Salt 3006.0 release notes¶

Remove and deprecate the orchestration key from salt.runner and salt.wheel return data. To get it back, set features.enable_deprecated_orchestration_flag master configuration option to True. The flag will be completely removed in Salt 3008 Argon. #59917

Removed distutils and replaced with setuptools, given distutils is deprecated and removed in Python 3.12 #60476

Removed runtests targets from noxfile.py #62239

Removed the PyObjC dependency.

This addresses problems with building a one dir build for macOS. It became problematic because depending on the macOS version, it pulls different dependencies, and we would either have to build a macos onedir for each macOS supported release, or ship a crippled onedir(because it would be tied to the macOS version where the onedir was built). Since it's currently not being used, it's removed. #62432

Removed SixRedirectImporter from Salt. Salt hasn't shipped six since Salt 3004. #63874

Add kwargs to handle extra parameters for http.query #36138

Fix mounted bind mounts getting active mount options added #39292

Fix sysctl.present converts spaces to tabs. #40054

Fixes state pkg.purged to purge removed packages on Debian family systems #42306

Fix fun_args missing from syndic returns #45823

Fix mount.mounted with 'mount: False' reports unmounted file system as unchanged when running with test=True #47201

Issue #49310: Allow users to touch a file with Unix date of birth #49310

Do not raise an exception in pkg.info_installed on nonzero return code #51620

Passes the value of the force parameter from file.copy to its call to file.remove so that files with the read-only attribute are handled. #51739

Fixed x509.certificate_managed creates new certificate every run in the new cryptography x509 module. Please migrate to the new cryptography x509 module for this improvement. #52167

Don't check for cached pillar errors on state.apply #52354, #57180, #59339

Swapping out args and kwargs for arg and kwarg respectively in the Slack engine when the command passed is a runner. #52400

Ensure when we're adding chunks to the rules when running aggregation with the iptables state module we use a copy of the chunk otherwise we end up with a recursive mess. #53353

When user_create or user_remove fail, return False instead of returning the error. #53377

Include sync_roster when sync_all is called. #53914

Avoid warning noise in lograte.get #53988

Fixed listing revoked keys with gpg.list_keys #54347

Fix mount.mounted does not handle blanks properly #54508

Fixed grain num_cpus get wrong CPUs count in case of inconsistent CPU numbering. #54682

Fix spelling error for python_shell argument in dpkg_lower module #54907

Cleaned up bytes response data before sending to non-bytes compatible returners (postgres, mysql) #55226

Fixed malformed state return when testing file.managed with unavailable source file #55269

Included stdout in error message for Zypper calls in zypperpkg module. #56016

Fixed pillar.filter_by with salt-ssh #56093

Fix boto_route53 issue with (multiple) VPCs. #57139

Remove log from mine runner which was not used. #57463

Fixed x509.read_certificate error when reading a Microsoft CA issued certificate in the new cryptography x509 module. Please migrate to the new cryptography x509 module for this improvement. #57535

Updating Slack engine to use slack_bolt library. #57842

Fixed warning about replace=True with x509.certificate_managed in the new cryptography x509 module. #58165

Fix salt.modules.pip:is_installed doesn't handle locally installed packages #58202

Add missing MariaDB Grants to mysql module. MariaDB has added some grants in 10.4.x and 10.5.x that are not present here, which results in an error when creating. #58297

linux_shadow: Fix cases where malformed shadow entries cause user.present states to fail. #58423

Fixed salt.utils.compat.cmp to work with dictionaries #58729

Fixed formatting for terse output mode #58953

Fixed RecursiveDictDiffer with added nested dicts #59017

Fixed x509.certificate_managed has DoS effect on master in the new cryptography x509 module. Please migrate to the new cryptography x509 module for this improvement. #59169

Fixed saltnado websockets disconnecting immediately #59183

Fixed x509.certificate_managed rolls certificates every now and then in the new cryptography x509 module. Please migrate to the new cryptography x509 module for this improvement. #59315

Fix postgres_privileges.present not idempotent for functions #59585

Fixed influxdb_continuous_query.present state to provide the client args to the underlying module on create. #59766

Warn when using insecure (http:// based) key_urls for apt-based systems in pkgrepo.managed, and add a kwarg that determines the validity of such a url. #59786

add load balancing policy default option and ensure the module can be executed with arguments from CLI #59909

Fix salt-ssh when using imports with extra-filerefs. #60003

Fixed cache directory corruption startup error #60170

Update docs remove dry_run in docstring of file.blockreplace state. #60227

Adds Parrot to OS_Family_Map in grains. #60249

Fixed stdout and stderr being empty sometimes when use_vt=True for the cmd.run[*] functions #60365

