Third, Saltstack certificate management

192.168.1.65 super65.cn Master
192.168.1.66 super66.cn Minion

Saltstack uses an SSL visa for secure authentication.

Minion on-line after the first contact with the master, their pub key sent past, then the master side through the SALT-KEY-L command will see Minion key, accept the Minion-key, that is, master and minion have mutual trust

Master side:

View Certificate Visa Status:

[Email protected] ~]# salt-key-l
Accepted Keys:
Denied Keys:
unaccepted Keys:
Super66
Rejected Keys:

Visas for all certificates not accepted:
[Email protected] ~]# salt-key-a-y
The following keys is going to be accepted:
unaccepted Keys:
Super66
Key for Minion Super66 accepted.

After viewing the visa status:
[Email protected] ~]# salt-key-l
Accepted Keys:
Super66
Denied Keys:
unaccepted Keys:
Rejected Keys:

More parameters for Salt-key use-H to view:

which

-A can specify only visas for certain machines (regular matching is supported)

Check that the communication is normal:

[email protected] ~]# Salt ' super66 ' test.ping
SUPER66:
True

Master side:

To view certificate-related files:

[Email protected] master]# pwd
/etc/salt/pki/master

[email protected] master]# LL
Total 28
-R--------1 root 1675 Sep 09:19 Master.pem ( own public key )
-rw-r--r--1 root root 451 Sep 09:19 master.pub (Own private key)
Drwxr-xr-x 2 root root 4096 Sep 09:32 Minions (already certified key)
Drwxr-xr-x 2 root root 4096 Sep 09:19 minions_autosign
Drwxr-xr-x 2 root root 4096 Sep 09:19 minions_denied
Drwxr-xr-x 2 root root 4096 Sep 09:32 minions_pre (no certified key)
Drwxr-xr-x 2 root root 4096 Sep 09:19 minions_rejected

Minion End:

To view certificate-related files:

[Email protected] minion]# pwd
/etc/salt/pki/minion
[email protected] minion]# LL
Total 12
-rw-r--r--1 root root 451 Sep 09:32 minion_master.pub (after authentication, master sends the public key here)
-R--------1 root 1679 Sep 09:17 Minion.pem (own public key)
-rw-r--r--1 root root 451 Sep 09:17 minion.pub (Own private key)

Minion and master side maintain long connections:

[[email protected] ~]# lsof-i: 4505
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
Salt-mini 5124 root 24u IPv4 30622 0t0 TCP super66.cn:39243->super65.cn:4505 (established)

Third, Saltstack certificate management