[BUG] Salt-ssh does not handle salt command in jinja when key not accepted
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
If I try to run a salt state (SLS) using salt-ssh and I have some jinja in this SLS with a salt command, if the host key is not accepted the salt command from jinja fail with the need to accept the key (even if no_host_keys is set to True)
{
"_error": "Failed to return clean data",
"stderr": "",
"stdout": "The host key needs to be accepted, to auto accept run salt-ssh with the -i flag:\nThe authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.\nECDSA key fingerprint is SHA256:3LBIB8w1DRz3DM22N0fykVmJBuQCqLrqtLheWuOjJ8c.\nECDSA key fingerprint is MD5:b8:d4:c4:18:e8:f3:79:e1:ca:b6:77:1e:46:ff:bf:72.\nAre you sure you want to continue connecting (yes/no)? ",
"retcode": 254
}
Setup
(Please provide relevant configs and/or SLS files (be sure to remove sensitive info).
A simple sls
# cat /srv/salt/test.sls
test:
test.configurable_test_state:
- comment: {{ salt["test.ping"]() }}
Salt master config
# grep -v -e '^#' -e '^$' /etc/salt/master
file_roots:
base:
- /srv/salt
no_host_keys: true
Roster
# grep -v -e '^#' -e '^$' /etc/salt/roster
node-1:
host: 127.0.0.1
user: root
priv: /root/.ssh/id_rsa
Steps to Reproduce the behavior
(Include debug logs if possible and relevant)
The target minion host key need to not be accepted yet (basically not in the ~/.ssh/known_hosts)
Then the salt call in jinja will fail because of host key not accepted
$ salt-ssh node-1 state.sls test
node-1:
The host key needs to be accepted, to auto accept run salt-ssh with the -i flag:
{
"local": {
"jid": "20210303133308711895",
"return": {
"test_|-test_|-test_|-configurable_test_state": {
"name": "test",
"changes": {
"testing": {
"old": "Unchanged",
"new": "Something pretended to change"
}
},
"result": true,
"comment": {
"_error": "Failed to return clean data",
"stderr": "",
"stdout": "The host key needs to be accepted, to auto accept run salt-ssh with the -i flag:\nThe authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.\nECDSA key fingerprint is SHA256:3LBIB8w1DRz3DM22N0fykVmJBuQCqLrqtLheWuOjJ8c.\nECDSA key fingerprint is MD5:b8:d4:c4:18:e8:f3:79:e1:ca:b6:77:1e:46:ff:bf:72.\nAre you sure you want to continue connecting (yes/no)? ",
"retcode": 254
},
NOTE: It's the exact same behavior if I put a -i in the salt-ssh command
Expected behavior
Since no_host_keys is set to True the Salt command in jinja should ignore this host key.
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)Salt Version:
Salt: 3002.5
Dependency Versions:
cffi: Not Installed
cherrypy: Not Installed
dateutil: Not Installed
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 2.8.1
libgit2: Not Installed
M2Crypto: 0.33.0
Mako: Not Installed
msgpack: 0.6.2
msgpack-pure: Not Installed
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: Not Installed
pycryptodome: Not Installed
pygit2: Not Installed
Python: 3.6.8 (default, Nov 16 2020, 16:55:22)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 17.0.0
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.1.4
System Versions:
dist: centos 7 Core
locale: UTF-8
machine: x86_64
release: 3.10.0-862.3.2.el7.x86_64
system: Linux
version: CentOS Linux 7 Core
Additional context
No, I didn't have time to check salt code for it yet
NOTE: Of course if you accept the host key manually on the host first then the command succeed
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the salt-ssh entry point and reproduce the failure using /srv/salt/test.sls, the shown roster, and no_host_keys: true. Trace how the salt.ping Jinja call handles SSH host-key options; done means the call succeeds without a pre-approved known_hosts entry when no_host_keys is enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100