mirror of
https://github.com/saltstack/salt.git
synced 2025-04-16 09:40:20 +00:00
d9343cca65
* Check only ssh-rsa encyption for set_known_host * Windows test fix * Fix pre-commit * add CentOS Stream to _OS_FAMILY_MAP, fix #59161 * added changelog and test * fix syntax * Use centosstream 8 for testing * Use ? for matching spaces Technically this isn't *quite* right as 'CentOSyStream' would also match, but it's pretty reasonable: - OS grains shouldn't ever be that kind of close - This test is only swapping out spaces, and only for the os grain. That would mean there would have to be two OSes with grains that only differ by one having a space where another one has any other character. - This test really isn't even about matching grains, we're just using compound matching and that's a reasonable one to use. * Add centos stream when detecting package manager name * Fix pre-commit * Remove tests for fedora 32/33 EOL * Remove tests for fedora 32/33 EOL * Remove tests for fedora 33 EOL * Use centosstream 8 for testing * Use ? for matching spaces Technically this isn't *quite* right as 'CentOSyStream' would also match, but it's pretty reasonable: - OS grains shouldn't ever be that kind of close - This test is only swapping out spaces, and only for the os grain. That would mean there would have to be two OSes with grains that only differ by one having a space where another one has any other character. - This test really isn't even about matching grains, we're just using compound matching and that's a reasonable one to use. * 3002.9: Fix pre-commit * 3003.5 Fix pre-commit * [3002.9] Replace use of 'sl' with 'paper' for Arch tests, due to 'sl' having key issues * Remove mojave testing * Remove mojave and high sierra testing * Remove mojave testing * [3002.9] Fix cloud vultr size issue * Update package name to aspnetcore-runtime-6.0 for redhat 8 pkg tests * Update package name to aspnetcore-runtime-6.0 for redhat 8 pkg tests * change amazon linux AMI * Migrate `unit.modules.test_gpg` to PyTest * Don't leave any `gpg-agent`'s running behind Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Start a background process to generate entropy. Some tests have failed because of not enough entropy which then makes the test timeout. Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * A different approach at generating entropy Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Turn entropy generation into a helper Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * change amazon linux AMI * change amazon linux AMI * [3004.2] Fix cloud vultr size issue * Fix cloud requirements * Skip pam tests on windows * Update ami to try to get the tests running * Update amis to try to get the tests running * Fixing test_publish_to_pubserv_ipc_tcp, moving the call to socket.socket into the while loop. * Add static requirements for 3.8 and 3.9 on Windows * Fix requirements Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * The whole CI process is already slower than GH Actions, no caches. * Pre-commit must not run with ``PIP_EXTRA_INDEX_URL`` set. * Lint fixes Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Compile cloud requirements * Run add requirements files for 3.8 and 3.9 * Fix docs and cloud requirements * [3003.5] Fix cloud vultr size issue * Windows test fix * Skip test if docker not running * [3003.5] Fix pre-commit * Update Markup and contextfunction imports for jinja versions >=3.1. * update bootstrap to 2022.03.15 * update bootstrap to 2022.03.15 * skipping tests/pytests/integration/modules/test_virt.py on 3002.x and 3003.x branches. * Windows test fix * Skip PAM tests on Windows Windows has no ctypes with the PAM bits, so we should go ahead and skip on Windows. * Skip PAM auth tests on Windows Windows lacks the correct bits, so... * Fix pre-commit * Skipping tests since they're also skipped on the master branch Fixes #403 Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Skip test that only runs because the patch binary is now available. The feature though, was only added in 3004. Fixes #404 Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Skip test which is only supposed to run in Linux Fixes https://github.com/saltstack/salt-priv/issues/405 Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * GPG tests do not work on windows yet * Fix tests * Fix pre-commit * skip tests.integration.modules.test_mac_brew_pkg.BrewModuleTest.test_list_upgrades and tests.integration.modules.test_state.StateModuleTest.test_get_file_from_env_in_top_match on Mac OS. * skip tests.integration.modules.test_mac_brew_pkg.BrewModuleTest.test_list_upgrades and tests.integration.modules.test_state.StateModuleTest.test_get_file_from_env_in_top_match on Mac OS. * Removing skip, moving it to different PR. * Skipping tests on 3002.9. * test fix * Do not run patch tests on 3003.5. Feature not added till 3004 * skipping tests/pytests/integration/modules/test_virt.py