[BUG] salt-run manage.key_regen doesnt work with auto-accept
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Circumstances
We had minions responding to a master running a salt \* command but not if you directly tried to target those minions, the minions key wasn't present in salt-key, we figured we had key artifacts in memory and decided to get the minions to re-authenticate in bulk to get these ghost minion keys back in salt-key.
The main command used was:
$ salt-run manage.key_regen
Unfortunately, this command will give you a giant warning to restart within 60 seconds or else, but our master already had auto_accept enabled and the ghost minion keys were showing up. Unfortunately, the warning scared my coworker and he restarted the master causing all keys to be deleted???
Expected behavior
The master deletes the minion keys and all minions are instructed to delete the master public key and you restart the master then accept the pending minions keys.
What happens?
Instead of the expected behavior if you have auto_accept on for the master and you restart the master, you will delete all your minion keys! and the minion don't attempt to send their key again.
Versions Report
Salt Version:
Salt: 3000.3
Dependency Versions:
cffi: 1.11.5
cherrypy: Not Installed
dateutil: Not Installed
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 2.11.2
libgit2: 0.28.2
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.6.2
mysql-python: Not Installed
pycparser: 2.19
pycrypto: 2.6.1
pycryptodome: 3.9.7
pygit2: 0.28.2
Python: 3.7.5 (default, Oct 17 2019, 12:25:15)
python-gnupg: Not Installed
PyYAML: 5.3.1
PyZMQ: 19.0.1
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.2
System Versions:
dist:
locale: UTF-8
machine: x86_64
release: 3.10.0-1062.18.1.el7.x86_64
system: Linux
version: Not Installed
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the salt-run manage.key_regen documentation and reproduce the reported sequence with auto_accept enabled, including the master restart. Trace the key-regeneration and minion re-authentication flow; done means restarting does not permanently delete the minion keys and pending keys can be accepted as described.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100