How do you use the 'publish' module in your own module

Question

I need to execute a script on another minion. The best solution seems to be Peer Publishing, but the only documentation I have been able to find only shows how to do it via CLI.

How can I define the following in a module?

salt-call system.example.com publish.publish '*' cmd.run './script_to_run'

Answer 1

The syntax for the .sls file:

salt-call publish.publish \* cmd.run 'cd /*directory* && ./script_to_run.sh:
  cmd.run

Alternative syntax:

execute script on other minion:
  cmd.run
    - name: salt-call publish.publish \* cmd.run 'cd /*directory* && ./script_to_run.sh

What I specifically did (I needed to execute a command, but only if a published command executed successfully. Which command to publish depends on the role of the minion):

execute script:
  cmd.run:
    - name: *some shell command here*
    - cwd: /*directory*
    - require:
      - file: *some file here*
    {% if 'role_1' in grains['roles'] -%} 
    - onlyif: salt-call publish.publish \* cmd.run 'cd /*other_directory* && ./script_to_run_A.sh'
    {% elif 'role_2' in grains['roles'] -%}
    - onlyif: salt-call publish.publish \* cmd.run 'cd /*other_directory* && ./script_to_run_B.sh'
    {% endif %}

Remember to enable peer communication in /etc/salt/master under the section 'Peer Publish Settings':

peer:
  .*:
    - .*

This configuration is not secure, since it enables all minions to execute all commands on fellow minions, but I have not figured out the correct syntax to select minions based on their role yet.

Another note is that it probably would be better to create a custom command containing the cmd.run and then enable only that, since enabling all nodes to execute arbitrary scripts on each other is not secure.

The essence of this answer is the same as Dan Garthwaite's, but what I needed was a solution for a .sls file.

Answer 2

You want the salt.client.Caller() API.

#!/usr/bin/env python
import salt.client
salt_call = salt.client.Caller()
salt_call.function('publish.publish', 'web001',
                   'cmd.run', 'logger "publish.publish success"')

You have to run the above as the salt user (usually root).

Then scoot over to web001 and confirm the message is in /var/log/syslog. Worked for me.