saltstack / saltstack/salt

salt-cloud prints minions private key to output

Open
#56,069 7 comments 1 reaction 1 assignee View on GitHub

@cmcmarrow is already working on this.

Since Nov 22, 2022.

bug Confirmed Salt-Cloud severity-critical v3000.7
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description of Issue

We are running salt-cloud commands from an Orchestration via Jenkins, and saw the minions private key being printed out to the logs.
I'd rather not see this in the output!

Example output from the cloud.create command:

    "__id__": "salt-cloud-create",
    "__run_num__": 1,
    "__sls__": "orch.aws.provision-host",
    "changes": {
        "ret": {
            "instance-hostname.com-create-runner": {
                "instance-hostname.com": {
                    "deploy_kwargs": {
                        "name": "instance-hostname.com",
                        "vm_": {
                            ........
                            "priv_key": "-----BEGIN RSA PRIVATE KEY-----\n entire private key contents here",
                            .........
                        }
                    }
                }
            }
        }
    }
Setup

(Please provide relevant configs and/or SLS files (Be sure to remove sensitive info).)
Example SLS file

salt-cloud-create:
  salt.parallel_runners:
  - runners:
      instance-cloud-create-runner-1:
      - name: cloud.create
      - kwarg:
          instances:
          - instance.cloud
          provider: ec2-provider
          availability_zone: eu-central-1b
          image: ami-04cf43aca3e6f3de3
          size: t3.small
          rename_on_destroy: true
          ssh_username: centos
Steps to Reproduce Issue

(Include debug logs if possible and relevant.)
Run the following example sls file.

Versions Report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)

> salt-cloud -V
Salt Version:
            Salt: 2019.2.0

Dependency Versions:
 Apache Libcloud: 2.2.1
            cffi: 1.6.0
        cherrypy: 5.6.0
        dateutil: 2.6.1
       docker-py: Not Installed
           gitdb: 0.6.4
       gitpython: 1.0.1
           ioflo: Not Installed
          Jinja2: 2.7.2
         libgit2: 0.26.3
         libnacl: Not Installed
        M2Crypto: 0.31.0
            Mako: Not Installed
    msgpack-pure: Not Installed
  msgpack-python: 0.5.6
    mysql-python: Not Installed
       pycparser: 2.14
        pycrypto: 2.6.1
    pycryptodome: Not Installed
          pygit2: 0.26.4
          Python: 2.7.5 (default, Jun 20 2019, 20:27:34)
    python-gnupg: Not Installed
          PyYAML: 3.11
           PyZMQ: 15.3.0
            RAET: Not Installed
           smmap: 0.9.0
         timelib: Not Installed
         Tornado: 4.2.1
             ZMQ: 4.1.4

System Versions:
            dist: centos 7.6.1810 Core
          locale: ANSI_X3.4-1968
         machine: x86_64
         release: 3.10.0-957.21.3.el7.x86_64
          system: Linux
         version: CentOS Linux 7.6.1810 Core

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.