mirror of
https://github.com/saltstack/salt.git
synced 2025-04-16 09:40:20 +00:00
66cf74140b
* Merge 3002.6 bugfix changes (#59822) * Pass `CI_RUN` as an environment variable to the test run. This allows us to know if we're running the test suite under a CI environment or not and adapt/adjust if needed * Migrate `unit.setup` to PyTest * Backportae36b15just for test_install.py * Only skip tests on CI runs * Always store git sha in _version.py during installation * Fix PEP440 compliance. The wheel metadata version 1.2 states that the package version MUST be PEP440 compliant. This means that instead of `3002.2-511-g033c53eccb`, the salt version string should look like `3002.2+511.g033c53eccb`, a post release of `3002.2` ahead by 511 commits with the git sha `033c53eccb` * Fix and migrate `tests/unit/test_version.py` to PyTest * Skip test if `easy_install` is not available * We also need to be PEP440 compliant when there's no git history * Allow extra_filerefs as sanitized kwargs for SSH client * Fix regression on cmd.run when passing tuples as cmd Co-authored-by: Alexander Graul <agraul@suse.com> * Add unit tests to ensure cmd.run accepts tuples * Add unit test to check for extra_filerefs on SSH opts * Add changelog file * Fix comment for test case * Fix unit test to avoid failing on Windows * Skip failing test on windows * Fix test to work on Windows * Add all ssh kwargs to sanitize_kwargs method * Run pre-commit * Fix pylint * Fix cmdmod loglevel and module_names tests * Fix pre-commit * Skip ssh tests if binary does not exist * Use setup_loader for cmdmod test * Prevent argument injection in restartcheck * Add changelog for restartcheck fix * docs_3002.6 * Add back tests removed in merge Co-authored-by: Pedro Algarvio <pedro@algarvio.me> Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com> Co-authored-by: Bryce Larson <brycel@vmware.com> Co-authored-by: Pablo Suárez Hernández <psuarezhernandez@suse.com> Co-authored-by: Alexander Graul <agraul@suse.com> Co-authored-by: Frode Gundersen <fgundersen@saltstack.com> * Remove glance state module in favor of glance_image * update wording in changelog * bump deprecation warning to Silicon. * Updating warnutil version to Phosphorous. * Update salt/modules/keystone.py Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com> * Check $HOMEBREW_PREFIX when linking against libcrypto When loading `libcrypto`, Salt checks for a Homebrew installation of `openssl` at Homebrew's default prefix of `/usr/local`. However, on Apple Silicon Macs, Homebrew's default installation prefix is `/opt/homebrew`. On all platforms, the prefix is configurable. If Salt doesn't find one of those `libcrypto`s, it will fall back on the un-versioned `/usr/lib/libcrypto.dylib`, which will cause the following crash: Application Specific Information: /usr/lib/libcrypto.dylib abort() called Invalid dylib load. Clients should not load the unversioned libcrypto dylib as it does not have a stable ABI. This commit checks $HOMEBREW_PREFIX instead of hard-coding `/usr/local`. * Add test case * Add changelog for 59808 * Add changelog entry * Make _find_libcrypto fail on Big Sur if it can't find a library Right now, if `_find_libcrypto` can't find any externally-managed versions of libcrypto, it will fall back on the pre-Catalina un-versioned system libcrypto. This does not exist on Big Sur and it would be better to raise an exception here rather than crashing later when trying to open it. * Update _find_libcrypto tests This commit simplifies the unit tests for _find_libcrypto by mocking out the host's filesystem and testing the common libcrypto installations (brew, ports, etc.) on Big Sur. It simplifies the tests for falling back on system versions of libcrypto on previous versions of macOS. * Fix description of test_find_libcrypto_with_system_before_catalina * Patch sys.platform for test_rsax931 tests * modules/match: add missing "minion_id" in Pillar example