[master] Master cluster

salt/cli/daemons.py

@@ -126,6 +126,51 @@ def _handle_signals(self, signum, sigframe):
             self.master.process_manager._handle_signals(signum, sigframe)
         super()._handle_signals(signum, sigframe)
 
+    def verify_environment(self):
+        if not self.config["verify_env"]:
+            return
+        v_dirs = [
+            self.config["pki_dir"],
+            os.path.join(self.config["pki_dir"], "minions"),
+            os.path.join(self.config["pki_dir"], "minions_pre"),
+            os.path.join(self.config["pki_dir"], "minions_denied"),
+            os.path.join(self.config["pki_dir"], "minions_autosign"),
+            os.path.join(self.config["pki_dir"], "minions_rejected"),
+            self.config["cachedir"],
+            os.path.join(self.config["cachedir"], "jobs"),
+            os.path.join(self.config["cachedir"], "proc"),
+            self.config["sock_dir"],
+            self.config["token_dir"],
+            self.config["syndic_dir"],
+            self.config["sqlite_queue_dir"],
+        ]
+        pki_dir = self.config["pki_dir"]
+        if (
+            self.config["cluster_id"]
+            and self.config["cluster_pki_dir"]
+            and self.config["cluster_pki_dir"] != self.config["pki_dir"]
+        ):
+            v_dirs.extend(
+                [
+                    self.config["cluster_pki_dir"],
+                    os.path.join(self.config["cluster_pki_dir"], "peers"),
+                    os.path.join(self.config["cluster_pki_dir"], "minions"),
+                    os.path.join(self.config["cluster_pki_dir"], "minions_pre"),
+                    os.path.join(self.config["cluster_pki_dir"], "minions_denied"),
+                    os.path.join(self.config["cluster_pki_dir"], "minions_autosign"),
+                    os.path.join(self.config["cluster_pki_dir"], "minions_rejected"),
+                ]
+            )
+            pki_dir = [self.config["pki_dir"], self.config["cluster_pki_dir"]]
+
+        verify_env(
+            v_dirs,
+            self.config["user"],
+            permissive=self.config["permissive_pki_access"],
+            root_dir=self.config["root_dir"],
+            pki_dir=pki_dir,
+        )
+
     def prepare(self):
         """
         Run the preparation sequence required to start a salt master server.
@@ -137,32 +182,7 @@ def prepare(self):
         super().prepare()
 
         try:
-            if self.config["verify_env"]:
-                v_dirs = [
-                    self.config["pki_dir"],
-                    os.path.join(self.config["pki_dir"], "minions"),
-                    os.path.join(self.config["pki_dir"], "minions_pre"),
-                    os.path.join(self.config["pki_dir"], "minions_denied"),
-                    os.path.join(self.config["pki_dir"], "minions_autosign"),
-                    os.path.join(self.config["pki_dir"], "minions_rejected"),
-                    self.config["cachedir"],
-                    os.path.join(self.config["cachedir"], "jobs"),
-                    os.path.join(self.config["cachedir"], "proc"),
-                    self.config["sock_dir"],
-                    self.config["token_dir"],
-                    self.config["syndic_dir"],
-                    self.config["sqlite_queue_dir"],
-                ]
-                verify_env(
-                    v_dirs,
-                    self.config["user"],
-                    permissive=self.config["permissive_pki_access"],
-                    root_dir=self.config["root_dir"],
-                    pki_dir=self.config["pki_dir"],
-                )
-                # Clear out syndics from cachedir
-                for syndic_file in os.listdir(self.config["syndic_dir"]):
-                    os.remove(os.path.join(self.config["syndic_dir"], syndic_file))
+            self.verify_environment()
         except OSError as error:
             self.environment_failure(error)
 

salt/config/__init__.py

@@ -185,6 +185,14 @@ def _gather_buffer_space():
         "pki_dir": str,
         # A unique identifier for this daemon
         "id": str,
+        # When defined we operate this master as a part of a cluster.
+        "cluster_id": str,
+        # Defines the other masters in the cluster.
+        "cluster_peers": list,
+        # Use this location instead of pki dir for cluster. This allows users
+        # to define where minion keys and the cluster private key will be
+        # stored.
+        "cluster_pki_dir": str,
         # Use a module function to determine the unique identifier. If this is
         # set and 'id' is not set, it will allow invocation of a module function
         # to determine the value of 'id'. For simple invocations without function
@@ -409,6 +417,8 @@ def _gather_buffer_space():
         "permissive_pki_access": bool,
         # The passphrase of the master's private key
         "key_pass": (type(None), str),
+        # The passphrase of the master cluster's private key
+        "cluster_key_pass": (type(None), str),
         # The passphrase of the master's private signing key
         "signing_key_pass": (type(None), str),
         # The path to a directory to pull in configuration file includes
@@ -1544,6 +1554,7 @@ def _gather_buffer_space():
         "verify_env": True,
         "permissive_pki_access": False,
         "key_pass": None,
+        "cluster_key_pass": None,
         "signing_key_pass": None,
         "default_include": "master.d/*.conf",
         "winrepo_dir": os.path.join(salt.syspaths.BASE_FILE_ROOTS_DIR, "win", "repo"),
@@ -1642,6 +1653,9 @@ def _gather_buffer_space():
         "netapi_enable_clients": [],
         "maintenance_interval": 3600,
         "fileserver_interval": 3600,
+        "cluster_id": None,
+        "cluster_peers": [],
+        "cluster_pki_dir": None,
     }
 )
 
@@ -4034,6 +4048,27 @@ def apply_master_config(overrides=None, defaults=None):
 
     prepend_root_dir(opts, prepend_root_dirs)
 
+    # When a cluster id is defined, make sure the other nessicery bits a
+    # defined.
+    if "cluster_id" not in opts:
+        opts["cluster_id"] = None
+    if opts["cluster_id"] is not None:
+        if not opts.get("cluster_peers", None):
+            log.warning("Cluster id defined without defining cluster peers")
+            opts["cluster_peers"] = []
+        if not opts.get("cluster_pki_dir", None):
+            log.warning(
+                "Cluster id defined without defining cluster pki, falling back to pki_dir"
+            )
+            opts["cluster_pki_dir"] = opts["pki_dir"]
+    else:
+        if opts.get("cluster_peers", None):
+            log.warning("Cluster peers defined without a cluster_id, ignoring.")
+            opts["cluster_peers"] = []
+        if opts.get("cluster_pki_dir", None):
+            log.warning("Cluster pki defined without a cluster_id, ignoring.")
+            opts["cluster_pki_dir"] = None
+
     # Enabling open mode requires that the value be set to True, and
     # nothing else!
     opts["open_mode"] = opts["open_mode"] is True