Salt minion returns no response after being accepted

Question

After setting up the salt-master and one minion, I am able to accept the key on the master. Running sudo salt-key -L shows that it is accepted. However, when I try the test.ping command, the master shows:

Minion did not return. [No response]

On the master, the log shows:

[ERROR ][1642] Authentication attempt from minion-01 failed, the public key in pending did not match. This may be an attempt to compromise the Salt cluster.

On the minion, the log shows:

[ERROR ][1113] The Salt Master has cached the public key for this node, this salt minion will wait for 10 seconds before attempting to re-authenticate

I have tried disconnecting and reconnecting, including rebooting both boxes in between.

Answer 1

Minion did not return. [No response]

Makes me think the salt-minion process is not running. (those other two errors are expected behavior until you accepted the key on the master)

Check if salt-minion is running with (depending on your OS) something like

$ systemctl status salt-minion

or

$ service salt-minion status

If it was not running, start it and try your test again.

$ sudo systemctl start salt-minion

or

$ sudo service salt-minion start

Depending on your installation method, the salt-minion may not have been registered to start upon system boot, and you may run into this issue again after a reboot.

Now, if your salt-minion was in fact running, and you are still getting No response, I would stop the process and restart the minion in debug so you can watch.

$ sudo systemctl stop salt-minion
$ sudo salt-minion -l debug

Another quick test you can run to test communication between your minion and master is to execute your test from the minion:

$ sudo salt-call test.ping

salt-call does not need the salt-minion process to be running to work. It fetches the states from the master and executes them ad hoc. So, if that works (returns

local:
    True

) you can eliminate the handshake between minion and master as the issue.

Answer 2

If you are confident that you are connecting to a valid Salt Master, then remove the master public key and restart the Salt Minion. The master public key can be found at: /etc/salt/pki/minion/minion_master.pub

Answer 3

I just hit this problem when moving the salt master to a new server, to fix it I had to do these things in this order (Debian 9):

root@minion:~# service salt-minion stop
root@master:~# salt-key -d minion
root@minion:~# rm /etc/salt/pki/minion/minion_master.pub
root@minion:~# service salt-minion start
root@master:~# salt-key -a minion

Please note the minion/master servers above.

Answer 4

Minion's public key position under master is /etc/salt/pki/master/minions

Just compare it with the minions own public key(under /etc/salt/pki/minion/minion.pub)

If it is not the same, excute salt-key -d * to delete the public key of minion from master, then excute service salt-minion restart to restart salt minion on the minion client. After this, Master can control the minion.