saltstack / saltstack/salt

[BUG] Salt-ssh does not handle salt command in jinja when key not accepted

Open
#59,691 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Salt-SSH severity-high
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description

If I try to run a salt state (SLS) using salt-ssh and I have some jinja in this SLS with a salt command, if the host key is not accepted the salt command from jinja fail with the need to accept the key (even if no_host_keys is set to True)

{
    "_error": "Failed to return clean data",
    "stderr": "",
    "stdout": "The host key needs to be accepted, to auto accept run salt-ssh with the -i flag:\nThe authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.\nECDSA key fingerprint is SHA256:3LBIB8w1DRz3DM22N0fykVmJBuQCqLrqtLheWuOjJ8c.\nECDSA key fingerprint is MD5:b8:d4:c4:18:e8:f3:79:e1:ca:b6:77:1e:46:ff:bf:72.\nAre you sure you want to continue connecting (yes/no)? ",
    "retcode": 254
}

Setup
(Please provide relevant configs and/or SLS files (be sure to remove sensitive info).

A simple sls

# cat /srv/salt/test.sls 
test:
  test.configurable_test_state:
    - comment: {{ salt["test.ping"]() }}

Salt master config

# grep -v -e '^#' -e '^$' /etc/salt/master
file_roots:
  base:
    - /srv/salt
no_host_keys: true

Roster

# grep -v -e '^#' -e '^$' /etc/salt/roster 
node-1:
  host: 127.0.0.1
  user: root
  priv: /root/.ssh/id_rsa

Steps to Reproduce the behavior
(Include debug logs if possible and relevant)

The target minion host key need to not be accepted yet (basically not in the ~/.ssh/known_hosts)

Then the salt call in jinja will fail because of host key not accepted

$ salt-ssh node-1 state.sls test
node-1:
    The host key needs to be accepted, to auto accept run salt-ssh with the -i flag:
    {
        "local": {
            "jid": "20210303133308711895",
            "return": {
                "test_|-test_|-test_|-configurable_test_state": {
                    "name": "test",
                    "changes": {
                        "testing": {
                            "old": "Unchanged",
                            "new": "Something pretended to change"
                        }
                    },
                    "result": true,
                    "comment": {
                        "_error": "Failed to return clean data",
                        "stderr": "",
                        "stdout": "The host key needs to be accepted, to auto accept run salt-ssh with the -i flag:\nThe authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.\nECDSA key fingerprint is SHA256:3LBIB8w1DRz3DM22N0fykVmJBuQCqLrqtLheWuOjJ8c.\nECDSA key fingerprint is MD5:b8:d4:c4:18:e8:f3:79:e1:ca:b6:77:1e:46:ff:bf:72.\nAre you sure you want to continue connecting (yes/no)? ",
                        "retcode": 254
                    },
   

NOTE: It's the exact same behavior if I put a -i in the salt-ssh command

Expected behavior

Since no_host_keys is set to True the Salt command in jinja should ignore this host key.

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
          Salt: 3002.5
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: Not Installed
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.8.1
       libgit2: Not Installed
      M2Crypto: 0.33.0
          Mako: Not Installed
       msgpack: 0.6.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: Not Installed
        pygit2: Not Installed
        Python: 3.6.8 (default, Nov 16 2020, 16:55:22)
  python-gnupg: Not Installed
        PyYAML: 3.11
         PyZMQ: 17.0.0
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.1.4
 
System Versions:
          dist: centos 7 Core
        locale: UTF-8
       machine: x86_64
       release: 3.10.0-862.3.2.el7.x86_64
        system: Linux
       version: CentOS Linux 7 Core

Additional context

No, I didn't have time to check salt code for it yet

NOTE: Of course if you accept the host key manually on the host first then the command succeed

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the salt-ssh entry point and reproduce the failure using /srv/salt/test.sls, the shown roster, and no_host_keys: true. Trace how the salt.ping Jinja call handles SSH host-key options; done means the call succeeds without a pre-approved known_hosts entry when no_host_keys is enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.