Use return code in iptables --check to verify rule exists. #60467

Fix regression pip.installed does not pass env_vars when calling pip.list #60557

Fix xfs module when additional output included in mkfs.xfs command. #60853

Fixed parsing new format of terraform states in roster.terraform #60915

Fixed recognizing installed ARMv7 rpm packages in compatible architectures. #60994

Fixing changes dict in pkg state to be consistent when installing and test=True. #60995

Fix cron.present duplicating entries when changing timespec to special. #60997

Made salt-ssh respect --wipe again #61083

state.orchestrate_single only passes a pillar if it is set to the state function. This allows it to be used with state functions that don't accept a pillar keyword argument. #61092

Fix ipset state when the comment kwarg is set. #61122

Fix issue with archive.unzip where the password was not being encoded for the extract function #61422

Some Linux distributions (like AlmaLinux, Astra Linux, Debian, Mendel, Linux Mint, Pop!_OS, Rocky Linux) report different oscodename, osfullname, osfinger grains if lsb-release is installed or not. They have been changed to only derive these OS grains from /etc/os-release. #61618

Pop!_OS uses the full version (YY.MM) in the osfinger grain now, not just the year. This allows differentiating for example between 20.04 and 20.10. #61619

Fix ssh config roster to correctly parse the ssh config files that contain spaces. #61650

Fix SoftLayer configuration not raising an exception when a domain is missing #61727

Allow the minion to start or salt-call to run even if the user doesn't have permissions to read the root_dir value from the registry #61789

Need to move the creation of the proxy object for the ProxyMinion further down in the initialization for sub proxies to ensure that all modules, especially any custom proxy modules, are available before attempting to run the init function. #61805

Fixed malformed state return when merge-serializing to an improperly formatted file #61814

Made cmdmod._run[_all]_quiet work during minion startup on MacOS with runas specified (which fixed mac_service) #61816

When deleting the vault cache, also delete from the session cache #61821

Ignore errors on reading license info with dpkg_lowpkg to prevent tracebacks on getting package information. #61827

win_lgpo: Display conflicting policy names when more than one policy is found #61859

win_lgpo: Fixed intermittent KeyError when getting policy setting using lgpo.get_policy #61860

Fixed listing minions on OpenBSD #61966

Make Salt to return an error on "pkg" modules and states when targeting duplicated package names #62019

Fix return of REST-returned permissions when auth_list is set #62022

Normalize package names once on using pkg.installed/removed with yum to make it possible to install packages with the name containing a part similar to a name of architecture. #62029

Fix inconsitency regarding name and pkgs parameters between zypperpkg.upgrade() and yumpkg.upgrade() #62030

Fix attr=all handling in pkg.list_pkgs() (yum/zypper). #62032

Fixed the humanname being ignored in pkgrepo.managed on openSUSE Leap #62053

Fixed issue with some LGPO policies having whitespace at the beginning or end of the element alias #62058

Fix ordering of args to libcloud_storage.download_object module #62074

Ignore extend declarations in sls files that are excluded. #62082

Remove leftover usage of impacket #62101

Pass executable path from _get_path_exec() is used when calling the program. The $HOME env is no longer modified globally. Only trailing newlines are stripped from the fetched secret. Pass process arguments are handled in a secure way. #62120

Ignore some command return codes in openbsdrcctl_service to prevent spurious errors #62131

Fixed extra period in filename output in tls module. Instead of "server.crt." it will now be "server.crt". #62139

Make sure lingering PAexec-*.exe files in the Windows directory are cleaned up #62152

Restored Salt's DeprecationWarnings #62185

Fixed issue with forward slashes on Windows with file.recurse and clean=True #62197

Recognize OSMC as Debian-based #62198

Fixed Zypper module failing on RPM lock file being temporarily unavailable. #62204

Improved error handling and diagnostics in the proxmox salt-cloud driver #62211

Added EndeavourOS to the Arch os_family. #62220

Fix salt-ssh not detecting platform-python as a valid interpreter on EL8 #62235

Fix pkg.version_cmp on openEuler and a few other os flavors. #62248

Fix localhost detection in glusterfs.peers #62273

Fix Salt Package Manager (SPM) exception when calling spm create_repo . #62281

Fix matcher slowness due to loader invocation #62283

Fixes the Puppet module for non-aio Puppet packages for example running the Puppet module on FreeBSD. #62323

Issue 62334: Displays a debug log message instead of an error log message when the publisher fails to connect #62334