on 3002.x and 3003.x branches. * Fix pre-commit * [3004.2] Update freebsd ami * Bump the git version for freebsd CI tests * removing versions that are no longer available from the tests.pytests.scenarios.compat.test_with_versions tests. * Skip tests on windows when NOT using static requirements Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * removing versions that are no longer available from the tests.pytests.scenarios.compat.test_with_versions tests. * test_issue_36469_tcp causes a fatal python error when run on Mac OS, so skipping. * Fix tests * Fix pre-commit * Do not run patch tests on 3003.5. Feature not added till 3004 * Skip archive tar tests on windows * [3002.9] Skip archive tar tests on windows * GPG tests do not work on windows yet * Skip test which is only supposed to run in Linux Fixes https://github.com/saltstack/salt-priv/issues/405 Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Skip test that only runs because the patch binary is now available. The feature though, was only added in 3004. Fixes #404 Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Skipping tests since they're also skipped on the master branch Fixes #403 Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Fix pre-commit * Fix pre-commit * Fix pre-commit * Fix pre-commit * retry sdb.get if it returns None None is an entirely valid return - see EtcdClient.get in salt/utils/etcd_util.py * drop py2/six * fix etcd sdb.set as well * Fix etdcd-sdb test failure If docker container is up and running, but etcd isn't responding yet it's possible that we get some failing tests. This should wait a reasonable amount of time for things to come up. Or just skip the test. * Fix etdcd-sdb test failure If docker container is up and running, but etcd isn't responding yet it's possible that we get some failing tests. This should wait a reasonable amount of time for things to come up. Or just skip the test. * Skip the tests from unit/transport/test_zero.py that are hanging on Mac. * skip tests in tests/pytests/unit/states/test_archive.py for 3002.9 * 3002.9 Skipping CA permissions tests on Windows, similar to 3003.5 and 3004.2 * change skipif to skip * Rollback Windows AMIs to use Python 3.7 * Rollback AMI's to Python 3.7... fix tests * Fix failing test_archive tests * Build using pyenv * Add symlinks to openssl and rpath * Add shasum for zeromq 4.3.4 * Fix docs on scripts * Build zeromq earlier, fix symlinks * Bring 61446 to 3004.1 branch * Add changelog and tests * Fix schedule test flakiness * Retry with new port if in use * fixing failing tests, ensuring that the correct path is used. * fixing failing tests, ensuring that the correct path is used. * fixing failing tests, ensuring that the correct path is used. * Re-enable tiamat-pip on windows Signed-off-by: Pedro Algarvio <palgarvio@vmware.com> * Bump duration time for windwos for test_retry_option_success * Skip test cauing hangs * go go pylint disable * more pre-commit * oh lint * so many weird hook failures * Add unit tests for PAM auth CVE We could add functional tests if it's important enough, but this is the narrowest place to test. * Fix PAM auth CVE Credit to @ysf Previously we weren't checking the result of PAM_ACCT_MGMT. * pylint disable * rewrite hook changes * Skip PAM auth tests on Windows Since Windows ends out lacking the correct bits, no need to run tests there. * pre-commit fixes * docs 3004.2 release * Fix bug in tcp transport * Fix the test_zeromq_filtering test * skip test_npm_install_url_referenced_package on centos 7 and 8. * Swapping CentOS Linux-8 for CentOS Stream-8 * Update build scripts to use pyenv * Fix tests on MacOS * Fix bug in tcp transport * Fix test failures * Update release notes and man pages for 3003.5 * Add 3002.9 changelog, release notes, man pages * Update doc/topics/releases/3002.9.rst Co-authored-by: Megan Wilhite <mwilhite@vmware.com> * Fix requirements * Fix imports * Test fixup * Fix merge warts * fix merge wart in changelog * Fix merge warts in tests Co-authored-by: krionbsd <krion@FreeBSD.org> Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com> Co-authored-by: Alexander Kriventsov <akriventsov@nic.ru> Co-authored-by: Megan Wilhite <mwilhite@vmware.com> Co-authored-by: Wayne Werner <wwerner@vmware.com> Co-authored-by: Gareth J. Greenaway <gareth@saltstack.com> Co-authored-by: David Murphy < dmurphy@saltstack.com> Co-authored-by: Twangboy <leesh@vmware.com> Co-authored-by: MKLeb <calebb@vmware.com> Co-authored-by: Pedro Algarvio <pedro@algarvio.me> Co-authored-by: Pedro Algarvio <palgarvio@vmware.com> Co-authored-by: Thomas Phipps <tphipps@vmware.com> Co-authored-by: Frode Gundersen <frogunder@gmail.com> Co-authored-by: Alyssa Rock <alyssa.rock@gmail.com> Co-authored-by: Alyssa Rock <43180546+barbaricyawps@users.noreply.github.com>
335 lines
8.5 KiB
Groff
335 lines
8.5 KiB
Groff
.\" Man page generated from reStructuredText.
