Enable netapi_enable_clients in salt_master role (fix 400 Client disabled)#596
Merged
Conversation
Salt 3006+ disables all netapi clients by default, so salt-api returns "400 Client disabled: 'runner'" for every /run call even with valid PAM auth — breaking kri's salt-api control plane on every master it provisions. Enable exactly the clients kri uses (local, local_async, runner, wheel); external_auth still scopes the functions. Closes #595. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions
Bot
added
test
Coverage Report✅ 83.7% on Gate passed |
Coverage Report✅ 83.7% on Gate passed |
Coverage Report✅ 83.7% on Gate passed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #595.
Root cause (verified live on mm1)
Salt 3006+ disables all netapi clients by default. With valid creds:
POST /login(krisalt/PAM) → 200 + token ✅POST /run(runner test.ping) → 400Client disabled: 'runner'. Add to 'netapi_enable_clients'❌kri's
salt_masterrole never setnetapi_enable_clients, so salt-api's control plane (wheel key ops, runner status, local exec) is dead on every master kri provisions.Fix
kri-master.conf.j2now enables exactly the clients kri uses:local,local_async,runner,wheel. Theexternal_authACL continues to scope the actual functions (least privilege).Tests
test_netapi_enable_clients_595.py— asserts the four required clients are enabled and no extras.test_salt_master_playbook.pystill passes.Operational follow-up (mm1, one-time, out of scope)
Re-run the role —
scripts/kri saltmaster install 192.168.1.64— or add the key to/etc/salt/master.d/kri.confon mm1 and restart salt-api.🤖 Generated with Claude Code