saltstack cheatsheet summary (key && compound matcher)

Salt key management

Listing all Salt key registration requests1.salt-key -LAccepting all Salt key requests:1.salt-key -AAccepting a single Salt key request, where minion_id is the name of the Minion:1.salt-key -a minion_idRemoving the key of a Salt Minion, where minion_id is the name of the Minion:1.salt-key -d minion_idRemoving all the key of Salt minions1.salt-key -D

Query Salt in order to find out what Minions are online, offline or maybe even show both

salt-run manage.up # Shows what Minions are upsalt-run manage.down # Shows what Minions are down or not connectedsalt-run manage.status # Shows both online and offline Minions

Matching the minion id
1.Globbing

Match all minions:salt '*' test.pingMatch all minions in the example.net domain or any of the example domains:salt '*.example.net' test.pingsalt '*.example.*' test.pingMatch all the webN minions in the example.net domain (web1.example.net, web2.example.net … webN.example.net):salt 'web?.example.net' test.pingMatch the web1 through web5 minions:salt 'web[1-5]' test.pingMatch the web1 and web3 minions:salt 'web[1,3]' test.pingMatch the web-x, web-y, and web-z minions:salt 'web-[x-z]' test.ping

2.Regular expressions

Match both web1-prod and web1-devel minions:salt -E 'web1-(prod|devel)' test.pingusing regular expressions in a State's top filebase:  'web1-(prod|devel)':  - match: pcre  - webserver

3.Lists

salt -L 'web1,web2,web3' test.ping

Compound matchers

LetterMatch TypeExampleGGrains globG@os:UbuntuEPCRE Minion IDE@web\d+\.(dev|qa|prod)\.locPGrains PCREP@os:(RedHat|Fedora|CentOS)LList of [e-mail],minion3.domain.comor bl*.domain.comIPillar globI@pdata:foobarSSubnet/IP addressS@192.168.1.0/24 orS@192.168.1.100RRange clusterR@%foo.bar

Matchers can be joined using boolean and,or, and not operators.

eg:

salt -C 'webserv* and G@os:Debian or E@web-dc1-srv.*' test.pingThat same example expressed in a top file looks like the following:base:  'webserv* and G@os:Debian or E@web-dc1-srv.*':    - match: compound    - webserverNote that a leading not is not supported in compound matchessalt -C '* and not G@kernel:Darwin' test.pingExcluding a minion based on its ID is also possible:salt -C '* and not web-dc1-srv' test.pingMatches can be grouped together with parentheses to explicitly declare precedence amongst groups.salt -C '( ms-1 or G@id:ms-3 ) and G@id:ms-3' test.ping

example:

salt '*' sys.docsalt -E '.*' cmd.run 'ls -l | grep foo'salt -L foo.bar.baz,quo.qux cmd.run 'ps aux | grep foo'salt '*' grains.itemssalt -G 'os:Fedora' test.pingsalt '*' pillar.itemssalt 'supply.*' network.ip_addrssalt '*' saltutil.refresh_pillarsalt '*' pillar.item mine_functionssalt '*' mine.get '*' grains.itemssalt -C 'G@circle:live and G@data_volume_attached:True'salt '*' state.sls sfym.appsalt -C 'E@^((?!frontline).)*$' cmd.run 'dpkg --purge nginx'salt -C 'E@^((?!frontline).)*$' cmd.run 'rm -rf /etc/nginx/'salt '*' state.highstate test=Tr