SaltStack isolation in virtualenv on Cloudbreak instances

[#1]

Introduction

Cloudbreak uses SaltStack to manage nodes of the cluster, install packages, change configuration files and execute recipes.

Motivation

Cloudbreak gives the opportunity to the users to manage their virtual machines. When user SSH into a machine and updates/installs packages using system package manager, SaltStack can fail with version incompatibility issues. This scenario led us to create a solution which ensures SaltStack’s correct behavior independently of the user actions with system package manager.

SaltStack in virtualenv

Since version 2.8, Cloudbreak provides official images to every cloud provider which contains Saltstack in a separated virtual environment. This prevents the mentioned version incompatibility. The virtual machines created by the official images creates a separated environment for SaltStack and installs it using the Python package manager of that environment.

Virtualenv

Virtualenv is widely used tool which can used to create different Python environments. When you create an environment, virtualenv copies the system Python binaries and libraries and adds additions binaries. You can define different Python version also.

You have to activate the environment to using the Python of the created environment.

source /path/to/environment/bin/activate

With activation, virtualenv adds the binary directory of your environment to the PATH system variable.

After your work is finished, you have to deactivate the environment.

deactivate

Using Saltstack

SaltStack can be used on virtual machines like in the previous versions, the only difference is that you need to activate the environment to execute any Salt commands.

Without activation you will get an error message like “salt command is not found”.

You need to switch to root user to activate the environment and execute salt commands in the same session.

Official images from Cloudbreak team defines a binary which can used to activate the environment without knowledge about the location the environment.

source activate_salt_env

Without this binary, usually you can find the directory under /opt/salt_{salt_version} and you can activate it using this directory:

source /opt/salt_{salt_version}/bin/activate

After activation you are able to execute Salt commands:

salt '*' test.ping

After you finished your work with SaltStack, you have to deactivate the environment. It is an important step because as long as your environment is active you’re using the Python of the activated environment in the current session. Forgetting to deactivate an environment can lead to Python issues in current session.

deactivate

SaltStack version

You can check the SaltStack version using Python package manager of the separated environment.

After activation you can list the packages:

pip list

If you want to upgrade SaltStack you can also use Python package manager of the separated environment.

pip install salt=={desired_salt_version} --upgrade

Please be aware during upgrade of SaltStack, version of SaltStack (and it’s dependencies like ZeroMQ) have to match on every instance of a cluster.

Also be aware to modify the directory of the environment, because every Salt related system service relies on that directory and have to be modified in case of directory change.