Minion/master connection-resilience defaults, dedicated namespaces, GHCR-first quickstart - #4
Merged
saifuddinrangwala merged 1 commit intoSep 8, 2026
Conversation
…HCR-first quickstart Minion resilience (salt-minion-vcf chart + salt-minion-kubernetes chart/ entrypoint, and salt-minion-vcf's own entrypoint for Docker/env users): - auth_timeout: 60 - allow more time for minions to authenticate against the master before timing out and retrying, reducing thundering-herd retry storms. - master_alive_interval: 60 - proactively checks the master TCP connection and reconnects if it's gone stale; disabled (0) by default in Salt itself, so minions previously only noticed a dead/rescheduled master at the next job dispatch attempt. - recon_default/recon_max/recon_randomize - ZeroMQ reconnect backoff with jitter, Salt's own documented fix for reconnect thundering herds when many minions reconnect at once (e.g. after a master restart). Master resilience (salt-master-kubernetes chart + docker/salt-master entrypoint): - presence_events: true - fires salt/presence/present|change events so manage.present/manage.status reflect which minions are actually connected right now, useful in Kubernetes where minion pods come and go independently of their accepted-key status. Dedicated default namespaces (previously kube-system for both): - salt-master-kubernetes now defaults to namespace `salt-master`. - salt-minion-kubernetes now defaults to namespace `salt` (both its own `namespace` and `kubeBench.namespace`, which must stay in sync with each other and with kube-bench-job's own namespace - see updated docs/kubernetes-compliance-guide.md). - salt-minion-vcf docs updated from the `vcf-salt` example namespace to `salt` for consistency (this chart has no explicit namespace value of its own - it deploys wherever `helm install -n` targets). README/docs: - Main README now leads with GHCR quick-install commands (Helm OCI charts + a plain `docker run` against the published salt-minion-vcf image) instead of local build instructions. - New docs/building.md consolidates the from-source build path (Docker images, chart packaging) that used to live in the main README. Verified: helm lint/template on all 3 charts, hadolint on all 4 Dockerfiles, shellcheck on both entrypoint scripts, bash -n on the master entrypoint - all clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
salt-minion-vcfandsalt-minion-kubernetes, chart + Docker/env entrypoint paths):auth_timeout: 60,master_alive_interval: 60,recon_default/recon_max/recon_randomize- reduces thundering-herd retry storms and ensures minions detect a dead/rescheduled master and reconnect (previously disabled by default in Salt).salt-master-kubernetes):presence_events: true- somanage.present/manage.statusreflect which minions are actually connected, useful since minion pods in Kubernetes come and go independently of their accepted-key status.kube-systemfor both charts):salt-master-kubernetes→salt-mastersalt-minion-kubernetes→salt(bothnamespaceandkubeBench.namespace, kept in sync - see updateddocs/kubernetes-compliance-guide.mdfor thekube-bench-jobcoordination note)salt-minion-vcfdocs updated from thevcf-saltexample tosaltfor consistency (this chart has no explicit namespace value of its own).README.mdnow leads with GHCR quick-install (Helm OCI charts +docker runagainst the published image) instead of local build steps; newdocs/building.mdholds the from-source build path.Verification
helm lint+helm template(all documented--setcombinations) on all 3 charts: clean.hadolint --failure-threshold infoon all 4 Dockerfiles: clean.shellcheckon both entrypoint scripts: clean.bash -non the master entrypoint: clean.🤖 Generated with Claude Code