The documented Pillar example for `match.filter_by` lacks the `minion_id` parameter. Without it, the assignment won't work as expected. - fix documentation - add tests: - to prove the misbehavior of the documented example - to prove the proper behaviour when supplying `minion_id` - to ensure some misbehaviour observed with compound matchers doesn't occur * Fix for issue #59773 - When instantiating the loader grab values of grains and pillars if they are NamedLoaderContext instances. - The loader uses a copy of opts. - Impliment deepcopy on NamedLoaderContext instances. * Add changelog for #59773 * _get_initial_pillar function returns pillar * Fix linter issues * Clean up test * Bump deprecation release for neutron * Uncomment Sulfur release name * Removing the _ext_nodes deprecation warning and alias. * Adding changelog. * Renaming changelog file. * Update 59804.removed * Initial pass at fips_mode config option * Fix pre-commit * Fix tests and add changelog * update docs 3003 * update docs 3003 - newline * Fix warts in changelog * update releasenotes 3003 * add ubuntu-2004-amd64 m2crypto pycryptodome and tcp tests * add distro_arch * changing the cloud platforms file missed in1a9b7be0e2* Update __utils__ calls to import utils in azure * Add changelog for 59744 * Fix azure unit tests and move to pytest * Use contextvars from site-packages for thin If a contextvars package exists one of the site-packages locations use it for the generated thin tarball. This overrides python's builtin contextvars and allows salt-ssh to work with python <=3.6 even when the master's python is >3.6 (Fixes #59942) * Add regression test for #59942 * Add changelog for #59942 * Update filemap to include test_py_versions * Fix broken thin tests * Always install the `contextvars` backport, even on Py3.7+ Without this change, salt-ssh cannot target systems with Python <= 3.6 * Use salt-factories to handle the container. Don't override default roster * Fix thin tests on windows * No need to use warn log level here * Fix getsitepackages for old virtualenv versions * Add explicit pyobjc reqs * Add back the passthrough stuff * Remove a line so pre-commit will run * Bugfix release docs * Bugfix release docs * Removing pip-compile log files * Fix failing test tests.unit.grains.test_core.CoreGrainsTestCase.test_xen_virtual * Fix pre-commit for docs.txt reqs Co-authored-by: Daniel Wozniak <dwozniak@saltstack.com> Co-authored-by: Pedro Algarvio <pedro@algarvio.me> Co-authored-by: Bryce Larson <brycel@vmware.com> Co-authored-by: Pablo Suárez Hernández <psuarezhernandez@suse.com> Co-authored-by: Alexander Graul <agraul@suse.com> Co-authored-by: Frode Gundersen <fgundersen@saltstack.com> Co-authored-by: Gareth J. Greenaway <gareth@saltstack.com> Co-authored-by: Gareth J. Greenaway <gareth@wiked.org> Co-authored-by: Hoa-Long Tam <hoalong@apple.com> Co-authored-by: krionbsd <krion@freebsd.org> Co-authored-by: Elias Probst <e.probst@ssc-services.de> Co-authored-by: Daniel A. Wozniak <dwozniak@vmware.com> Co-authored-by: Frode Gundersen <frogunder@gmail.com> Co-authored-by: twangboy <slee@saltstack.com> Co-authored-by: twangboy <leesh@vmware.com> Co-authored-by: ScriptAutomate <derek@icanteven.io>
335 lines
8.5 KiB
Groff
335 lines
8.5 KiB
Groff
.\" Man page generated from reStructuredText.
|
|
.
|
|
.TH "SALT-KEY" "1" "Apr 20, 2021" "3003.1" "Salt"
|
|
.SH NAME
|
|
salt-key \- salt-key Documentation
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.SH SYNOPSIS
|
|
.INDENT 0.0
|
|
.INDENT 3.5
|
|
.sp
|
|
.nf
|
|
.ft C
|
|
salt\-key [ options ]
|
|
.ft P
|
|
.fi
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.SH DESCRIPTION
|
|
.sp
|
|
Salt\-key executes simple management of Salt server public keys used for
|
|
authentication.
|
|
.sp
|
|
On initial connection, a Salt minion sends its public key to the Salt
|
|
master. This key must be accepted using the \fBsalt\-key\fP command on the
|
|
Salt master.
