Command center
The command center is where you do one-off work on your machines without knowing Salt's syntax. You search for what you want to do, read what each command does in its own words, fill in a form, and run it. Every run goes through the same checks as a runbook: your permissions, change windows, locks, held work for offline machines, and the audit log.
To open it: choose Automation > Command center.
Common tasks
The top of the page has the everyday jobs as forms:
- Patch a node group: install every pending update.
- Install a package and Remove a package: by name, with each machine's own package manager (apt, dnf, zypper, or the Windows equivalent).
- Restart a service: systemd on Linux, the service manager on Windows.
- Reboot a node group, Apply security baseline and Health check.
- Run a command, when command execution is turned on for this server.
Choose Open, fill in the form, and choose Run now.
Any Salt command
Below the common tasks you can search every command your machines offer. The list comes from your machines themselves, from one Linux and one Windows machine, and is refreshed once a day.
- Type what you want to do, in plain words ("install package", "restart service", "add user", "disk space") or part of a command's name ("pkg.").
- Choose a node group, or type machine names.
- Choose a command. Gardience shows what it does, an example, and a field for each of its settings, with each setting's description. The main settings are shown first; the rest are under More options.
- Check the line This runs:. It is the exact Salt command, so you learn Salt as you go.
- Choose Run now. The run appears under Recent runs with each machine's result.
Commands that only read are marked as such. Commands that make changes are recorded in the audit log under your name, with every machine's result.
Commands an admin must allow first
Gardience runs commands through its own service identity, which may use only the commands on its allowed list. A new server allows the commands Gardience's features need. Others are shown under more that an admin must allow first. To allow one, root on the server runs:
/opt/gardience/gardience automation allow pkg.refresh_dbYour own role still applies: if your role may not run a command on a machine, Gardience refuses it, whatever the allowed list says.
Values you type may contain letters, digits, spaces and _ . , : @ / + = ~ * % ! -. Characters a shell would treat specially, such as ;, |, $ and backticks, are refused, so a value can never become a second command.
From a machine's page
Every machine's page (Machines > All machines, then the machine) has Run on this machine, for work on just that machine without picking it in a list:
- Command: type a command and run it there (in PowerShell on Windows). The output shows on the page as it comes back. Shown only when command execution is turned on for the server.
- State: apply a saved state from Automation > States. Test first is ticked by default, so the first run shows what would change without changing anything.
- Runbook: run any runbook that normally targets a node group on this machine alone, with its other settings at their defaults.
- Add to a group (admins): add the machine to a group of named machines, or start a new group with it.
Each one goes through the same checks as the Command center: the person's permissions and team scope, change windows, locks, approvals, change tickets, and the audit log.