Minimal VM requirements for Salt configuration are not documented

[qu...@posteo.de]

Hi,

I am trying to setup all VMs with Salt since the switch to Fedora 24.

I usually took the minimal template and create the others on base of
this with more packages.

The problem is that the Qubes salt documentation does not document what
the minimal requirements on packages are for deploying salt and
receiving.

For example if I install in the minimal fedora 24 template
qubes-mgmt-salt-vm-connector I still can not install any packages with
Salt from the outside. If I use this minimal template as the default I
can not deploy Salt anymore to templates which can be updated with Salt
because they have all the necessary packages.

The errors in the qubes log are also not descriptive:
If I use the standard template as default (which has the packages to
deploy salt) and try to update packages in the extended minimal template
I get the following log entry:
calling 'state.highstate'...
output: fedora-24-test
output: Target 'fedora-24-test' did not return any data, probably
due to an error.
exit code: 20

If I use the minimal template as default (which does not seem to have
the packages to deploy salt) I get the following log entry:
calling 'state.highstate'...
exit code: 127


So I am missing the documentation what the minimal requirements for vms
are to be configured by salt or be able to deploy salt?

It would be also great to have an example in the Wiki how to update the
vm packages with Salt. I have one configuration but this also seems to
not work with Fedora 24 anymore.

Thx in advance for the help and thx for a great os

[john.david.r.smith]

looks like my problem i posted here:
https://groups.google.com/d/msg/qubes-users/C1tJV4Ykgr8/5H09IT06CQAJ

i did not try it again since i had this problem.
missing in min are sudo and file (but after this i still get problems)

[qu...@posteo.de]

Hi John,

On 20.01.2017 10:26, john.david.r.smith wrote:
> looks like my problem i posted here:
> https://groups.google.com/d/msg/qubes-users/C1tJV4Ykgr8/5H09IT06CQAJ
>
> i did not try it again since i had this problem.
> missing in min are sudo and file (but after this i still get problems)

many thx for the reply. You are right, some issues overlap.

I have tried installing sudo but not file. Installing also the later
fixes the issue of the default template, so you can use the extended
Minimal as default template with these changes and do not get the error
127 for standard templates.

But applying salt on minimals vms with all the mentioned packages plus
sudo and file still results in the exit code 20.

How can I debug this further. What commands are run on the disposble vms
so I can see more output?

Thx in advance

[john.david.r.smith]

well that is the part i am currently at (as i wrote, i did not try again
after Marek answered.

Marek wrote a few tricks on debugging this problem. (ctrl+z when the
target vm is started etc. (you can look it up in the linked thread))

i will probably try again this weekend and will post any results i get.
in case you manage to fix this, tell me! ;)

concerning a tutorial:
i probably will write a more verbose tutorial if i got all my stuff fixed.

-john

[john.david.r.smith]

problem solved (details posted in other thread).

you need to install in fed24 minimal the sudo package and delete the left over files in the ~/QubesIncomming folder (they screw you over)

[qu...@posteo.de]

On 22.01.2017 01:44, john.david.r.smith wrote:
> problem solved (details posted in other thread).
>
> you need to install in fed24 minimal the sudo package and delete the
> left over files in the ~/QubesIncomming folder (they screw you over)

Many thx for the hint. It seems to fix my issue too. This should be
documented in the Wiki until there is a solution for this.

I also ran into another issue configuring the repos with salt, because
yum.conf under Qubes seems to be different, but I guess this should be
easier to fix from our side.

Regards

[qu...@posteo.de]

On 22.01.2017 01:44, john.david.r.smith wrote:
>

> problem solved (details posted in other thread).
>
> you need to install in fed24 minimal the sudo package and delete the
> left over files in the ~/QubesIncomming folder (they screw you over)

The original issue is fixed.

But if I try to setup a NetVM template with the packages described under
https://www.qubes-os.org/doc/templates/fedora-minimal/ I can not install
tinyproxy and the notification-daemon because of the
qubes-templates-minimal-stub package. If I remove this it tries to
remove 147 packages including the Qubes ones which breaks the vm.
I did not find another template package. I could install all these
packages manually but this does not seem like a good approach.

Somehow I was able to install the manually in the past but it does not
work now. Did anybody find a solution to install these packages in the
minimal template without the template package interfering?

Thx in advance

[Manuel Amador (Rudd-O)]

On 01/20/2017 08:58 AM, qu...@posteo.de wrote:
> Hi,
>
> I am trying to setup all VMs with Salt since the switch to Fedora 24.
>
> I usually took the minimal template and create the others on base of
> this with more packages.
>
> The problem is that the Qubes salt documentation does not document
> what the minimal requirements on packages are for deploying salt and
> receiving.
>
> For example if I install in the minimal fedora 24 template
> qubes-mgmt-salt-vm-connector I still can not install any packages with
> Salt from the outside. If I use this minimal template as the default I
> can not deploy Salt anymore to templates which can be updated with
> Salt because they have all the necessary packages.

You're going to need at the very minimum python-dnf.

--
Rudd-O
http://rudd-o.com/

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Created a ticket for this:
https://github.com/QubesOS/qubes-issues/issues/2600

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYhXo0AAoJENuP0xzK19csX1IIAIDNIGgv8Bx3GTpbrbDGGc4H
20SjI8TdnGtRZdsIZvvIUA5MfCPBn1cPSFuUMGzbwgTNQrnnAtJ1Vd0jxkbtSKhc
jGqTUPqTt7DGGfqAIzvGKX+gSUuGnwqcjMYW7dhqdm1P/rhpXL/UC2vxZ6O4y6c+
YMOeY7KkzSsb9JAjpFCJLs1gQNVWm3AX6po0nQ03T62/8BLG+HBlswzvaTPtL2zn
2dY7K2GKdXHqREA7Rmgh9DA7tL5/v2n6WyOVxG9nhlu/MDnAbpVBTukKkSZqRlCT
WwDXooEgOMYVZ2fvvkheA0cn3+KtDAg3E9dbRlt7EUTd5r64x3drkQbc/H1rBFM=
=aQCf
-----END PGP SIGNATURE-----