salt-ssh pkg.install fails

[Sean McGrath]

Hi,

(This is a cross post from the bug report I have submitted, apologies if doing that is not the conventions).

Using salt 3006.9 on a Rocky Linux 8.10 test salt master the salt-ssh tool fails to install packages on a Rocky Linux 8.10 test minion and gives and error that "'pkg.install' is not available" or 'pkg.installed' was not found.

This errors: salt-ssh -i minion.fqdn pkg.install nmap

As follows:
    ----------
    retcode:
        255
    stderr:
        /var/tmp/.root_2bbfa8_salt/pyall/salt/utils/psutil_compat.py:18: DeprecationWarning: Please stop importing 'salt.utils.psutil_compat' and instead import 'psutil' directly as there's no longer a need for a compatability layer. The 'salt.utils.psutil_compat' will go away on Salt 3008.0 (Argon).
          "Please stop importing 'salt.utils.psutil_compat' and instead import "
        /var/tmp/.root_2bbfa8_salt/pyall/salt/modules/x509.py:100: DeprecationWarning: The x509 modules are deprecated. Please migrate to the replacement modules (x509_v2). They are the default from Salt 3008 (Argon) onwards.
          "The x509 modules are deprecated. Please migrate to the replacement "
        'pkg.install' is not available.
    stdout:

Or as follows if using a salt state:

salt-ssh -i minion.fqdn state.sls installsalt.update

          ID: install nmap to test
    Function: pkg.installed
        Name: nmap
      Result: False
     Comment: State 'pkg.installed' was not found in SLS 'installsalt.update'
              Reason: 'pkg' __virtual__ returned False: pkg module could not be loaded
     Changes:

The salt state contains the following in it in case relevant.

install nmap to test:
  pkg.installed:
    - name: nmap

Using salt directly, i.e. no salt-ssh, command e.g. below, works though.

salt hprc-guest-114-230.tchpc.tcd.ie state.sls installsalt.update

So the issue seems to be limited to salt-ssh.

It also does not occur from a salt master running salt version 3005.5. I can get pkg.install to work with salt-ssh from a 3005.5 master.

As per https://docs.saltproject.io/en/3006/ref/modules/index.html#overriding-virtual-module-providers I have set the pkg provider to yumpkg in /etc/salt/minion on the minion host as follows:

providers:
  pkg: yumpkg

I've also tried updating the state file to set the provider as follows:

install nmap to test:
  pkg.installed:
    - name: nmap
    - provider: yumpkg

This does not resolve the issue though.

Any advice on what I am doing wrong would be very much apprecaited please.

Salt Version:
          Salt: 3006.9
 
Python Version:
        Python: 3.10.14 (main, Jun 26 2024, 11:44:37) [GCC 11.2.0]
 
Dependency Versions:
          cffi: 1.14.6
      cherrypy: unknown
  cryptography: 42.0.5
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 3.1.4
       libgit2: Not Installed
  looseversion: 1.0.2
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 22.0
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.19.1
        pygit2: Not Installed
  python-gnupg: 0.4.8
        PyYAML: 6.0.1
         PyZMQ: 23.2.0
        relenv: 0.17.0
         smmap: Not Installed
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.4
 
System Versions:
          dist: rocky 8.10 Green Obsidian
        locale: utf-8
       machine: x86_64
       release: 4.18.0-553.40.1.el8_10.x86_64
        system: Linux
       version: Rocky Linux 8.10 Green Obsidian


Thanks

Sean

[Sean McGrath]

For the record and in case anyone else has this issue. Downgrading to 3006.8 works around this issue. Issue caused by salt-ssh needing to use system python, while regular salt can bring its own python. More details in the bug report https://github.com/saltstack/salt/issues/67777. 

[Hagen Kröber]

Hello,

we use salt-ssh and own state / execution modules.

We also run in trouble with the python version

• the current salt version at the salt master host requires
• our own salt modules requires
• salt uses at the minion

We:

• use salt version 3007.1 (requires at least Python 3.8 ) on the salt master host (inside a virtual env for Python 3.11)
• run openSuse Leap 15.6 on the minions with Python 3.6 on OS system level (doesn't meet the required salt version)
• installed additional Python version(s) on OS system level (e.g Python 3.11) in parallel

As salt generates a Shell script which uses the OS system Python3 version, we patch that script to use a specific python version

• https://github.com/saltstack/salt/blob/f906ca5052ed90245538617c14d7f2dbc4b72127/salt/client/ssh/__init__.py#L151

We add the specific Python binaries at begin of the list of "tested" python interpreters ("PYTHON_CMDS").
A better solution is, to define the Python interpreater as additional salt roster parameter.

Hagen

Patch

~/salt/client/ssh/__init__.py

```
SSH_SH_SHIM = "\n".join(
[
s.strip()
for s in r'''/bin/sh << 'EOF'
set -e
set -u
...
PYTHON_CMDS="python3.12 python3.11 python3.9 python3 python27 python2.7 python26 python2.6 python2 python /usr/libexec/platform-python"
for py_cmd in $PYTHON_CMDS
do
if command -v "$py_cmd" >/dev/null 2>&1 && "$py_cmd" -c "import sys; sys.exit(not (sys.version_info >= (2, 6)));"
...
```

[Sean McGrath]

Thanks for that. Will consider if it would work for us.