Preseed Minion with Accepted KeyΒΆ

In some situations, it is not convenient to wait for a minion to start before accepting its key on the master. For instance, you may want the minion to bootstrap itself as soon as it comes online. You may also want to to let your developers provision new development machines on the fly.

There is a general four step process to do this:

  1. Generate the keys on the master:
root@saltmaster# salt-key --gen-keys=[key_name]

Pick a name for the key, such as the minion's id.

  1. Add the public key to the accepted minion folder:
root@saltmaster# cp key_name.pub /etc/salt/pki/master/minions/[minion_id]

It is necessary that the public key file has the same name as your minion id. This is how Salt matches minions with their keys. Also note that the pki folder could be in a different location, depending on your OS or if specified in the master config file.

  1. Distribute the minion keys.

There is no single method to get the keypair to your minion. If you are spooling up minions on EC2, you could pass them in using user_data or a cloud-init script. If you are handing them off to a team of developers for provisioning dev machines, you will need a secure file transfer.

Security Warning

Since the minion key is already accepted on the master, distributing the private key poses a potential security risk. A malicious party will have access to your entire state tree and other sensitive data.

  1. Preseed the Minion with the keys

You will want to place the minion keys before starting the salt-minion daemon:

/etc/salt/pki/minion/minion.pem
/etc/salt/pki/minion/minion.pub

Once in place, you should be able to start salt-minion and run salt-call state.highstate or any other salt commands that require master authentication.