Fix pyobjects renderer access to opts and sls #62336

Fix use of random shuffle and sample functions as Jinja filters #62372

Fix groups with duplicate GIDs are not returned by get_group_list #62377

Fix the "zpool.present" state when enabling zpool features that are already active. #62390

Fix ability to execute remote file client methods in saltcheck #62398

Update all platforms to use pycparser 2.21 or greater for Py 3.9 or higher, fixes fips fault with openssl v3.x #62400

Due to changes in the Netmiko library for the exception paths, need to check the version of Netmiko python library and then import the exceptions from different locations depending on the result. #62405

When using preq on a state, then prereq state will first be run with test=True to determine if there are changes. When there are changes, the state with the prereq option will be run prior to the prereq state. If this state fails then the prereq state will not run and the state output uses the test=True run. However, the proposed changes are included for the prereq state are included from the test=True run. We should pull those out as there weren't actually changes since the prereq state did not run. #62408

Added directory mode for file.copy with makedirs #62426

Provide better error handling in the various napalm proxy minion functions when the device is not accessible. #62435

When handling aggregation, change the order to ensure that the requisites are aggregated first and then the state functions are aggregated. Caching whether aggregate functions are available for particular states so we don't need to attempt to load them everytime. #62439

The patch allows to boostrap kubernetes clusters in the version above 1.13 via salt module #62451

sysctl.persist now updates the in-memory value on FreeBSD even if the on-disk value was already correct. #62461

Fixed parsing CDROM apt sources #62474

Update sanitizing masking for Salt SSH to include additional password like strings. #62483

Fix user/group checking on file state functions in the test mode. #62499

Fix user.present to allow removing groups using optional_groups parameter and enforcing idempotent group membership. #62502

Fix possible tracebacks if there is a package with '------' or '======' in the description is installed on the Debian based minion. #62519

Fixed the omitted "pool" parameter when cloning a VM with the proxmox salt-cloud driver #62521

Fix rendering of pyobjects states in saltcheck #62523

Fixes pillar where a corrupted CacheDisk file forces the pillar to be rebuilt #62527

Use str() method instead of repo_line for when python3-apt is installed or not in aptpkg.py. #62546

Remove the connection_timeout from netmiko_connection_args before netmiko_connection_args is added to context["netmiko_device"]["args"] which is passed along to the Netmiko library. #62547

Fix order specific mount.mounted options for persist #62556

Fixed salt-cloud cloning a proxmox VM with a specified new vmid. #62558

Fix runas with cmd module when using the onedir bundled packages #62565

Update setproctitle version for all platforms #62576

Fixed missing parameters when cloning a VM with the proxmox salt-cloud driver #62580

Handle PermissionError when importing crypt when FIPS is enabled. #62587

Correctly reraise exceptions in states.http #62595

Fixed syndic eauth. Now jobs will be published when a valid eauth user is targeting allowed minions/functions. #62618

updated rest_cherry/app to properly detect arg sent as a string as curl will do when only one arg is supplied. #62624

Prevent possible tracebacks in core grains module by ignoring non utf8 characters in /proc/1/environ, /proc/1/cmdline, /proc/cmdline #62633

Fixed vault ext pillar return data for KV v2 #62651

Fix saltcheck _get_top_states doesn't pass saltenv to state.show_top #62654

Fix groupadd.* functions hard code relative command name #62657

Fixed pdbedit.create trying to use a bytes-like hash as string. #62670

Fix depenency on legacy boto module in boto3 modules #62672

Modified "_get_flags" function so that it returns regex flags instead of integers #62676

Change startup ReqServer log messages from error to info level. #62728

Fix kmod.* functions hard code relative command name #62772

Remove mako as a dependency in Windows and macOS. #62785

Fix mac_brew_pkg to work with null taps #62793

Fixing a bug when listing the running schedule if "schedule.enable" and/or "schedule.disable" has been run, where the "enabled" items is being treated as a schedule item. #62795

Prevent annoying RuntimeWarning message about line buffering (buffering=1) not being supported in binary mode #62817

Include UID and GID checks in modules.file.check_perms as well as comparing ownership by username and group name. #62818

Fix presence events on TCP transport by removing a client's presence when minion disconnects from publish channel correctly #62826

Remove Azure deprecation messages from functions that always run w/ salt-cloud #62845

Use select instead of iterating over entrypoints as a dictionary for importlib_metadata>=5.0.0 #62854

Fixed master job scheduler using when #62858

LGPO: Added support for missing domain controller policies: VulnerableChannelAllowList and LdapEnforceChannelBinding #62873

Fix unnecessarily complex gce metadata grains code to use googles metadata service more effectively. #62878

