saltstack / saltstack/salt

[BUG] rotate_aes_key master config not working

Open
#64,035 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage v2019.2.0
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
The rotate_aes_key config is not verified in main maintenance method
I have a scenario with 15k minions, every day this is causing a spike of minions authentication and as consequence a lot of command failures at this moment.

click here

Setup
master config:

rotate_aes_key: False

Steps to Reproduce the behavior
Just use the configuration above

Expected behavior
Do not rotate AES key when the configuration is equals False

Screenshots
None

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
           Salt: 2019.2.8

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.8.2
      docker-py: Not Installed
          gitdb: 2.0.3
      gitpython: 2.1.8
          ioflo: Not Installed
         Jinja2: 2.10
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 3.6.9 (default, Jun 29 2022, 11:45:57)
   python-gnupg: 0.4.1
         PyYAML: 3.12
          PyZMQ: 16.0.2
           RAET: Not Installed
          smmap: 2.0.3
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.2.5

System Versions:
           dist: Ubuntu 18.04 bionic
         locale: UTF-8
        machine: x86_64
        release: 5.4.0-1063-aws
         system: Linux
        version: Ubuntu 18.04 bionic

Additional context
None.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in salt/master.py at the linked line and inspect the main maintenance method's handling of rotate_aes_key. Reproduce with rotate_aes_key: False and verify that the AES key is not rotated; the issue is done when this configuration prevents the reported minion reauthentication spike.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.