Description
When trying to have highstate run at startup on an AWS WorkSpace with a AL2 based image and users coming in some unknown (kerberos?) fashion from a remote system, states that need to run as a user will hang indefinitely trying to retrieve the user's environment.
After the user has logged in, the state will run as expected.
Setup
Both the master and minion are using version salt-3005.1.-4.amzn2.x86_64
The minion is an AWS WorkSpace using an AL2 image. User info comes from WINBIND.
When trying to apply this state, salt will try to gather my user's environment information:
{% set user = salt['grains.get']('group:domain') + "\\" + salt['grains.get']('user:name') %}
global-email:
git.config_set:
- name: user.email
- value: {{ salt['grains.get']('user:email') }}
- user: {{ user | yaml_encode }}
- global: TrueDuring this execution, these are the debug logs:
Mar 16 13:44:17 a-3nn6chtl3usbj salt-minion[2878]: [DEBUG ] LazyLoaded git.config_set
Mar 16 13:44:17 a-3nn6chtl3usbj salt-minion[2878]: [INFO ] Running state [user.email] at time 13:44:17.813491
Mar 16 13:44:17 a-3nn6chtl3usbj salt-minion[2878]: [INFO ] Executing state git.config_set for [user.email]
Mar 16 13:44:17 a-3nn6chtl3usbj salt-minion[2878]: [INFO ] Executing command git as user 'gusb\ul931f' in directory '/home/ul931f'
Mar 16 13:44:17 a-3nn6chtl3usbj salt-minion[2878]: [DEBUG ] env command: ['su', '-s', '/bin/sh', '-', 'gusb\\ul931f', '-c', '/opt/saltstack/salt/run/run python /tmp/tmp4oql6lze']
Mar 16 13:44:17 a-3nn6chtl3usbj salt-minion[2878]: [DEBUG ] User provided environment variable 'LD_LIBRARY_PATH' with value '/opt/saltstack/salt/run' which is the value that PyInstaller set's. Removing it
Mar 16 13:44:17 a-3nn6chtl3usbj salt-minion[2878]: [DEBUG ] Setting environment variable 'LD_LIBRARY_PATH' to an empty string
Mar 16 13:44:17 a-3nn6chtl3usbj su[4808]: (to gusb\ul931f) root on none
The su pid 4808 shows as defunct but salt does not progress its execution.
This environment retrieval is coming from this subprocess.Popen call, which does not pass a timeout kwarg to the communicate method. I have found that by adding in a timeout, it does in fact work in my environment.
The following change worked for me:
try:
env_bytes, env_encoded_err = subprocess.Popen(
env_cmd,
stderr=subprocess.PIPE,
stdout=subprocess.PIPE,
stdin=subprocess.PIPE,
).communicate(salt.utils.stringutils.to_bytes(py_code), timeout=10)
except subprocess.TimeoutExpired:
marker_count = 0
env_encoded_err=None
env_bytes=None
else:
marker_count = env_bytes.count(marker_b)
Description
When trying to have highstate run at startup on an AWS WorkSpace with a AL2 based image and users coming in some unknown (kerberos?) fashion from a remote system, states that need to run as a user will hang indefinitely trying to retrieve the user's environment.
After the user has logged in, the state will run as expected.
Setup
Both the master and minion are using version
salt-3005.1.-4.amzn2.x86_64The minion is an AWS WorkSpace using an AL2 image. User info comes from WINBIND.
When trying to apply this state, salt will try to gather my user's environment information:
During this execution, these are the debug logs:
The su pid
4808shows as defunct but salt does not progress its execution.This environment retrieval is coming from this subprocess.Popen call, which does not pass a
timeoutkwarg to thecommunicatemethod. I have found that by adding in a timeout, it does in fact work in my environment.The following change worked for me: