Salt: Can't delete key if another has the same name in accepted/rejected/denied

[epelc]

If you have 2 keys one that's accepted one that's denied with the same name there is no way to just delete one.

Is there a way to target just the denied key? It seems to only let you target based on the name.

root@salt:~# salt-key -d app-1
The following keys are going to be deleted:
Accepted Keys:
app-1
Denied Keys:
app-1
Proceed? [N/y] 

[jfindlay]

@epelc, this could be very useful, thanks for the report.

[epelc]

@jfindlay no problem.

I ended up just deleting the keys. Only required me to restart my minions and do a salt-key -A

[JensRantil]

Allright, did some digging into some issues related to this. My proposal here is that -d works with the list specifier --list. That is, given the list specifiers in #5330, deleting the denied key in the example of this issue would be done by issueing:

salt-key --list=denied -d app-1

What do you think of this?

[epelc]

Sounds like a good solution!

[jfindlay]

@JensRantil, I think that is a good solution as well. You are welcome to submit a pull request.

[danbudris]

Hi, was there ever a resolution to this?

[bobrik]

You can always just manually remove keys from /etc/salt/pki/master/minions_denied.

[danbudris]

Thanks!

On Apr 28, 2017 7:29 PM, "Ivan Babrou" [e-mail] wrote:

You can always just manually remove keys from
/etc/salt/pki/master/minions_denied.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/saltstack/salt/issues/27263#issuecomment-298129068,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ALMgaaBGogthFplv4tn9hzBAqKut4iPzks5r0nZdgaJpZM4GAipp
.

[rsaffi]

I also think this is pretty useful!
+1

[joe-niland]

Here's a workaround until the salt-key cli support this:

sudo salt-key --list rejected | grep -v 'Rejected Keys' | xargs -L 1 sudo salt-key -y -d

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

If this issue is closed prematurely, please leave a comment and we will gladly reopen the issue.

[TheVakman]

This comment is to keep this issue/feature request open. It would be good if Salt CLI supported this.

[philraj]

Until this is supported, after deleting the keys sharing the same name, restart the salt-minion service on the minion whose key you want to re-accept and it will re-announce its key.

service salt-minion restart