salt-ssh should build a simple tunnel to forward zeromq between a local temporary master and a remote temporary minion

[baby-gnu]

Is your feature request related to a problem? Please describe.

It's not possible to use several standard feature of salt with salt-ssh:

• jinja TemplateNotFound:
  • salt-ssh jinja TemplateNotFound  #9878
  • Jinja import cannot be referenced by any valid path from managed file deployed with salt-ssh #19564
  • TemplateNotFound: salt/formulas.jinja when running salt-ssh #21370
  • salt-ssh not providing jinja file for salt-formula #26585
• gitfs not working
  • Cannot use gitfs with salt-ssh #23576

Describe the solution you'd like

The salt-ssh command tunneled a full master / minion connexion using zeromq:

• start a local master:
  • listen on 127.0.0.1
  • random publish_port
  • random ret_port
• open a connexion to a minion with SSH
  • transfert master ports locally:
    • listen on the minion 127.0.0.1
    • random publish_port on the minion piped to master random publish_port
    • random ret_port on the minion piped to master random ret_port
  • start a temporary minion with the proper options to contact the temporary master
    • master is 127.0.0.1 to reach the local endpoint of the tunnel
    • master_port is local random ret_port
    • publish_port is local random publish_port

Describe alternatives you've considered

None.

Additional context

Please Note
If this feature request would be considered a substantial change or addition, this should go through a SEP process here https://github.com/saltstack/salt-enhancement-proposals, instead of a feature request.

[baby-gnu]

As I'm not sure it's a substantial change, I open this feature request.

Tell me if you prefer an issue in https://github.com/saltstack/salt-enhancement-proposals.

Regards.

[Ch3LL]

There is this project https://gitlab.com/saltstack/pop/heist that will solve this problem :)

[baby-gnu]

There is this project https://gitlab.com/saltstack/pop/heist that will solve this problem :)

In one use case, I have several users connecting to a salt-ssh machine where everything is in place for them to call salt-ssh as users.

I may miss something but heist seems to require a salt-master service running.

Regards.