saltstack / saltstack/salt

[BUG] salt-run manage.key_regen doesnt work with auto-accept

Open
#57,704 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug pending-discussion severity-high
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Circumstances
We had minions responding to a master running a salt \* command but not if you directly tried to target those minions, the minions key wasn't present in salt-key, we figured we had key artifacts in memory and decided to get the minions to re-authenticate in bulk to get these ghost minion keys back in salt-key.

The main command used was:

$ salt-run manage.key_regen

Unfortunately, this command will give you a giant warning to restart within 60 seconds or else, but our master already had auto_accept enabled and the ghost minion keys were showing up. Unfortunately, the warning scared my coworker and he restarted the master causing all keys to be deleted???

Expected behavior
The master deletes the minion keys and all minions are instructed to delete the master public key and you restart the master then accept the pending minions keys.

What happens?
Instead of the expected behavior if you have auto_accept on for the master and you restart the master, you will delete all your minion keys! and the minion don't attempt to send their key again.

Versions Report

Salt Version:
           Salt: 3000.3
 
Dependency Versions:
           cffi: 1.11.5
       cherrypy: Not Installed
       dateutil: Not Installed
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
         Jinja2: 2.11.2
        libgit2: 0.28.2
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.6.2
   mysql-python: Not Installed
      pycparser: 2.19
       pycrypto: 2.6.1
   pycryptodome: 3.9.7
         pygit2: 0.28.2
         Python: 3.7.5 (default, Oct 17 2019, 12:25:15)
   python-gnupg: Not Installed
         PyYAML: 5.3.1
          PyZMQ: 19.0.1
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.2
 
System Versions:
           dist:   
         locale: UTF-8
        machine: x86_64
        release: 3.10.0-1062.18.1.el7.x86_64
         system: Linux
        version: Not Installed

Resources
https://docs.saltstack.com/en/latest/ref/runners/all/salt.runners.manage.html#salt.runners.manage.key_regen

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the salt-run manage.key_regen documentation and reproduce the reported sequence with auto_accept enabled, including the master restart. Trace the key-regeneration and minion re-authentication flow; done means restarting does not permanently delete the minion keys and pending keys can be accepted as described.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.