saltstack / saltstack/salt

[BUG] Zabbix 5.4+ no tls_psk properties in host response

Open
#63,105 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
Zabbix 5.4 made the properties tls_psk and tls_psk_identity write-only.
This means the zabbix_host.present state will always try to re-add them.

Setup

zabbix host:
  zabbix_host.present:
    - host: {{ grains['id'] }}
    - visible_name: {{ grains['id'].split('.')[0] }}
    - tls_accept: '2'
    - tls_connect: '2'
    - tls_psk_identity: psk_{{ grains['id'] }}
    - tls_psk: {{ pillar['zabbix_psk'] }}
    - groups: [ Salt ]
    - inventory_mode: '1'

Steps to Reproduce the behavior

# salt-call state.apply --state-output=changes
local:
----------
          ID: zabbix host
    Function: zabbix_host.present
      Result: True
     Comment: Host minion.example.com updated.
     Started: 14:32:44.522430
    Duration: 2001.996 ms
     Changes:
              ----------
              host:
                  {'tls_psk_identity': 'psk_minion.example.com', 'tls_psk': 'xxxxxxxxxxxxxxxxxxxxxxxx'}

Summary for local
-------------
Succeeded: 1 (changed=1)
Failed:    0
-------------
Total states run:     1
Total run time:    2.573 s

Expected behavior
Some way to deal with this.

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
          Salt: 3004.2

Dependency Versions:
          cffi: 1.14.5
      cherrypy: Not Installed
      dateutil: 2.7.3
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.10.1
       libgit2: Not Installed
      M2Crypto: 0.31.0
          Mako: Not Installed
       msgpack: 0.6.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: 2.20
      pycrypto: Not Installed
  pycryptodome: 3.6.1
        pygit2: Not Installed
        Python: 3.8.10 (default, Jun 22 2022, 20:18:18)
  python-gnupg: 0.4.5
        PyYAML: 5.3.1
         PyZMQ: 20.0.0
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.2

System Versions:
          dist: ubuntu 20.04 focal
        locale: utf-8
       machine: x86_64
       release: 5.4.0-132-generic
        system: Linux
       version: Ubuntu 20.04 focal

Additional information
https://support.zabbix.com/browse/ZBX-18134

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the zabbix_host.present state and reproduce the behavior with the provided salt-call state.apply example against Zabbix 5.4+. Trace how tls_psk and tls_psk_identity are compared when the response omits write-only properties. Done should include a defined handling for those properties so repeated runs no longer report them as changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.