search

uvsmtid / common-salt-states

A framework of interrelated states and pillars on top of Saltstack common to other projects.
Apache License 2.0
2 stars 0 forks source link

Handle `gpg` setup for Salt master (and masterless Salt minions) via bootstrap package #16

Open uvsmtid opened 8 years ago

uvsmtid commented 8 years ago

At the moment, gpg installation and configuration (besides just private key import) for Salt master has to be done manually - bootstrap package won't handle this.

uvsmtid commented 8 years ago

When sensitive data is used, there is no automatic means for bootstrap package to provide GPG private keys securely at the moment. Moreover, it is insecure to distribute private keys in bootstrap packages.

Therefore, setting up Salt master (and mateterless Salt minions) will likely become manual step anyway (due to private key deployment).

In Salt master case it is even a one-time installation. Only masterless Salt minions is a special case which requires automated support. Should we use private keys encrypted with password?

Therefore, the fix for this issue is (indefinitely) postponed.