|
|
.
|
|
.TH "SALT-KEY" "1" "May 12, 2022" "3004.2" "Salt"
|
|
.SH NAME
|
|
salt-key \- salt-key Documentation
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.SH SYNOPSIS
|
|
.INDENT 0.0
|
|
.INDENT 3.5
|
|
.sp
|
|
.nf
|
|
.ft C
|
|
salt\-key [ options ]
|
|
.ft P
|
|
.fi
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.SH DESCRIPTION
|
|
.sp
|
|
Salt\-key executes simple management of Salt server public keys used for
|
|
authentication.
|
|
.sp
|
|
On initial connection, a Salt minion sends its public key to the Salt
|
|
master. This key must be accepted using the \fBsalt\-key\fP command on the
|
|
Salt master.
|
|
.sp
|
|
Salt minion keys can be in one of the following states:
|
|
.INDENT 0.0
|
|
.IP \(bu 2
|
|
\fBunaccepted\fP: key is waiting to be accepted.
|
|
.IP \(bu 2
|
|
\fBaccepted\fP: key was accepted and the minion can communicate with the Salt
|
|
master.
|
|
.IP \(bu 2
|
|
\fBrejected\fP: key was rejected using the \fBsalt\-key\fP command. In
|
|
this state the minion does not receive any communication from the Salt
|
|
master.
|
|
.IP \(bu 2
|
|
\fBdenied\fP: key was rejected automatically by the Salt master.
|
|
This occurs when a minion has a duplicate ID, or when a minion was rebuilt or
|
|
had new keys generated and the previous key was not deleted from the Salt
|
|
master. In this state the minion does not receive any communication from the
|
|
Salt master.
|
|
.UNINDENT
|
|
.sp
|
|
To change the state of a minion key, use \fB\-d\fP to delete the key and then
|
|
accept or reject the key.
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-version
|
|
Print the version of Salt that is running.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-versions\-report
|
|
Show program\(aqs dependencies and version number, and then exit
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-h, \-\-help
|
|
Show the help message and exit
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-c CONFIG_DIR, \-\-config\-dir=CONFIG_dir
|
|
The location of the Salt configuration directory. This directory contains
|
|
the configuration files for Salt master and minions. The default location
|
|
on most systems is \fB/etc/salt\fP\&.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-u USER, \-\-user=USER
|
|
Specify user to run salt\-key
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-hard\-crash
|
|
Raise any original exception rather than exiting gracefully. Default is
|
|
False.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-q, \-\-quiet
|
|
Suppress output
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-y, \-\-yes
|
|
Answer \(aqYes\(aq to all questions presented, defaults to False
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-rotate\-aes\-key=ROTATE_AES_KEY
|
|
Setting this to False prevents the master from refreshing the key session
|
|
when keys are deleted or rejected, this lowers the security of the key
|
|
deletion/rejection operation. Default is True.
|
|
.UNINDENT
|
|
.SS Logging Options
|
|
.sp
|
|
Logging options which override any settings defined on the configuration files.
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-log\-file=LOG_FILE
|
|
Log file path. Default: /var/log/salt/minion\&.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-log\-file\-level=LOG_LEVEL_LOGFILE
|
|
Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
|
|
\fBdebug\fP, \fBinfo\fP, \fBwarning\fP, \fBerror\fP, \fBquiet\fP\&. Default:
|
|
\fBwarning\fP\&.
|
|
.UNINDENT
|
|
.SS Output Options
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out
|
|
Pass in an alternative outputter to display the return of data. This
|
|
outputter can be any of the available outputters:
|
|
.INDENT 7.0
|
|
.INDENT 3.5
|
|
\fBhighstate\fP, \fBjson\fP, \fBkey\fP, \fBoverstatestage\fP, \fBpprint\fP, \fBraw\fP, \fBtxt\fP, \fByaml\fP, and many others\&.
