saltstack / saltstack/salt

[DOCS] key rejection is not mentioned in the guides when AES key rotation situations happens

Open
#63,469 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation good first issue severity-medium time-estimate-quick-fix
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
Is not obvious that key rejection causes AES rotation for publications.

Suggested Fix

https://docs.saltproject.io/en/latest/topics/tutorials/intro_scale.html#too-many-minions-re-authing
The Salt Master generates a new AES key to encrypt its publications at certain events such as a Master restart or the removal of a Minion key. If you are encountering this problem of too many minions re-authing against the Master, you will need to recalibrate your setup to reduce the rate of events like a Master restart or Minion key removal (salt-key -d).

TO

The Salt Master generates a new AES key to encrypt its publications at certain events such as a Master restart or the removal/rejection of a Minion key. If you are encountering this problem of too many minions re-authing against the Master, you will need to recalibrate your setup to reduce the rate of events like a Master restart, Minion key removal (salt-key -d) or Minion key rejection (salt-key -r).
https://docs.saltproject.io/en/getstarted/system/communication.html in "ROTATING SECURITY KEYS"
A rotating AES key is used to encrypt jobs that are sent to the Salt minion by the Salt master, and to encrypt connections to the Salt master fileserver. A new key is generated and used each time the Salt master restarts and each time a Salt minion key is deleted using the salt-key command.

TO

A rotating AES key is used to encrypt jobs that are sent to the Salt minion by the Salt master, and to encrypt connections to the Salt master fileserver. A new key is generated and used each time the Salt master restarts and each time a Salt minion key is deleted/rejected using the salt-key command.
https://docs.saltproject.io/en/latest/ref/cli/salt-key.html

Add a huge warning and backlinking to performance guide for key removal/rejection sections

Type of documentation
Guides

Location or format of documentation
https://docs.saltproject.io/en/getstarted/system/communication.html
https://docs.saltproject.io/en/latest/topics/tutorials/intro_scale.html#too-many-minions-re-authing
https://docs.saltproject.io/en/latest/ref/cli/salt-key.html

Additional context

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the three specified documentation locations: the “Too many minions re-authing” section in intro_scale.html, “ROTATING SECURITY KEYS” in communication.html, and the removal/rejection sections of salt-key.html. Update each location to mention rejected keys, add the requested warning and backlink, then verify the wording and links in the rendered documentation.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.