh.banner_string is defined %}
1012
- contents: {{ openssh.banner_string | yaml }}
11-
{% else %}
12-
- source: {{ openssh.banner_src }}
13+
{% else %}
14+
# Preserve backward compatibility
15+
- source: {{ openssh.banner_src
16+
if '://' in openssh.banner_src
17+
else files_switch( [openssh.banner_src],
18+
'sshd_banner_file_managed'
19+
) }}
1320
- template: jinja
14-
{% endif %}
21+
{% endif %}

‎openssh/config.sls‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1-
{% from "openssh/map.jinja" import openssh, ssh_config, sshd_config with context %}
1+
{% set tplroot = tpldir.split('/')[0] %}
2+
{% from tplroot ~ "/map.jinja" import openssh, ssh_config, sshd_config with context %}
3+
{% from tplroot ~ "/libtofs.jinja" import files_switch %}
4+
25
36
include:
47
- openssh
@@ -7,7 +10,12 @@ include:
710
sshd_config:
811
file.managed:
912
- name: {{ openssh.sshd_config }}
10-
- source: {{ openssh.sshd_config_src }}
13+
# Preserve backward compatibility
14+
- source: {{ openssh.sshd_config_src
15+
if '://' in openssh.sshd_config_src
16+
else files_switch( [openssh.sshd_config_src],
17+
'sshd_config_file_managed'
18+
) }}
1119
- template: jinja
1220
- user: {{ openssh.sshd_config_user }}
1321
- group: {{ openssh.sshd_config_group }}
@@ -24,7 +32,12 @@ sshd_config:
2432
ssh_config:
2533
file.managed:
2634
- name: {{ openssh.ssh_config }}
27-
- source: {{ openssh.ssh_config_src }}
35+
# Preserve backward compatibility
36+
- source: {{ openssh.ssh_config_src
37+
if '://' in openssh.ssh_config_src
38+
else files_switch( [openssh.ssh_config_src],
39+
'ssh_config_file_managed'
40+
) }}
2841
- template: jinja
2942
- user: {{ openssh.ssh_config_user }}
3043
- group: {{ openssh.ssh_config_group }}

‎openssh/defaults.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,19 @@ default:
33
sshd_enable: True
44
sshd_binary: /usr/sbin/sshd
55
sshd_config: /etc/ssh/sshd_config
6-
sshd_config_src: salt://openssh/files/sshd_config
6+
sshd_config_src: sshd_config # Default TOFS source filename
77
sshd_config_user: root
88
sshd_config_group: root
99
sshd_config_mode: '644'
1010
sshd_config_backup: True
1111
ssh_config: /etc/ssh/ssh_config
12-
ssh_config_src: salt://openssh/files/ssh_config
12+
ssh_config_src: ssh_config # Default TOFS source filename
1313
ssh_config_user: root
1414
ssh_config_group: root
1515
ssh_config_mode: '644'
1616
ssh_config_backup: True
1717
banner: /etc/ssh/banner
18-
banner_src: salt://openssh/files/banner
18+
banner_src: banner # Default TOFS source filename
1919
ssh_known_hosts: /etc/ssh/ssh_known_hosts
2020
dig_pkg: dnsutils
2121
ssh_moduli: /etc/ssh/moduli

‎openssh/files/banner‎ renamed to ‎openssh/files/default/banner‎

File renamed without changes.

‎openssh/files/fire_banner‎ renamed to ‎openssh/files/default/fire_banner‎

File renamed without changes.

‎openssh/files/ssh_config‎ renamed to ‎openssh/files/default/ssh_config‎

File renamed without changes.

‎openssh/files/ssh_known_hosts‎ renamed to ‎openssh/files/default/ssh_known_hosts‎

File renamed without changes.

‎openssh/files/sshd_config‎ renamed to ‎openssh/files/default/sshd_config‎

File renamed without changes.

‎openssh/known_hosts.sls‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
{% from "openssh/map.jinja" import openssh with context %}
1+
{% set tplroot = tpldir.split('/')[0] %}
2+
{% from tplroot ~ "/map.jinja" import openssh with context %}
3+
{% from tplroot ~ "/libtofs.jinja" import files_switch %}
24
35
ensure dig is available:
46
pkg.installed:
@@ -8,7 +10,9 @@ ensure dig is available:
810
manage ssh_known_hosts file:
911
file.managed:
1012
- name: {{ openssh.ssh_known_hosts }}
11-
- source: salt://openssh/files/ssh_known_hosts
13+
- source: {{ files_switch( ['ssh_known_hosts'],
14+
'ssh_known_hosts_file_managed'
15+
) }}
1216
- template: jinja
1317
- user: root
1418
- group: {{ openssh.ssh_config_group }}

