Checking Salt keys

Confirm Salt keys after activating separated Python environment for Salt with the source activate_salt_env command.

Salt uses RSA keys for secure communication. If a minion's key is not accepted, the master cannot send it commands. This is a common issue when nodes are restarted or re-imaged.

Run these commands on the Salt master node.
Table 1. Salt keys
Command Description

salt-key -L

List all keys by category:
  • Accepted

    The key was accepted and the minion can communicate with the Salt master.

  • Unaccepted (Pending)

    The key is waiting to be accepted.

  • Denied

    The Salt master has automatically rejected the key. This occurs when:

    • a minion has a duplicate ID
    • when a minion was rebuilt
    • when a minion had new keys generated and the previous key was not deleted from the Salt master

    In this state the minion does not receive any communication from the Salt master.

salt-key -a <minion_id>

Accept a specific key. Moves a key from Unaccepted to Accepted.

salt-key -d <minion_id>

Delete a key. Use this if a node was deleted or if you see a Key Mismatch error.