sos/sos/report/plugins/saltmaster.py at 472c221b28a8c3e5eb841429776f71fc233fdd8c · TrevorBenson/sos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# This file is part of the sos project: https://github.com/sosreport/sos
#
# This copyrighted material is made available to anyone wishing to use,
# modify, copy, or redistribute it subject to the terms and conditions of
# version 2 of the GNU General Public License.
#
# See the LICENSE file in the source distribution for further information.
import glob
import yaml

from sos.report.plugins import Plugin, IndependentPlugin


class SaltMaster(Plugin, IndependentPlugin):

    short_desc = 'Salt Master'

    plugin_name = 'saltmaster'
    profiles = ('sysmgmt',)

    packages = ('salt-master', 'salt-api',)

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.collected_pillar_roots = []

    def setup(self):
        if self.get_option("all_logs"):
            self.add_copy_spec("/var/log/salt")
        else:
            self.add_copy_spec("/var/log/salt/master")

        self.add_copy_spec("/etc/salt")
        self.add_forbidden_path("/etc/salt/pki/*/*.pem")

        self.add_pillar_roots()
        self.add_cmd_output([
            "salt-master --version",
            "systemctl --full status salt-master",
            "systemctl --full status salt-api",
            "salt-key --list all",
            "salt-run jobs.list_jobs --out=yaml",
            "salt-run manage.list_state --out=yaml",
            "salt-run manage.list_not_state --out=yaml",
            "salt-run manage.joined --out=yaml",
        ], timeout=30)

    def add_pillar_roots(self):
        """ Collect pilliar_roots of all salt configs """
        cfgs = glob.glob("/etc/salt/master.d/*conf")
        main_cfg = "/etc/salt/master"

        if self.path_exists(main_cfg):
            cfgs.append(main_cfg)

        all_pillar_roots = []
        for cfg in cfgs:
            with open(cfg, "r", encoding='UTF-8') as file:
                try:
                    cfg_pillar_roots = (
                        yaml.safe_load(file).get("pillar_roots", {}).
                        get("base", [])
                    )
                except AttributeError:
                    cfg_pillar_roots = []
                all_pillar_roots.extend(cfg_pillar_roots)

        self.collected_pillar_roots = all_pillar_roots
        self.add_copy_spec(all_pillar_roots)

    def postproc(self):
        regexp = (
            r'(^\s*.*(pass|secret|(?<![A-z])key(?![A-z])|'
            r'api_?key|encryption_?key).*:\ ).+'
        )
        subst = r'\1******'

        self.do_path_regex_sub("/etc/salt/*", regexp, subst)

        for pillar_root in self.collected_pillar_roots:
            normalized_root = pillar_root if pillar_root.endswith('/') else (
                f"{pillar_root}/"
            )
            self.do_path_regex_sub(f"{normalized_root}*", regexp, subst)

# vim: set et ts=4 sw=4 :