‎openssh/libtofs.jinja‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
{%- macro files_switch(source_files,
2+
lookup=None,
3+
default_files_switch=['id', 'os_family'],
4+
indent_width=6,
5+
v1_path_prefix='') %}
6+
{#-
7+
Returns a valid value for the "source" parameter of a "file.managed"
8+
state function. This makes easier the usage of the Template Override and
9+
Files Switch (TOFS) pattern.
10+
11+
Params:
12+
* source_files: ordered list of files to look for
13+
* lookup: key under '<tplroot>:tofs:source_files' to override
14+
list of source files
15+
* default_files_switch: if there's no config (e.g. pillar)
16+
'<tplroot>:tofs:files_switch' this is the ordered list of grains to
17+
use as selector switch of the directories under
18+
"<path_prefix>/files"
19+
* indent_witdh: indentation of the result value to conform to YAML
20+
* v1_path_prefix: (deprecated) only used for injecting a path prefix into
21+
the source, to support older TOFS configs
22+
23+
Example (based on a `tplroot` of `xxx`):
24+
25+
If we have a state:
26+
27+
Deploy configuration:
28+
file.managed:
29+
- name: /etc/yyy/zzz.conf
30+
- source: {{ files_switch(['/etc/yyy/zzz.conf', '/etc/yyy/zzz.conf.jinja'],
31+
lookup='Deploy configuration'
32+
) }}
33+
- template: jinja
34+
35+
In a minion with id=theminion and os_family=RedHat, it's going to be
36+
rendered as:
37+
38+
Deploy configuration:
39+
file.managed:
40+
- name: /etc/yyy/zzz.conf
41+
- source:
42+
- salt://xxx/files/theminion/etc/yyy/zzz.conf
43+
- salt://xxx/files/theminion/etc/yyy/zzz.conf.jinja
44+
- salt://xxx/files/RedHat/etc/yyy/zzz.conf
45+
- salt://xxx/files/RedHat/etc/yyy/zzz.conf.jinja
46+
- salt://xxx/files/default/etc/yyy/zzz.conf
47+
- salt://xxx/files/default/etc/yyy/zzz.conf.jinja
48+
- template: jinja
49+
#}
50+
{#- Get the `tplroot` from `tpldir` #}
51+
{%- set tplroot = tpldir.split('/')[0] %}
52+
{%- set path_prefix = salt['config.get'](tplroot ~ ':tofs:path_prefix', tplroot) %}
53+
{%- set files_dir = salt['config.get'](tplroot ~ ':tofs:dirs:files', 'files') %}
54+
{%- set files_switch_list = salt['config.get'](
55+
tplroot ~ ':tofs:files_switch',
56+
default_files_switch
57+
) %}
58+
{#- Lookup source_files (v2), files (v1), or fallback to source_files parameter #}
59+
{%- set src_files = salt['config.get'](
60+
tplroot ~ ':tofs:source_files:' ~ lookup,
61+
salt['config.get'](
62+
tplroot ~ ':tofs:files:' ~ lookup,
63+
source_files
64+
)
65+
) %}
66+
{#- Only add to [''] when supporting older TOFS implementations #}
67+
{%- set path_prefix_exts = [''] %}
68+
{%- if v1_path_prefix != '' %}
69+
{%- do path_prefix_exts.append(v1_path_prefix) %}
70+
{%- endif %}
71+
{%- for path_prefix_ext in path_prefix_exts %}
72+
{%- set path_prefix_inc_ext = path_prefix ~ path_prefix_ext %}
73+
{#- For older TOFS implementation, use `files_switch` from the config #}
74+
{#- Use the default, new method otherwise #}
75+
{%- set fsl = salt['config.get'](
76+
tplroot ~ path_prefix_ext|replace('/', ':') ~ ':files_switch',
77+
files_switch_list
78+
) %}
79+
{#- Append an empty value to evaluate as `default` in the loop below #}
80+
{%- if '' not in fsl %}
81+
{%- do fsl.append('') %}
82+
{%- endif %}
83+
{%- for fs in fsl %}
84+
{%- for src_file in src_files %}
85+
{%- if fs %}
86+
{%- set fs_dir = salt['config.get'](fs, fs) %}
87+
{%- else %}
88+
{%- set fs_dir = salt['config.get'](tplroot ~ ':tofs:dirs:default', 'default') %}
89+
{%- endif %}
90+
{%- set url = [
91+
'- salt:/',
92+
path_prefix_inc_ext.strip('/'),
93+
files_dir.strip('/'),
94+
fs_dir.strip('/'),
95+
src_file.strip('/'),
96+
] | select | join('/') %}
97+
{{ url | indent(indent_width, true) }}
98+
{%- endfor %}
99+
{%- endfor %}
100+
{%- endfor %}
101+
{%- endmacro %}

0 commit comments

Comments
 (0)