salt: Salt-master doesn't renew vault token
Description of Issue/Question
Vault allows for an issued token to be renewed while it is still active. When the salt-master is configured to use token auth, it does not attempt to renew the token, instead, it lets it expire and then fail.
This seems like poor behavior, especially since the other auth method approle
appears to validate if it’s expired and request a new token. (older versions of salt do not support approle).
It would be beneficial if the salt-master monitored the remaining time to live of it’s configured token and renew’d it.
Setup
(Please provide relevant configs and/or SLS files (Be sure to remove sensitive info).)
/etc/salt/master.d/vault.conf
vault:
url: http://avault.server:8200
auth:
method: token
token: randomjunkhere
Steps to Reproduce Issue
Provision a token with the appropriate polices, wait until the ttl expires, be unable to access vault.
Versions Report
(Provided by running salt --versions-report
. Please also mention any differences in master/minion versions.)
salt --versions-report
Salt Version:
Salt: 2017.7.8
Dependency Versions:
cffi: 1.5.2
cherrypy: Not Installed
dateutil: 2.4.2
docker-py: Not Installed
gitdb: 2.0.3
gitpython: 2.1.10
ioflo: Not Installed
Jinja2: 2.8
libgit2: 0.24.0
libnacl: Not Installed
M2Crypto: Not Installed
Mako: 1.0.3
msgpack-pure: Not Installed
msgpack-python: 0.4.6
mysql-python: Not Installed
pycparser: 2.14
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: 0.24.0
Python: 2.7.12 (default, Nov 12 2018, 14:36:49)
python-gnupg: 0.3.8
PyYAML: 3.11
PyZMQ: 15.2.0
RAET: Not Installed
smmap: 2.0.3
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.1.4
System Versions:
dist: Ubuntu 16.04 xenial
locale: UTF-8
machine: x86_64
release: 4.4.0-1075-aws
system: Linux
version: Ubuntu 16.04 xenial
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Comments: 18 (6 by maintainers)
@ptitdoc Thanks. How did you set up that policy and approle in vault to get salt to be happy with it ?
I’ve copied yours to test and salt is reporting “Bad: Request” with no other debug I can find atm.
I’s currently working, I only need to reset the secret-id every month because of the TTL using
vault write -f auth/approle/role/saltmaster/secret-id
https://github.com/hashicorp/vault/issues/5445
So there is two ways around:
1/ Change the secret_id_ttl by providing a ttl in seconds but it is buggy. If you exceed 999999 seconds, it will just show 768h of ttl when writing a new secret-id:
vault write auth/approle/role/saltmaster secret_id_ttl=999999
vault write -f auth/approle/role/saltmaster/secret-id
2/ Set the secret_id_ttl to zero to disable completely ttl:
vault write auth/approle/role/saltmaster secret_id_ttl=0
vault write -f auth/approle/role/saltmaster/secret-id
Thank you for updating this issue. It is no longer marked as stale.
thanks for the input i really appreciate it 😃