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.sp
|
|
Some outputters are formatted only for data returned from specific functions.
|
|
If an outputter is used that does not support the data passed into it, then
|
|
Salt will fall back on the \fBpprint\fP outputter and display the return data
|
|
using the Python \fBpprint\fP standard library module.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out\-indent OUTPUT_INDENT, \-\-output\-indent OUTPUT_INDENT
|
|
Print the output indented by the provided value in spaces. Negative values
|
|
disable indentation. Only applicable in outputters that support
|
|
indentation.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out\-file=OUTPUT_FILE, \-\-output\-file=OUTPUT_FILE
|
|
Write the output to the specified file.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-out\-file\-append, \-\-output\-file\-append
|
|
Append the output to the specified file.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-no\-color
|
|
Disable all colored output
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-force\-color
|
|
Force colored output
|
|
.sp
|
|
\fBNOTE:\fP
|
|
.INDENT 7.0
|
|
.INDENT 3.5
|
|
When using colored output the color codes are as follows:
|
|
.sp
|
|
\fBgreen\fP denotes success, \fBred\fP denotes failure, \fBblue\fP denotes
|
|
changes and success and \fByellow\fP denotes a expected future change in configuration.
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-state\-output=STATE_OUTPUT, \-\-state_output=STATE_OUTPUT
|
|
Override the configured state_output value for minion
|
|
output. One of \(aqfull\(aq, \(aqterse\(aq, \(aqmixed\(aq, \(aqchanges\(aq or
|
|
\(aqfilter\(aq. Default: \(aqnone\(aq.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-state\-verbose=STATE_VERBOSE, \-\-state_verbose=STATE_VERBOSE
|
|
Override the configured state_verbose value for minion
|
|
output. Set to True or False. Default: none.
|
|
.UNINDENT
|
|
.SS Actions
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-l ARG, \-\-list=ARG
|
|
List the public keys. The args \fBpre\fP, \fBun\fP, and \fBunaccepted\fP will
|
|
list unaccepted/unsigned keys. \fBacc\fP or \fBaccepted\fP will list
|
|
accepted/signed keys. \fBrej\fP or \fBrejected\fP will list rejected keys.
|
|
Finally, \fBall\fP will list all keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-L, \-\-list\-all
|
|
List all public keys. (Deprecated: use \fB\-\-list all\fP)
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-a ACCEPT, \-\-accept=ACCEPT
|
|
Accept the specified public key (use \-\-include\-all to match rejected keys
|
|
in addition to pending keys). Globs are supported.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-A, \-\-accept\-all
|
|
Accepts all pending keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-r REJECT, \-\-reject=REJECT
|
|
Reject the specified public key (use \-\-include\-all to match accepted keys
|
|
in addition to pending keys). Globs are supported.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-R, \-\-reject\-all
|
|
Rejects all pending keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-include\-all
|
|
Include non\-pending keys when accepting/rejecting.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-p PRINT, \-\-print=PRINT
|
|
Print the specified public key.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-P, \-\-print\-all
|
|
Print all public keys
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-d DELETE, \-\-delete=DELETE
|
|
Delete the specified key. Globs are supported.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-D, \-\-delete\-all
|
|
Delete all keys.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-f FINGER, \-\-finger=FINGER
|
|
Print the specified key\(aqs fingerprint.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-F, \-\-finger\-all
|
|
Print all keys\(aq fingerprints.
|
|
.UNINDENT
|
|
.SS Key Generation Options
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-gen\-keys=GEN_KEYS
|
|
Set a name to generate a keypair for use with salt
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-gen\-keys\-dir=GEN_KEYS_DIR
|
|
Set the directory to save the generated keypair. Only works
|
|
with \(aqgen_keys_dir\(aq option; default is the current directory.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-keysize=KEYSIZE
|
|
Set the keysize for the generated key, only works with
|
|
the \(aq\-\-gen\-keys\(aq option, the key size must be 2048 or
|
|
higher, otherwise it will be rounded up to 2048. The
|
|
default is 2048.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-gen\-signature
|
|
Create a signature file of the master\(aqs public\-key named
|
|
master_pubkey_signature. The signature can be sent to a minion in the
|
|
master\(aqs auth\-reply and enables the minion to verify the master\(aqs public\-key
|
|
cryptographically. This requires a new signing\-key\-pair which can be
|
|
auto\-created with the \-\-auto\-create parameter.
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-priv=PRIV
|
|
The private\-key file to create a signature with
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-signature\-path=SIGNATURE_PATH
|
|
The path where the signature file should be written
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-pub=PUB
|
|
The public\-key file to create a signature for
|
|
.UNINDENT
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \-\-auto\-create
|
|
Auto\-create a signing key\-pair if it does not yet exist
|
|
.UNINDENT
|
|
.SH SEE ALSO
|
|
.sp
|
|
\fBsalt(7)\fP
|
|
\fBsalt\-master(1)\fP
|
|
\fBsalt\-minion(1)\fP
|
|
.SH AUTHOR
|
|
Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
|
|
.\" Generated by docutils manpage writer.
|
|
.
|