How to use GPG encrypted YAML in your Salt configuration
search cancel

How to use GPG encrypted YAML in your Salt configuration

book

Article ID: 390800

calendar_today

Updated On:

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Some integrations with Salt, like GitFS, require storing sensitive secret data as part of the Salt master configuration in order for the Salt master to access those resources. These secrets should be stored and retrieved securely. Storing plaintext credentials for authentication poses a security risk. To mitigate this, Salt provides SDB as a mechanism aimed at retrieving secrets securely. There are multiple integrations available, but we will use GPG-encrypted YAML in this example. See the SaltProject SDB documentation for more information (See link in additional information). This guide provides a step-by-step process to encrypt the Git password and integrate it into Salt's configuration.

Environment

Aria Config - all versions

Tanzu Salt - all versions

SaltProject - all versions

Resolution

  1. Install dependencies.
    1. Install GnuGPG and RNG: 
      sudo yum install -y gnupg rng-tools
    2. Start RNG daemon: 
      sudo systemctl start rngd
sudo systemctl enable rngd
  2. Create a phrase-less key for the Salt master.
    1. If a phrase-less key is not used, the phrase will need to be entered each time the Salt master is started.
    2. Create GPG directory.

      We'll store the GPG keyring under the Salt master configuration directory to help ensure it is accessible by the Salt master.

      sudo mkdir -p /etc/salt/pki/gpg
sudo chown -R $(whoami):$(whoami) /etc/salt/pki/gpg
sudo chmod 700 /etc/salt/pki/gpg
    3. Create the key. 
      gpg --homedir=/etc/salt/pki/gpg --gen-key
      • Choose RSA key
      • Key size 2048
      • Key should not expire
      • Put "Salt Master" for real name
      • Leave email address blank
      • No passphrase
    4. Find and Export the GPG Key.

      Run the following command to list keys in your keyring and identify the <key_id>:

      gpg --homedir=/etc/salt/pki/gpg --list-keys

      Look for the string after pub (e.g., rsa2048/1234ABCD) where 1234ABCD is your <key_id>.

    5. Export the GPG Key. 
      gpg --homedir=/etc/salt/pki/gpg --armor --export <key_id> > /etc/salt/pki/gpg/public.key
gpg --homedir=/etc/salt/pki/gpg --armor --export-secret-key <key_id> > /etc/salt/pki/gpg/private.key
    6. Encrypt the Git Password and Store in YAML. 
      echo -n "my_git_password" | gpg --homedir=/etc/salt/pki/gpg --armor --encrypt -r <key_id>
    7. Store Encrypted Password in YAML.

      Use the example content below to create a git_secrets.yaml file.

      git_password:
  gpg: |
    -----BEGIN PGP MESSAGE-----
    <encrypted_password_here>
    -----END PGP MESSAGE-----

      This file can live in any secure directory accessible by the Salt master. It is not a direct part of the Salt master configuration.

    8. Configure the GPG key integration in the Salt master configuration.

      This info is probably best placed near the GitFS configuration, but can be placed in any file ending with a .conf file extension under the /etc/salt/master.d directory.

      gpg_keydir: /etc/salt/pki/gpg
gpg_keyname: <key_id>
gpg_decrypt: true
    9. Update the Salt master configuration to point to the new GPG encrypted data.

      Add a configuration section similar to the following:

      gpg_keydir: /etc/salt/pki/gpg
gpg_keyname: <INSERT YOUR KEY NAME HERE>

local-crypt: # Can be named anything the user wants, but is how the backend will be referenced
  driver: yaml
  files:
    - /srv/sdb/testing.yaml
    - /srv/sdb/git_secrets.yaml
  gpg: True
    10. Configure GitFS to Use the Encrypted Password. 
      gitfs_remotes:
  - https://your.git.repo/url:
    - user: your_git_user
    - password: sdb://local-crypt/git_password  # Ensure this references the SDB profile defined in the previous step
    11. Fully stop and then start the Salt master to ensure the new configuration is loaded. 
      sudo systemctl stop salt-master
sudo systemctl start salt-master
    12. Verify the backend operation.

      Run the following sample command to test the backend and verify that things are operating as expected:

      salt-run -l debug sdb.get 'sdb://local-crypt/git_password'

Assuming the Salt master starts successfully, you now have a GPG encrypted secret that is retrievable by the Salt master.

Additional Information

Powered by Wolken Software