Took a "little" detour... *sigh* So far well over 90% of the time I'm not fighting with SaltStack but in fact with FreeBSD and iocage. I found out that there were two newer iocage versions out after the one that I used and decided to give the newest one a try. A port for that was only released a day ago and so I had to build from ports as a package is not yet even in :latest.
The good thing about the new version: It fixes the problem with the "hanging" process that I experienced before. The bad news: This version depends on the system having a UTF-8 locale activated. I tried hard to force FreeBSD to provide LC_ALL=en_US.UTF-8 in the environment but it wouldn't let me. A lot of people seem to set this via loader.conf, but I cannot get this to work. After hours of
wasted time valuable learning experience, I gave up on that one for now and resort to issuing
setenv LC_ALL en_US.UTF-8 before doing the salt run. Iocage now requires Python 3.6 instead of 2.7 which lead to all that Unicode fun. But hey, it solved the other problem, so that's probably worth it.
([rant]I
really hope that they will make UTF-8 the default for 12... Non-UTF-8 locales suck big time anyway and this is way overdue!
[/rant])
Another thing that I simply do not understand is: When I edit /etc/rc.conf of one jail, adding a line to it and then turn that jail into a template, I would expect any new jail built from that template to come with that change. Unfortunately... this is not what happens. I can edit rc.conf to my liking and when I cat out the file, everything is fine, the additional line is there. Any new jails build from the template however get a fresh rc.conf! I have no idea what the heck is happening here. This is completely stupid behavior and I'm clueless as to how that can even be.
Progress (if you will): The state file can now be applied in one run again without having to CTRL-Z and kill the hanging process only to start another run. Also the system is now configured for UTF-8.
Code: Select all
#########################
# UTF-8 configuration #
#########################
set_login.conf_UTF-8:
file.blockreplace:
- name: /etc/login.conf
- marker_start: ':datasize=unlimited:\'
- marker_end: ':stacksize=unlimited:\'
- content: |
:charset=UTF-8:\
:setenv=LC_ALL=en_US.UTF-8,LC_COLLATE=en_US.UTF-8,LC_CTYPE=en_US.UTF-8,LC_MESSAGES=en_US.UTF-8,LC_MONETARY=en_US.UTF-8,LC_NUMERIC=en_US.UTF-8,LC_TIME=en_US.UTF-8:\
:lang=en_US.UTF-8:\
cap_mkdb:
cmd.run:
- name: 'cap_mkdb /etc/login.conf'
- onchanges:
- file: set_login.conf_UTF-8
set_env_lang:
environ.setenv:
- name: LANG
- value: en_US.UTF-8
- update_minion: True
set_env_lc-all:
environ.setenv:
- name: LC_ALL
- value: en_US.UTF-8
- update_minion: True
#########
# NAT #
#########
create_lo1_if:
file.append:
- name: /etc/rc.conf
- text:
- cloned_interfaces="lo1"
- ifconfig_lo1="inet 10.0.0.254 netmask 255.255.255.0"
cmd.run:
- name: ifconfig lo1 create
- unless: ifconfig -l | grep lo1
basic_pf_nat_rules:
file.managed:
- name: /etc/pf.conf
- contents: |
ext_if="vtnet0"
int_if="lo1"
localnet=$int_if:network
scrub in all fragment reassemble
set skip on lo0
set skip on lo1
#nat for jails
nat on $ext_if inet from $localnet to any -> ($ext_if)
load_pf_ko:
cmd.run:
- name: kldload pf.ko
- unless: 'service pf status | grep -v "pf.ko is not loaded"'
activate_pf:
file.append:
- name: /etc/rc.conf
- text:
- pf_enable="YES"
- pflog_enable="YES"
cmd.run:
- name: pfctl -e -f /etc/pf.conf
- unless: 'service pf status | grep "Status: Enabled for"'
########################
# iocage preparation #
########################
prepare_latest_repo:
file.directory:
- name: /usr/local/etc/pkg/repos
- makedirs: True
activate_latest_repo:
file.managed:
- name: /usr/local/etc/pkg/repos/FreeBSD.conf
- contents: |
FreeBSD: {
url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest"
}
install_iocage_package:
pkg.installed:
- name: py36-iocage
jail_fetch_fbsd11:
cmd.run:
- name: 'iocage fetch --release 11.0-RELEASE'
- creates: /iocage/releases/11.0-RELEASE
##########################
# salt minion template #
##########################
saltminion_create_jail:
cmd.run:
- name: iocage create tag=saltminion ip4_addr="lo1|10.0.0.1/24" -r 11.0-RELEASE
- unless: test `iocage list | grep saltminion | wc -l` -gt 0 -o `iocage list -t | grep saltminion | wc -l` -gt 0 && true || false
saltminion_ensure_running:
cmd.run:
- name: iocage start saltminion
- unless: test `iocage list | grep saltminion | grep up | wc -l` -gt 0 -o `iocage list -t | grep saltminion | wc -l` -gt 0 && true
saltminion_ensure_pkg:
cmd.run:
- name: iocage pkg saltminion "install pkg"
- env:
- ASSUME_ALWAYS_YES: 'yes'
- unless: test -e /iocage/jails/`iocage get host_hostuuid saltminion`/root/usr/local/sbin/pkg -o `iocage list -t | grep saltminion | wc -l` -gt 0 && true
saltminion_ensure_salt_installed:
cmd.run:
- name: iocage pkg saltminion install py27-salt
- env:
- ASSUME_ALWAYS_YES: 'yes'
- unless: test -d /iocage/jails/`iocage get host_hostuuid saltminion`/root/usr/local/etc/salt -o `iocage list -t | grep saltminion | wc -l` -gt 0 && true
saltminion_ensure_stopped:
cmd.run:
- name: iocage stop saltminion
- unless: test `iocage list | grep saltminion | grep down | wc -l` -gt 0 -o `iocage list -t | grep saltminion | wc -l` -gt 0 && true
saltminion_converted_template:
cmd.run:
- name: iocage set template=yes saltminion
- unless: iocage list -t | grep saltminion
I decided to build the saltmaster next instead of the gitjail an I probably have to do all configuration there if I don't find a way to make iocage copy important configuration files over...
And even though I know that PF is not nearly as horrible, thanks to netfilter/iptables I still hate firewalling enough to have stayed away from it so far. 