salt-stack - Salt 中处于单一状态的多个 file.line

Question

我想要一个 Salt 状态来管理我的 SSH 文件。这需要多个 file.line操作。我怎样才能做到这一点？

更新:请参阅问题底部以了解我当前的解决方法

我有的是这个:

Secure SSH:
  file:
   - name: /etc/ssh/sshd_config
   - line:
     - match: "^PasswordAuthentication "
     - content: "PasswordAuthentication no"
     - mode: ensure
   - line:
     - match: "^PubkeyAuthentication "
     - content: "PubkeyAuthentication yes"
     - mode: ensure
   - line:
     - match: "^Port "
     - content: "Port 8888"
     - mode: ensure
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

但这失败了

    Data failed to compile:
----------
    No function declared in state 'file' in SLS u'xyz'

其实我的第一次尝试是这样的:

Secure SSH:
  file.line:
    - name: /etc/ssh/sshd_config
    - match: "^PasswordAuthentication "
    - content: "PasswordAuthentication no"
    - mode: ensure
  file.line:
    - name: /etc/ssh/sshd_config
    - match: "^PubkeyAuthentication "
    - content: "PubkeyAuthentication yes"
    - mode: ensure
  file.line:
    - name: /etc/ssh/sshd_config
    - match: "^Port "
    - content: "Port 8888"
    - mode: ensure
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

但这失败了

    Data failed to compile:
----------
    Rendering SLS 'base:xyz' failed: Conflicting ID 'file.line'

我理解这个错误，因为每个状态函数都是一个字典键，但它看起来很干净。

Salt 文档在这方面非常无用，因为它没有说 任何事情关于什么时候刚好 也许您想将多个内容修改为一个文件，它方便地仅在其文档中提供了非常简单的示例。

更新:
我通过为每一行使用单独的状态来让它工作(我也将 file.line 更改为 file.replace 但这是另一个问题)。我认为这相当笨拙，而且每一步后服务不是都重新加载了吗？

Disallow SSH password authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PasswordAuthentication .*
    - repl: PasswordAuthentication no
    - append_if_not_found: True
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

Allow SSH public key authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PubkeyAuthentication .*
    - repl: PubkeyAuthentication yes
    - append_if_not_found: True
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

Set SSH port:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^Port .*
    - repl: Port 8888
    - append_if_not_found: True
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

Answer 1

将 file.replace 分离为多个状态是要走的路。

为了避免冗余，您也应该将 service.running 移动到它自己的状态。另外:当使用 watch(或 watch_in)时，你需要在 file: 之后指定你正在观看的状态的名称。部分。

结果将如下所示:

Disallow SSH password authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PasswordAuthentication .*
    - repl: PasswordAuthentication no
    - append_if_not_found: True
    - watch_in:
      - service: ssh_service

Allow SSH public key authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PubkeyAuthentication .*
    - repl: PubkeyAuthentication yes
    - append_if_not_found: True
    - watch_in:
      - service: ssh_service

Set SSH port:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^Port .*
    - repl: Port 8888
    - append_if_not_found: True
    - watch_in:
      - service: ssh_service

ssh_service:
  service.running:
    - name: sshd