Linting Salt states without running them

Question

I am using Saltstack in a homelab, and I often find myself checking in slightly-broken rules when testing them. I would like to be able to check them for validity, and otherwise lint them, locally and on a Jenkins instance, but I can't find any documentation about how I might do so. Is there something I'm missing?

Answer 1

Syntax issues are multi-layered in Salt (i.g. Jinja -> YAML -> state function args) and there is no tool to cover them all.

The fast answer based on this related issue is to trigger the multi-layered parsing:

salt-call state.show_highstate      | tee highstate.output.yaml
salt-call state.show_sls [state_id] | tee state_id.output.yaml

The show_* functions display state data as minion sees it before execution.

Using salt-call on minion side (instead of salt on master side) often provides better debug options - this is mostly a preference.

The problems may also be in pillar or grains (check that all required data is compiled and exists as expected):

salt-call pillar.items | tee pillar.output.yaml
salt-call grains.items | tee grains.output.yaml

Just like @cyfur01 already mentioned, running states directly (with test mode or not) is the last step to troubleshoot:

salt-call state.highstate      test=True | tee highstate.output.yaml
salt-call state.sls [state_id] test=True | tee state_id.output.yaml

Answer 2

Salt states support a testing interface. For example:

salt '*' state.highstate test=True

This should run the states and tell you everything they would do without actually changing anything -- effectively it's a dry run. While it's not directly a linting tool, it does verify that Salt is able to parse and run everything.