Merge pull request #5262 from c-po/remote-salt

salt: T8973: remove feature

9 files changed, 3 insertions, 403 deletions

diff --git a/data/templates/salt-minion/minion.j2 b/data/templates/salt-minion/minion.j2
deleted file mode 100644
index a69438f0b..000000000
--- a/data/templates/salt-minion/minion.j2
+++ /dev/null
@@ -1,67 +0,0 @@
-### Autogenerated by service_salt-minion.py ###
-
-##### Primary configuration settings #####
-##########################################
-
-# The hash_type is the hash to use when discovering the hash of a file on
-# the master server. The default is sha256, but md5, sha1, sha224, sha384 and
-# sha512 are also supported.
-#
-# WARNING: While md5 and sha1 are also supported, do not use them due to the
-# high chance of possible collisions and thus security breach.
-#
-# Prior to changing this value, the master should be stopped and all Salt
-# caches should be cleared.
-hash_type: {{ hash }}
-
-#####         Logging settings       #####
-##########################################
-# The location of the minion log file
-# The minion log can be sent to a regular file, local path name, or network
-# location. Remote logging works best when configured to use rsyslogd(8) (e.g.:
-# ``file:///dev/log``), with rsyslogd(8) configured for network logging. The URI
-# format is: <file|udp|tcp>://<host|socketpath>:<port-if-required>/<log-facility>
-# log_file: file:///dev/log
-#
-log_file: /var/log/salt/minion
-
-# The level of messages to send to the console.
-# One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'.
-#
-# The following log levels are considered INSECURE and may log sensitive data:
-# ['garbage', 'trace', 'debug']
-#
-# Default: 'warning'
-log_level: warning
-
-# Set the location of the salt master server, if the master server cannot be
-# resolved, then the minion will fail to start.
-master:
-{% for host in master %}
-  - {{ host | bracketize_ipv6 }}
-{% endfor %}
-
-# The user to run salt
-user: minion
-
-# The directory to store the pki information in
-pki_dir: /config/salt/pki/minion
-
-# Explicitly declare the id for this minion to use, if left commented the id
-# will be the hostname as returned by the python call: socket.getfqdn()
-# Since salt uses detached ids it is possible to run multiple minions on the
-# same machine but with different ids, this can be useful for salt compute
-# clusters.
-id: {{ id }}
-
-# The number of minutes between mine updates.
-mine_interval: {{ interval }}
-
-{% if source_interface is vyos_defined %}
-# The name of the interface to use when establishing the connection to the Master.
-source_interface_name: {{ source_interface }}
-{% endif %}
-
-# Enables verification of the master-public-signature returned by the master
-# in auth-replies.
-verify_master_pubkey_sign: {{ 'True' if master_key is vyos_defined else 'False' }}
diff --git a/debian/control b/debian/control
index 7edd692f4..a8d41056e 100644
--- a/debian/control
+++ b/debian/control
@@ -241,9 +241,6 @@ Depends:
   openssh-server,
   sshguard,
 # End "service ssh"
-# For "service salt-minion"
-  salt-minion,
-# End "service salt-minion"
 # For "service snmp"
   snmp,
   snmpd,
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst
index 4ca20d8e3..a263b6b37 100644
--- a/debian/vyos-1x.postinst
+++ b/debian/vyos-1x.postinst
@@ -3,19 +3,6 @@
 # Turn off Debian default for %sudo
 sed -i -e '/^%sudo/d' /etc/sudoers || true
 
