Docs: mention key rejection as AES rotation trigger (re-auth thundering herd) - #70104
Conversation
Key rejection (salt-key -r) triggers AES key rotation just like key removal (salt-key -d), forcing all minions to re-authenticate. - Mention rejection alongside removal in the 'Too many minions re-authing' performance guide section - Add a warning to the salt-key CLI docs about the re-auth 'thundering herd' effect, linking back to the performance guide Fixes saltstack#63469
|
Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here's some information that may help as you continue your Salt journey. There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar. |
What does this PR do?
Documents that minion key rejection (
salt-key -r) triggers AES key rotation — just like key removal (salt-key -d) — causing all minions to re-authenticate with the master.Two documentation changes:
doc/topics/tutorials/intro_scale.rst, "Too many minions re-authing" section): now mentionsremoval/rejectionandsalt-key -ralongsidesalt-key -d, as suggested in the issue.doc/ref/cli/salt-key.rst): adds a prominent warning that deleting/rejecting keys rotates the AES publication key, which can cause a "thundering herd" of minion re-auths on large installations, with a backlink to the performance guide section (new:ref:targettoo-many-minions-re-authing).Note: the third location mentioned in the issue, the legacy
en/getstarted/system/communication.htmlpage ("Rotating security keys" section), no longer exists in this repository — the get-started docs were migrated to thesalt-user-guide/salt-install-guiderepos, whose security pages already describe key rotation. Happy to open a companion PR there if maintainers would like.What issues does this PR fix or reference?
Fixes #63469
Previous Behavior
The performance guide only mentioned master restart and key removal (
salt-key -d) as events that rotate the AES key; key rejection was not mentioned, and thesalt-keyreference carried no warning about the re-auth thundering-herd effect of key deletion/rejection.New Behavior
Rejection is documented as a rotation trigger in both the performance guide and the
salt-keyCLI docs (with a warning and cross-link).Merge requirements satisfied?
Commits signed with GPG?
No