saltstack中salt-key的用法

运维张小星 2021-07-08

1682

介绍：

saltstack中master和minion是依靠证书来进行加密通信的。

在saltstack中salt-key命令是用来管理证书的

用法：

salt-key [options]

常用参数：

-L, --list-all #显示已经或未认证的被控端id

-a ACCEPT, --accept=ACCEPT #接受单个id证书请求

-A, --accept-all #接受所有id证书请求

-r REJECT, --reject=REJECT #拒绝指定的公钥

-R, --reject-all #拒绝所有正在请求的公钥

-d DELETE, --delete=DELETE #删除指定的公钥

-D, --delete-all #删除所有的公钥

证书状态

salt-key -L
Accepted Keys：#已经接受的key
Denied Keys：#拒绝的key
Unaccepted Keys：#未加入的key
Rejected Keys：#吊销的key

实例：

1.检查所有证书

[root@salt-master ~]# salt-key -L
Accepted Keys:
web1
web2
Denied Keys:
Unaccepted Keys:
Rejected Keys:

2.删除指定证书

-d

[root@salt-master ~]# salt-key -d web1 
The following keys are going to be deleted:
Accepted Keys:
web1
Proceed? [N/y] y
Key for minion web1 deleted.

删除所有证书

[root@salt-master ~]# salt-key -D 
The following keys are going to be deleted:
Accepted Keys:
web1
web2
Proceed? [N/y] y
Key for minion web1 deleted.
Key for minion web2 deleted.
[root@salt-master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
Rejected Keys:

3.接受单个证书

-a

[root@salt-master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
web1
web2
Rejected Keys:
[root@salt-master ~]# salt-key -a web1
The following keys are going to be accepted:
Unaccepted Keys:
web1
Proceed? [n/Y] y
Key for minion web1 accepted.
[root@salt-master ~]# salt-key -L
Accepted Keys:
web1
Denied Keys:
Unaccepted Keys:
web2
Rejected Keys:
[root@salt-master ~]# salt '*' test.ping
web1:
    True

接收所有证书

[root@salt-master ~]# salt-key -A
The following keys are going to be accepted:
Unaccepted Keys:
web2
Proceed? [n/Y] y
Key for minion web2 accepted.

4.拒绝单个证书认证

-r

[root@salt-master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
web1
web2
Rejected Keys:
[root@salt-master ~]# salt-key -r web1
The following keys are going to be rejected:
Unaccepted Keys:
web1
Proceed? [n/Y] y
Key for minion web1 rejected.
[root@salt-master ~]# salt-key -L
Accepted Keys:
Denied Keys:
Unaccepted Keys:
web2
Rejected Keys:
web1

拒绝所有

[root@salt-master ~]# salt-key -R
The following keys are going to be rejected:
Unaccepted Keys:
web2
Proceed? [n/Y] y
Key for minion web2 rejected.

如果不想交互，加个-y就可以了

证书的所有文件都在salt-master中

注意保存

[root@salt-master master]# pwd
/etc/salt/pki/master
[root@salt-master master]# tree
.
├── master.pem
├── master.pub
├── minions
├── minions_autosign
├── minions_denied
├── minions_pre
└── minions_rejected
    ├── web1
    └── web2

数据库

文章转载自运维张小星，如果涉嫌侵权，请发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。

saltstack中salt-key的用法

评论