-# Add minion user for salt-minion
-if ! grep -q '^minion' /etc/passwd; then
-    adduser --quiet --firstuid 100 --system --disabled-login --ingroup vyattacfg \
-        --gecos "salt minion user" --shell /bin/vbash minion
-    adduser --quiet minion frrvty
-    adduser --quiet minion sudo
-    adduser --quiet minion adm
-    adduser --quiet minion dip
-    adduser --quiet minion disk
-    adduser --quiet minion users
-    adduser --quiet minion frr
-fi
-
 # OpenVPN should get its own user
 if ! grep -q '^openvpn' /etc/passwd; then
     adduser --quiet --firstuid 100 --system --group --shell /usr/sbin/nologin openvpn
diff --git a/interface-definitions/include/version/salt-version.xml.i b/interface-definitions/include/version/salt-version.xml.i
deleted file mode 100644
index fe4684050..000000000
--- a/interface-definitions/include/version/salt-version.xml.i
+++ /dev/null
@@ -1,3 +0,0 @@
-<!-- include start from include/version/salt-version.xml.i -->
-<syntaxVersion component='salt' version='1'></syntaxVersion>
-<!-- include end -->
diff --git a/interface-definitions/include/version/system-version.xml.i b/interface-definitions/include/version/system-version.xml.i
index f29226c03..58bba16a2 100644
--- a/interface-definitions/include/version/system-version.xml.i
+++ b/interface-definitions/include/version/system-version.xml.i
@@ -1,3 +1,3 @@
 <!-- include start from include/version/system-version.xml.i -->
-<syntaxVersion component='system' version='32'></syntaxVersion>
+<syntaxVersion component='system' version='33'></syntaxVersion>
 <!-- include end -->
diff --git a/interface-definitions/service_salt-minion.xml.in b/interface-definitions/service_salt-minion.xml.in
deleted file mode 100644
index eaa2899f4..000000000
--- a/interface-definitions/service_salt-minion.xml.in
+++ /dev/null
@@ -1,74 +0,0 @@
-<?xml version="1.0"?>
-<interfaceDefinition>
-  <node name="service">
-    <children>
-      <node name="salt-minion" owner="${vyos_conf_scripts_dir}/service_salt-minion.py">
-        <properties>
-          <help>Salt Minion</help>
-          <priority>500</priority>
-        </properties>
-        <children>
-          <leafNode name="hash">
-            <properties>
-              <help>Hash used when discovering file on master server (default: sha256)</help>
-              <completionHelp>
-                <list>md5 sha1 sha224 sha256 sha384 sha512</list>
-              </completionHelp>
-              <constraint>
-                <regex>(md5|sha1|sha224|sha256|sha384|sha512)</regex>
-              </constraint>
-            </properties>
-            <defaultValue>sha256</defaultValue>
-          </leafNode>
-          <leafNode name="master">
-            <properties>
-              <help>Hostname or IP address of the Salt master server</help>
-              <valueHelp>
-                <format>ipv4</format>
-                <description>Salt server IPv4 address</description>
-              </valueHelp>
-              <valueHelp>
-                <format>ipv6</format>
-                <description>Salt server IPv6 address</description>
-              </valueHelp>
-              <valueHelp>
-                <format>hostname</format>
-                <description>Salt server FQDN address</description>
-              </valueHelp>
-              <constraint>
-                <validator name="ip-address"/>
-                <validator name="fqdn"/>
-              </constraint>
-              <constraintErrorMessage>Invalid FQDN or IP address</constraintErrorMessage>
-              <multi/>
-            </properties>
-          </leafNode>
-          <leafNode name="id">
-            <properties>
-              <help>Explicitly declare ID for this minion to use (default: hostname)</help>
-            </properties>
-          </leafNode>
-          <leafNode name="interval">
-            <properties>
-              <help>Interval in minutes between updates (default: 60)</help>
-              <valueHelp>
-                <format>u32:1-1440</format>
-                <description>Update interval in minutes</description>
-              </valueHelp>
