Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] state x509.certificate_managed with no changes causes all subsequent file.managed to be treated as if run with "test=true" #64882

Closed
Dr-Bone opened this issue Jul 31, 2023 · 2 comments
Labels
Bug broken, incorrect, or confusing behavior needs-triage

Comments

@Dr-Bone
Copy link

Dr-Bone commented Jul 31, 2023

Description
If you perform a highstate which contains a x509.certificate_managed which actually does not do changes all following file.managed states are not executed and listed as "unchanged". As if run with test=true.

Setup
two lxd containers running Arch Linux
minion names: "saltmaster01" and "ca"
one is salt master one is certificate authority
x509_v2 is active
all pkgs installed using official Arch Linux repositories (using pacman)

Statefile: /srv/salt/temp/cert.sls:

/tmp/test:
  file.directory

/tmp/test/www.key:
  x509.private_key_managed:
    - name: /tmp/test/www.key
    - keysize: 4096
    - backup: False
    - require:
      - file: '/tmp/test'

/tmp/test/www.crt:
  x509.certificate_managed:
    - ca_server: ca
    - signing_policy: 'web_clients'
    - private_key: '/tmp/test/www.key'
    - CN: '{{ grains['id'] }}'
    - backup: False
    - days_remaining: 30
    - require:
      - x509: '/tmp/test/www.key'

/tmp/test/foo:
  file.managed:
    - contents: "bar"

I don't think my x509.conf on the ca minion matters in this case but here is a redacted/stripped down version (let me know if more is needed):

features:
  x509_v2: true
x509_signing_policies:
  web_clients:
    - minions: 'ca'
    - signing_private_key: 
    - signing_cert:        
    - basicConstraints:       'critical CA:false'
    - keyUsage:               'critical keyEncipherment'
    - extendedKeyUsage:       'serverAuth,clientAuth,emailProtection'
    - subjectKeyIdentifier:   'hash'
    - authorityKeyIdentifier: 'keyid,issuer:always'
    - days_valid:              90
    - copypath: 

Steps to Reproduce the behavior

[root@saltmaster01 srv]# salt ca state.apply temp.cert
/usr/lib/python3.11/site-packages/salt/utils/http.py:8: DeprecationWarning: 'cgi' is deprecated and slated for removal in Python 3.13
  import cgi
/usr/lib/python3.11/site-packages/salt/utils/jinja.py:9: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
ca:
----------
          ID: /tmp/test
    Function: file.directory
      Result: True
     Comment:
     Started: 14:20:48.456728
    Duration: 5.392 ms
     Changes:
              ----------
              /tmp/test:
                  ----------
                  directory:
                      new
----------
          ID: /tmp/test/www.key
    Function: x509.private_key_managed
      Result: True
     Comment: The private key has been created
     Started: 14:20:48.497420
    Duration: 1050.363 ms
     Changes:
              ----------
              created:
                  /tmp/test/www.key
----------
          ID: /tmp/test/www.key
    Function: file.managed
      Result: True
     Comment: File /tmp/test/www.key updated
     Started: 14:20:49.543980
    Duration: 3.595 ms
     Changes:
              ----------
              diff:
                  New file
              mode:
                  0400
----------
          ID: /tmp/test/www.crt
    Function: x509.certificate_managed
      Result: True
     Comment: The certificate has been created
     Started: 14:20:49.548358
    Duration: 1866.385 ms
     Changes:
              ----------
              created:
                  /tmp/test/www.crt
----------
          ID: /tmp/test/www.crt
    Function: file.managed
      Result: True
     Comment: File /tmp/test/www.crt updated
     Started: 14:20:51.409615
    Duration: 4.821 ms
     Changes:
              ----------
              diff:
                  New file
----------
          ID: /tmp/test/foo
    Function: file.managed
      Result: True
     Comment: File /tmp/test/foo updated
     Started: 14:20:51.414920
    Duration: 2.062 ms
     Changes:
              ----------
              diff:
                  New file

