Salt: Problem with salt-api and salt-ssh

[davidpsv17]

Hi,

I'm trying to use salt-ssh with salt-api and it didn't work.

When I execute the normal sentence it works:

salt-ssh 'MachineSSH' test.ping

But when I tried to run over salt-api appears an error:

david@david-PC:~$ curl -si localhost:9191/run -H 'Accept: application/x-yaml' -d client='ssh' -d tgt='MachineSSH' -d fun='test.ping'
HTTP/1.1 200 OK
Content-Length: 388
Access-Control-Expose-Headers: GET, POST
Vary: Accept-Encoding
Server: CherryPy/3.2.2
Allow: GET, HEAD, POST
Access-Control-Allow-Credentials: true
Date: Mon, 02 May 2016 07:55:40 GMT
Access-Control-Allow-Origin: *
Content-Type: application/x-yaml

return:
- MachineSSH:
    retcode: 254
    stderr: ''
    stdout: 'The host key needs to be accepted, to auto accept run salt-ssh with the
      -i flag:

      The authenticity of host ''192.168.254.2 (192.168.254.2)'' can''t be established.

      ECDSA key fingerprint is ad:27:39:e6:20:0a:3b:15:a7:82:b4:1c:e6:ba:4d:f0.

      Are you sure you want to continue connecting (yes/no)? '

I don't know how to pass "-i" flag via curl.

Can anyone help me please?

Thanks!

[jfindlay]

@davidpsv17, thanks for reporting. I'm not seeing any way for netapi to access salt or salt-ssh options at the command line level. My guess, @whiteinge can correct me if I'm wrong, is that it interacts with salt through LocalClient, which seems to be same API that the command line utils use, so if you need to setup the remote host key, you may have to accept it manually before running salt-ssh through the netapi client.

[whiteinge]

Short update: This uses SSHClient. It is not documented if that class has any runtime parameters to modify StrictHostKeyChecking. At quick glance it's pulling that setting from opts (the config file).

@jfindlay and I talked and he is checking with the salt-ssh authors on whether that parameter can be modified at runtime. If not, we'll need to make this into a feature addition.

[davidpsv17]

Thanks @jfindlay , @whiteinge . For the moment I solved this adding in the roster file the tag priv:

[rallytime]

@jfindlay Any update on this about whether or not this should be made into a feature request? Or is this resolved as-is?

[rallytime]

I'm closing this since I didn't hear back. If this needs to be re-opened, please let me know. Thanks!

[whiteinge]

@rallytime thanks for keeping up on this. This does indeed need a feature request. I filed the above-linked one just now.

cc @jfindlay

[jfindlay]

Thanks, @rallytime, @whiteinge. I must have missed this one.

[rallytime]

Perfect - thanks @whiteinge!

[xiaopanggege]

hi @davidpsv17 I have the same problem,Is there any good solution?

[whiteinge]

@xiaopanggege I think the only workaround for now is to make your own custom wrapper (will require a little Python-fu). The ssh Runner module is a good place to start, then edit the __opts__ dictionary to add the necessary params before instantiating.

[xiaopanggege]

@whiteinge Thanks，my solution is in master server add /root/.ssh/config:
cat /root/.ssh/config
Host *
StrictHostKeyChecking no

now is Skip this Warning notices