-              <constraint>
-                <validator name="numeric" argument="--range 1-1440"/>
-              </constraint>
-            </properties>
-            <defaultValue>60</defaultValue>
-          </leafNode>
-          <leafNode name="master-key">
-            <properties>
-              <help>URL with signature of master for auth reply verification</help>
-            </properties>
-          </leafNode>
-          #include <include/source-interface.xml.i>
-        </children>
-      </node>
-    </children>
-  </node>
-</interfaceDefinition>
diff --git a/smoketest/scripts/cli/test_service_salt-minion.py b/smoketest/scripts/cli/test_service_salt-minion.py
deleted file mode 100755
index 494e02aa5..000000000
--- a/smoketest/scripts/cli/test_service_salt-minion.py
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import unittest
-
-from socket import gethostname
-from base_vyostest_shim import VyOSUnitTestSHIM
-
-from vyos.utils.process import process_named_running
-from vyos.utils.file import read_file
-from vyos.utils.process import cmd
-
-SALT_CONF = '/etc/salt/minion'
-base_path = ['service', 'salt-minion']
-
-interface = 'dum4456'
-
-class TestServiceSALT(VyOSUnitTestSHIM.TestCase):
-    @classmethod
-    def setUpClass(cls):
-        super(TestServiceSALT, cls).setUpClass()
-
-        # ensure we can also run this test on a live system - so lets clean
-        # out the current configuration :)
-        cls.cli_delete(cls, base_path)
-
-        cls.cli_set(cls, ['interfaces', 'dummy', interface, 'address', '100.64.0.1/16'])
-
-    @classmethod
-    def tearDownClass(cls):
-        cls.cli_delete(cls, ['interfaces', 'dummy', interface])
-        super(TestServiceSALT, cls).tearDownClass()
-
-    def tearDown(self):
-        # Check for running process
-        self.assertTrue(process_named_running('python3.11', '/usr/bin/salt-minion'))
-
-        # delete testing SALT config
-        self.cli_delete(base_path)
-        self.cli_commit()
-
-        # For an unknown reason on QEMU systems (e.g. where smoketests are executed
-        # from the CI) salt-minion process is not killed by systemd. Apparently
-        # no issue on VMWare.
-        if cmd('systemd-detect-virt') != 'kvm':
-            self.assertFalse(process_named_running('python3.11', '/usr/bin/salt-minion'))
-        # always forward to base class
-        super().tearDown()
-
-    def test_default(self):
-        servers = ['192.0.2.1', '192.0.2.2']
-
-        for server in servers:
-            self.cli_set(base_path + ['master', server])
-
-        self.cli_commit()
-
-        # commiconf = read_file() Check configured port
-        conf = read_file(SALT_CONF)
-        self.assertIn(f'  - {server}', conf)
-
-        # defaults
-        hostname = gethostname()
-        self.assertIn(f'hash_type: sha256', conf)
-        self.assertIn(f'id: {hostname}', conf)
-        self.assertIn(f'mine_interval: 60', conf)
-
-    def test_options(self):
-        server = '192.0.2.3'
-        hash = 'sha1'
-        id = 'foo'
-        interval = '120'
-
-        self.cli_set(base_path + ['master', server])
-        self.cli_set(base_path + ['hash', hash])
-        self.cli_set(base_path + ['id', id])
-        self.cli_set(base_path + ['interval', interval])
-        self.cli_set(base_path + ['source-interface', interface])
-
-        self.cli_commit()
-
-        # commiconf = read_file() Check configured port
-        conf = read_file(SALT_CONF)
-        self.assertIn(f'- {server}', conf)
-
-        # defaults
-        self.assertIn(f'hash_type: {hash}', conf)
-        self.assertIn(f'id: {id}', conf)
-        self.assertIn(f'mine_interval: {interval}', conf)
-        self.assertIn(f'source_interface_name: {interface}', conf)
-
-if __name__ == '__main__':
-    unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on())
diff --git a/src/conf_mode/service_salt-minion.py b/src/conf_mode/service_salt-minion.py
deleted file mode 100755
index f035485d3..000000000
--- a/src/conf_mode/service_salt-minion.py
+++ /dev/null
@@ -1,120 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import os