Summary for ca
------------
Succeeded: 6 (changed=6)
Failed:    0
------------
Total states run:     6
Total run time:   2.933 s
[root@saltmaster01 srv]# salt ca file.read /tmp/test/foo
/usr/lib/python3.11/site-packages/salt/utils/http.py:8: DeprecationWarning: 'cgi' is deprecated and slated for removal in Python 3.13
  import cgi
/usr/lib/python3.11/site-packages/salt/utils/jinja.py:9: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
ca:
    bar
[root@saltmaster01 srv]# salt ca file.replace /tmp/test/foo pattern="bar" repl="baz"
/usr/lib/python3.11/site-packages/salt/utils/http.py:8: DeprecationWarning: 'cgi' is deprecated and slated for removal in Python 3.13
  import cgi
/usr/lib/python3.11/site-packages/salt/utils/jinja.py:9: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
ca:
    ---
    +++
    @@ -1 +1 @@
    -bar
    +baz
[root@saltmaster01 srv]# salt ca file.read /tmp/test/foo
/usr/lib/python3.11/site-packages/salt/utils/http.py:8: DeprecationWarning: 'cgi' is deprecated and slated for removal in Python 3.13
  import cgi
/usr/lib/python3.11/site-packages/salt/utils/jinja.py:9: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
ca:
    baz
[root@saltmaster01 srv]# salt ca state.apply temp.cert
/usr/lib/python3.11/site-packages/salt/utils/http.py:8: DeprecationWarning: 'cgi' is deprecated and slated for removal in Python 3.13
  import cgi
/usr/lib/python3.11/site-packages/salt/utils/jinja.py:9: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
ca:
----------
          ID: /tmp/test/foo
    Function: file.managed
      Result: None
     Comment: The file /tmp/test/foo is set to be changed
              Note: No changes made, actual changes may
              be different due to other states.
     Started: 14:21:23.715606
    Duration: 18.918 ms
     Changes:
              ----------
              diff:
                  ---
                  +++
                  @@ -1 +1 @@
                  -baz
                  +bar

Summary for ca
------------
Succeeded: 6 (unchanged=1, changed=1)
Failed:    0
------------
Total states run:     6
Total run time:   1.921 s
[root@saltmaster01 srv]# salt ca file.read /tmp/test/foo
/usr/lib/python3.11/site-packages/salt/utils/http.py:8: DeprecationWarning: 'cgi' is deprecated and slated for removal in Python 3.13
  import cgi
/usr/lib/python3.11/site-packages/salt/utils/jinja.py:9: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
ca:
    baz

Expected behavior
file.managed works also after a x509.certificate_managed does not do changes

Versions Report

salt --versions-report ```yaml saltmaster01: Salt Version: Salt: 3006.1
Python Version:
        Python: 3.11.3 (main, Jun  5 2023, 09:32:32) [GCC 13.1.1 20230429]

Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: Not Installed
     docker-py: Not Installed
         gitdb: 4.0.10
     gitpython: 3.1.30
        Jinja2: 3.1.2
       libgit2: Not Installed
  looseversion: 1.2.0
      M2Crypto: 0.38.0
          Mako: Not Installed
       msgpack: 1.0.5
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 23.1
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.12.0
        pygit2: Not Installed
  python-gnupg: Not Installed
        PyYAML: 6.0
         PyZMQ: 25.1.0
        relenv: Not Installed
         smmap: 5.0.0
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: arch
        locale: utf-8
       machine: x86_64
       release: 6.3.7-arch1-1
        system: Linux
       version: Arch Linux

ca:
Salt Version:
Salt: 3006.1

Python Version:
        Python: 3.11.3 (main, Jun  5 2023, 09:32:32) [GCC 13.1.1 20230429]

Dependency Versions:
          cffi: 1.15.1
      cherrypy: Not Installed
      dateutil: Not Installed
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 3.1.2
       libgit2: Not Installed
  looseversion: 1.2.0
      M2Crypto: 0.38.0
          Mako: Not Installed
       msgpack: 1.0.5
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 23.1
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.12.0
        pygit2: Not Installed
  python-gnupg: Not Installed
        PyYAML: 6.0.1
         PyZMQ: 25.1.0
        relenv: Not Installed
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: arch
        locale: utf-8
       machine: x86_64
       release: 6.3.7-arch1-1
        system: Linux
       version: Arch Linux
</details>

**Additional context**
n/a
@Dr-Bone Dr-Bone added Bug broken, incorrect, or confusing behavior needs-triage labels Jul 31, 2023
@welcome
Copy link

welcome bot commented Jul 31, 2023

Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here’s some information that may help as you continue your Salt journey.
Please be sure to review our Code of Conduct. Also, check out some of our community resources including:

There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar.
If you have additional questions, email us at [email protected]. We’re glad you’ve joined our community and look forward to doing awesome things with you!

@Dr-Bone
Copy link
Author

Dr-Bone commented Jul 31, 2023

duplicate of #64195 sorry for the noise

@Dr-Bone Dr-Bone closed this as completed Jul 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug broken, incorrect, or confusing behavior needs-triage
Projects
None yet
Development

No branches or pull requests

1 participant