|
|
.sp
|
|
Salt minion keys can be in one of the following states:
|
|
.INDENT 0.0
|
|
.IP \(bu 2
|
|
\fBunaccepted\fP: key is waiting to be accepted.
|
|
.IP \(bu 2
|
|
\fBaccepted\fP: key was accepted and the minion can communicate with the Salt
|
|
master.
|
|
.IP \(bu 2
|
|
\fBrejected\fP: key was rejected using the \fBsalt\-key\fP command. In
|
|
this state the minion does not receive any communication from the Salt
|
|
master.
|
|
.IP \(bu 2
|
|
\fBdenied\fP: key was rejected automatically by the Salt master.
|
|
This occurs when a minion has a duplicate ID, or when a minion was rebuilt or
|
|
had new keys generated and the previous key was not deleted from the Salt
|
|
master. In this state the minion does not receive any communication from the
|
|
Salt master.
|
|
.UNINDENT
|
|
.sp
|
|
To change the state of a minion key, use \fB\-d\fP to delete the key and then
|
|
accept or reject the key.
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-version
|
|
Print the version of Salt that is running.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-versions\-report
|
|
Show program\(aqs dependencies and version number, and then exit
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-h, \-\-help
|
|
Show the help message and exit
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-c CONFIG_DIR, \-\-config\-dir=CONFIG_dir
|
|
The location of the Salt configuration directory. This directory contains
|
|
the configuration files for Salt master and minions. The default location
|
|
on most systems is \fB/etc/salt\fP\&.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-u USER, \-\-user=USER
|
|
Specify user to run salt\-key
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-hard\-crash
|
|
Raise any original exception rather than exiting gracefully. Default is
|
|
False.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-q, \-\-quiet
|
|
Suppress output
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-y, \-\-yes
|
|
Answer \(aqYes\(aq to all questions presented, defaults to False
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-rotate\-aes\-key=ROTATE_AES_KEY
|
|
Setting this to False prevents the master from refreshing the key session
|
|
when keys are deleted or rejected, this lowers the security of the key
|
|
deletion/rejection operation. Default is True.
|
|
.UNINDENT
|
|
.SS Logging Options
|
|
.sp
|
|
Logging options which override any settings defined on the configuration files.
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-log\-file=LOG_FILE
|
|
Log file path. Default: /var/log/salt/minion\&.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-log\-file\-level=LOG_LEVEL_LOGFILE
|
|
Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
|
|
\fBdebug\fP, \fBinfo\fP, \fBwarning\fP, \fBerror\fP, \fBquiet\fP\&. Default:
|
|
\fBwarning\fP\&.
|
|
.UNINDENT
|
|
.SS Output Options
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out
|
|
Pass in an alternative outputter to display the return of data. This
|
|
outputter can be any of the available outputters:
|
|
.INDENT 7.0
|
|
.INDENT 3.5
|
|
\fBhighstate\fP, \fBjson\fP, \fBkey\fP, \fBoverstatestage\fP, \fBpprint\fP, \fBraw\fP, \fBtxt\fP, \fByaml\fP, and many others\&.
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.sp
|
|
Some outputters are formatted only for data returned from specific functions.
|
|
If an outputter is used that does not support the data passed into it, then
|
|
Salt will fall back on the \fBpprint\fP outputter and display the return data
|
|
using the Python \fBpprint\fP standard library module.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out\-indent OUTPUT_INDENT, \-\-output\-indent OUTPUT_INDENT
|
|
Print the output indented by the provided value in spaces. Negative values
|
|
disable indentation. Only applicable in outputters that support
|
|
indentation.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out\-file=OUTPUT_FILE, \-\-output\-file=OUTPUT_FILE
|
|
Write the output to the specified file.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out\-file\-append, \-\-output\-file\-append
|
|
Append the output to the specified file.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-no\-color
|
|
Disable all colored output
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-force\-color
|
|
Force colored output
|
|
.sp
|
|
\fBNOTE:\fP
|
|
.INDENT 7.0
|
|
.INDENT 3.5
|
|
When using colored output the color codes are as follows:
|
|
.sp
|
|
\fBgreen\fP denotes success, \fBred\fP denotes failure, \fBblue\fP denotes
|
|
changes and success and \fByellow\fP denotes a expected future change in configuration.
