From 0b644b6f7b58c92c81c802b983f24603e24dac81 Mon Sep 17 00:00:00 2001
From: Georg Pfuetzenreuter
Date: Thu, 1 Jun 2023 14:40:08 +0200
Subject: Support multi-master

Read an optional configuration file to accept keys on a secondary
master.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
---
 salt-keydiff.sh | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 54 insertions(+), 2 deletions(-)

(limited to 'salt-keydiff.sh')

diff --git a/salt-keydiff.sh b/salt-keydiff.sh
index a6c66e0..324d0ad 100755
--- a/salt-keydiff.sh
+++ b/salt-keydiff.sh
@@ -12,9 +12,12 @@
 
 set -Ceu
 
+config='/etc/salt-scriptconfig'
+partner='null'
 minion="${1:-null}"
 key_user="${2:-null}"
 NOCOLOR="$(tput sgr0)"
+exco=0
 
 if ! command -v jq >/dev/null || ! command -v salt-key >/dev/null
 then
@@ -22,6 +25,16 @@ then
 	exit 1
 fi
 
+if [ -f "$config" ]
+then
+	# shellcheck source=/dev/null
+	. "$config"
+	if [ ! "$partner" = 'null' ]
+	then
+		ssh_key="${ssh_key:?Configuration option 'partner' requires 'ssh_key'}"
+	fi
+fi
+
 if [ "$minion" = 'null' ]
 then
 	printf 'Please specify the minion to diff against.\n'
@@ -36,8 +49,20 @@ then
 	exit 2
 fi
 
+if [ ! "$partner" = 'null' ]
+then
+	key_salt_remote="$(ssh -qi "$ssh_key" "$partner" salt-key --out json -f "$minion" | jq --arg minion "$minion" -r '.minions_pre[$minion]')"
+	
+	if [ ! "$key_salt" = "$key_salt_remote" ]
+	then
+		printf 'Local and remote keys do not match, bailing out.\n'
+		exit 2
+	fi
+fi
+
 if [ "$key_user" = 'null' ]
 then
+	# shellcheck disable=SC2016
 	printf 'Enter fingerprint to diff against (run `salt-call --local key.finger` on the minion)\n'
 	read -r key_user
 fi
@@ -46,10 +71,37 @@ if [ "$key_salt" = "$key_user" ]
 then
 	GREEN="$(tput setaf 2)"
 	printf '%sMatches%s\n' "$GREEN" "$NOCOLOR"
-	salt-key --out=yaml -a "$minion"
+	printf 'Accept? (y/n)\n'
+	read -r answer
+	if [ "$answer" = 'y' ]
+	then
+		if salt-key --out=quiet -yqa "$minion" >/dev/null
+		then
+			printf 'Accepted on local master\n'
+		else
+			printf 'Failed to accept key on local master\n'
+			exco=1
+		fi
+
+		if [ ! "$partner" = 'null' ]
+		then
+			if ssh -qi "$ssh_key" "$partner" salt-key --out=quiet -yqa "$minion" >/dev/null
+			then
+				printf 'Accepted on remote master\n'
+			else
+				printf 'Failed to accept key on remote master\n'
+				exco=1
+			fi
+		fi
+	else
+		printf 'Bye\n'
+		exco=2
+	fi
 elif [ ! "$key_salt" = "$key_user" ]
 then
 	RED="$(tput setaf 1)"
 	printf '%sMismatch%s\n' "$RED" "$NOCOLOR"
-	exit 2
+	exco=2
 fi
+
+exit "$exco"
-- 
cgit v1.2.3