DeprecationWarning on salt-minion

Question

I have a salt-master (0.17.5) and a salt-minion (0.17.5) on two Debian machine (Debian 8 - Jessy).

When I launch this command salt '*' cp.get_file salt://file /file, I have this warning on my salt-minion :

[WARNING] /usr/lib/.../minion.py:594: Deprecation Warning: Master pub message signing is disabled but we received a signature for this message. Most likely this means that your masters and minions are not the same version...

Why I have this warning ?

Answer 1

I have resolved my problem !

It is necessary to use salt-cp '*' /file/src.txt /file/dest.txt instead of salt '*' cp.get_file salt://file/src.txt /file/dest.txt.

Answer 2

I also was seeing such warnings periodically in the minions logs. Unfortunately, they only popup from time to time, so reproducing them is a bit tricky. It seems, that they are specific to the 0.17.5 version only.

Here is the quote from the configuration file that explains where those warnings come from:

Signature verification on messages published from the master. This causes the master to cryptographically sign all messages published to its event bus, and minions then verify that signature before acting on the message.

This is False by default.

Note that to facilitate interoperability with masters and minions that are different versions, if sign_pub_messages is True but a message is received by a minion with no signature, it will still be accepted, and a warning message will be logged.

Conversely, if sign_pub_messages is False, but a minion receives a signed message it will be accepted, the signature will not be checked, and a warning message will be logged. This behavior will go away in Salt 0.17.6 (or Hydrogen RC1, whichever comes first) and these two situations will cause minion to throw an exception and drop the message.

sign_pub_messages: False

Since I've changed configuration to:

sign_pub_messages: True

I haven't seen those warnings in the logs anymore(but see the remark on reproducing).