-
-from socket import gethostname
-from sys import exit
-from urllib3 import PoolManager
-
-from vyos.base import Warning, DeprecationWarning
-from vyos.config import Config
-from vyos.configverify import verify_interface_exists
-from vyos.template import render
-from vyos.utils.process import call
-from vyos.utils.permission import chown
-from vyos import ConfigError
-
-from vyos import airbag
-airbag.enable()
-
-config_file = r'/etc/salt/minion'
-master_keyfile = r'/opt/vyatta/etc/config/salt/pki/minion/master_sign.pub'
-
-user='minion'
-group='vyattacfg'
-
-def get_config(config=None):
-    if config:
-        conf = config
-    else:
-        conf = Config()
-    base = ['service', 'salt-minion']
-
-    if not conf.exists(base):
-        return None
-
-    salt = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
-    # ID default is dynamic thus we can not use defaults()
-    if 'id' not in salt:
-        salt['id'] = gethostname()
-    # We have gathered the dict representation of the CLI, but there are default
-    # options which we need to update into the dictionary retrieved.
-    salt = conf.merge_defaults(salt, recursive=True)
-
-    if not conf.exists(base):
-        return None
-    else:
-        conf.set_level(base)
-
-    return salt
-
-def verify(salt):
-    if not salt:
-        return None
-
-    DeprecationWarning('Salt minion integration is deprecated and will be removed in future VyOS versions')
-
-    if 'hash' in salt and salt['hash'] == 'sha1':
-        Warning('Do not use sha1 hashing algorithm, upgrade to sha256 or later!')
-
-    if 'source_interface' in salt:
-        verify_interface_exists(salt, salt['source_interface'])
-
-    return None
-
-def generate(salt):
-    if not salt:
-        return None
-
-    render(config_file, 'salt-minion/minion.j2', salt, user=user, group=group)
-
-    if not os.path.exists(master_keyfile):
-        if 'master_key' in salt:
-            req = PoolManager().request('GET', salt['master_key'], preload_content=False)
-            with open(master_keyfile, 'wb') as f:
-                while True:
-                    data = req.read(1024)
-                    if not data:
-                        break
-                    f.write(data)
-
-            req.release_conn()
-            chown(master_keyfile, user, group)
-
-    return None
-
-def apply(salt):
-    service_name = 'salt-minion.service'
-    if not salt:
-        # Salt removed from running config
-        call(f'systemctl stop {service_name}')
-        if os.path.exists(config_file):
-            os.unlink(config_file)
-    else:
-        call(f'systemctl restart {service_name}')
-
-    return None
-
-if __name__ == '__main__':
-    try:
-        c = get_config()
-        verify(c)
-        generate(c)
-        apply(c)
-    except ConfigError as e:
-        print(e)
-        exit(1)
diff --git a/src/migration-scripts/salt/0-to-1 b/src/migration-scripts/system/32-to-33
index 05f6476ce..632be0dae 100644
--- a/src/migration-scripts/salt/0-to-1
+++ b/src/migration-scripts/system/32-to-33
@@ -1,4 +1,4 @@
-# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright (C) VyOS Inc.
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -13,26 +13,12 @@
 # You should have received a copy of the GNU Lesser General Public License
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
-# Delete log_file, log_level and user nodes
-# rename hash_type to hash
-# rename mine_interval to interval
-
 from vyos.configtree import ConfigTree
 
 base = ['service', 'salt-minion']
 
 def migrate(config: ConfigTree) -> None:
     if not config.exists(base):
-        # Nothing to do
         return
 
-    # delete nodes which are now populated with sane defaults
-    for node in ['log_file', 'log_level', 'user']:
-        if config.exists(base + [node]):
-            config.delete(base + [node])
-
-    if config.exists(base + ['hash_type']):
-        config.rename(base + ['hash_type'], 'hash')
-
-    if config.exists(base + ['mine_interval']):
-        config.rename(base + ['mine_interval'], 'interval')
+    config.delete(base)