Fixed dockermod version_info function for docker-py 6.0.0+ #62882

Moving setting the LOAD_BALANCING_POLICY_MAP dictionary into the try except block that determines if the cassandra_cql module should be made available. #62886

Updating various MongoDB module functions to work with latest version of pymongo. #62900

Restored channel for Syndic minions to send job returns to the Salt master. #62933

removed _resolve_deps as it required a library that is not generally avalible. and switched to apt-get for everything as that can auto resolve dependencies. #62934

Updated pyzmq to version 22.0.3 on Windows builds because the old version was causing salt-minion/salt-call to hang #62937

Allow root user to modify crontab lines for non-root users (except AIX and Solaris). Align crontab line changes with the file ones and also with listing crontab. #62940

Fix systemd_service.* functions hard code relative command name #62942

Fix file.symlink backupname operation can copy remote contents to local disk #62953

Issue #62968: Fix issue where cloud deployments were putting the keys in the wrong location on Windows hosts #62968

Fixed gpg_passphrase issue with gpg decrypt/encrypt functions #62977

Fix file.tidied FileNotFoundError #62986

Fixed bug where module.wait states were detected as running legacy module.run syntax #62988

Fixed issue with win_wua module where it wouldn't load if the CryptSvc was set to Manual start #62993

The __opts__ dunder dictionary is now added to the loader's pack if not already present, which makes it accessible via the salt.loader.context.NamedLoaderContext class. #63013

Issue #63024: Fix issue where grains and config data were being place in the wrong location on Windows hosts #63024

Fix btrfs.subvolume_snapshot command failing #63025

Fix file.retention_schedule always reports changes #63033

Fix mongo authentication for mongo ext_pillar and mongo returner

This fix also include the ability to use the mongo connection string for mongo ext_pillar #63058

Fixed x509.create_csr creates invalid CSR by default in the new cryptography x509 module. #63103

TCP transport documentation now contains proper master/minion-side filtering information #63120

Fixed gpg.verify does not respect gnupghome #63145

User responsible for the runner is now correctly reported in the events on the event bus for the runner. #63148

Made pillar cache pass extra minion data as well #63208

Fix serious performance issues with the file.tidied module #63231

Fix rpm_lowpkg version comparison logic when using rpm-vercmp and only one version has a release number. #63317

Import StrictVersion and LooseVersion from setuptools.distutils.verison or setuptools._distutils.version, if first not available #63350

service.status on Windows does no longer throws a CommandExecutionError if the service is not found on the system. It now returns "Not Found" instead. #63577

When the shell is passed as powershell or pwsh, only wrapper the shell in quotes if cmd.run is running on Windows. When quoted on Linux hosts, this results in an error when the keyword arguments are appended. #63590

LGPO: Added support for "Relax minimum password length limits" #63596

Fixed the ability to set a scheduled task to auto delete if not scheduled to run again (delete_after) #63650

When a job is disabled only increase it's _next_fire_time value if the job would have run at the current time, eg. the current _next_fire_time == now. #63699

have salt.template.compile_template_str cleanup its temp files. #63724

Check file is not empty before attempting to read pillar disk cache file #63729

Fixed an issue with generating fingerprints for public keys with different line endings #63742

Add fileserver_interval and maintenance_interval master configuration options. These options control how often to restart the FileServerUpdate and Maintenance processes. Some file server and pillar configurations are known to cause memory leaks over time. A notable example of this are configurations that use pygit2. Salt can not guarantee dependency libraries like pygit2 won't leak memory. Restarting any long running processes that use pygit2 guarantees we can keep the master's memory usage in check. #63747

mac_xattr.list and mac_xattr.read will replace undecode-able bytes to avoid raising CommandExecutionError. #63779 #63779

Change default GPG keyserver from pgp.mit.edu to keys.openpgp.org. #63806

fix cherrypy 400 error output to be less generic. #63835

Ensure kwargs is passed along to _call_apt when passed into install function. #63847

remove eval and update logging to be more informative on bad config #63879

add linux_distribution to util to stop dep warning #63904

Fix valuerror when trying to close fileclient. Remove usage of del and close the filclient properly. #63920

Handle the situation when a sub proxy minion does not init properly, eg. an exception happens, and the sub proxy object is not available. #63923

Clarifying documentation for extension_modules configuration option. #63929

Windows pkg module now properly handles versions containing strings #63935

Handle the scenario when the check_cmd requisite is used with a state function when the state has a local check_cmd function but that function isn't used by that function. #63948

Issue #63981: Allow users to pass verify_ssl to pkg.install/pkg.installed on Windows #63981

Hardened permissions on workers.ipc and master_event_pub.ipc. #64063