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-state\-output=STATE_OUTPUT, \-\-state_output=STATE_OUTPUT
|
|
Override the configured state_output value for minion
|
|
output. One of \(aqfull\(aq, \(aqterse\(aq, \(aqmixed\(aq, \(aqchanges\(aq or
|
|
\(aqfilter\(aq. Default: \(aqnone\(aq.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-state\-verbose=STATE_VERBOSE, \-\-state_verbose=STATE_VERBOSE
|
|
Override the configured state_verbose value for minion
|
|
output. Set to True or False. Default: none.
|
|
.UNINDENT
|
|
.SS Actions
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-l ARG, \-\-list=ARG
|
|
List the public keys. The args \fBpre\fP, \fBun\fP, and \fBunaccepted\fP will
|
|
list unaccepted/unsigned keys. \fBacc\fP or \fBaccepted\fP will list
|
|
accepted/signed keys. \fBrej\fP or \fBrejected\fP will list rejected keys.
|
|
Finally, \fBall\fP will list all keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-L, \-\-list\-all
|
|
List all public keys. (Deprecated: use \fB\-\-list all\fP)
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-a ACCEPT, \-\-accept=ACCEPT
|
|
Accept the specified public key (use \-\-include\-all to match rejected keys
|
|
in addition to pending keys). Globs are supported.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-A, \-\-accept\-all
|
|
Accepts all pending keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-r REJECT, \-\-reject=REJECT
|
|
Reject the specified public key (use \-\-include\-all to match accepted keys
|
|
in addition to pending keys). Globs are supported.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-R, \-\-reject\-all
|
|
Rejects all pending keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-include\-all
|
|
Include non\-pending keys when accepting/rejecting.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-p PRINT, \-\-print=PRINT
|
|
Print the specified public key.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-P, \-\-print\-all
|
|
Print all public keys
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-d DELETE, \-\-delete=DELETE
|
|
Delete the specified key. Globs are supported.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-D, \-\-delete\-all
|
|
Delete all keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-f FINGER, \-\-finger=FINGER
|
|
Print the specified key\(aqs fingerprint.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-F, \-\-finger\-all
|
|
Print all keys\(aq fingerprints.
|
|
.UNINDENT
|
|
.SS Key Generation Options
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-gen\-keys=GEN_KEYS
|
|
Set a name to generate a keypair for use with salt
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-gen\-keys\-dir=GEN_KEYS_DIR
|
|
Set the directory to save the generated keypair. Only works
|
|
with \(aqgen_keys_dir\(aq option; default is the current directory.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-keysize=KEYSIZE
|
|
Set the keysize for the generated key, only works with
|
|
the \(aq\-\-gen\-keys\(aq option, the key size must be 2048 or
|
|
higher, otherwise it will be rounded up to 2048. The
|
|
default is 2048.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-gen\-signature
|
|
Create a signature file of the master\(aqs public\-key named
|
|
master_pubkey_signature. The signature can be sent to a minion in the
|
|
master\(aqs auth\-reply and enables the minion to verify the master\(aqs public\-key
|
|
cryptographically. This requires a new signing\-key\-pair which can be
|
|
auto\-created with the \-\-auto\-create parameter.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-priv=PRIV
|
|
The private\-key file to create a signature with
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-signature\-path=SIGNATURE_PATH
|
|
The path where the signature file should be written
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-pub=PUB
|
|
The public\-key file to create a signature for
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-auto\-create
|
|
Auto\-create a signing key\-pair if it does not yet exist
|
|
.UNINDENT
|
|
.SH SEE ALSO
|
|
.sp
|
|
\fBsalt(7)\fP
|
|
\fBsalt\-master(1)\fP
|
|
\fBsalt\-minion(1)\fP
|
|
.SH AUTHOR
|
|
Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
|
|
.\" Generated by docutils manpage writer.
|
|
.
|