Add support for using signed keys

README.md

@@ -13,6 +13,7 @@ For other methods to install SaltStack please refer to the [Official SaltStack I
 - [Configuration](#configuration)
   - [Custom Recipes](#custom-recipes)
   - [Minion Keys](#minion-keys)
+  - [Master Signed Keys](#master-signed-keys)
   - [Available Configuration Parameters](#available-configuration-parameters)
 - [Usage](#usage)
 - [Shell Access](#shell-access)
@@ -58,7 +59,7 @@ Alternatively, you can manually launch the `saltstack-master`  container:
 docker run --name salt_master --detach \
     --publish 4505:4505/tcp --publish 4506:4506/tcp \
     --env 'SALT_LOG_LEVEL=info' \
-    --read-only --volume ./srv/:/srv/ \
+    --read-only --volume $(pwd)/srv/:/srv/ \
     cdalvaro/saltstack-master:2018.3.2
 ```
 
@@ -76,16 +77,42 @@ Minion keys can be added automatically on startup to SaltStack master by mountin
 
 ```sh
 mkdir -p keys/minions
-cp -v /etc/salt/pki/minion/minion.pub keys/minions/minion1
+rsync root@minion1:/etc/salt/pki/minion/minion.pub keys/minions/minion1
 
 docker run --name salt_master -d \
     --publish 4505:4505/tcp --publish 4506:4506/tcp \
     --env 'SALT_LOG_LEVEL=info' \
-    --read-only --volume ./srv/:/srv/ \
-    --volume ./keys/:/etc/salt-docker/keys/ \
+    --volume $(pwd)/srv/:/srv/ \
+    --volume $(pwd)/keys/:/etc/salt-docker/keys/ \
     cdalvaro/saltstack-master:2018.3.2
 ```
 
+### Master Signed Keys
+
+It is possible to use signed master keys by establishing the environment variable `SALT_MASTER_SIGN_PUBKEY` to `True`.
+
+```sh
+docker run --name salt_stack --detach \
+    --publish 4505:4505/tcp --publish 4506:4506/tcp \
+    --env 'SALT_LOG_LEVEL=info' \
+    --env 'SALT_MASTER_SIGN_PUBKEY=True'
+    --volume $(pwd)/srv/:/srv/ \
+    --volume $(pwd)/keys/:/etc/salt-docker/keys/ \
+    cdalvaro/saltstack-master:2018.3.2
+```
+
+The container will create the `master_sign` key and its signature. More information about how to configure the minion service can be found [here](https://docs.saltstack.com/en/latest/topics/tutorials/multimaster_pki.html#prepping-the-minion-to-verify-received-public-keys).
+
+Additionally, you can generate new keys by executing the following command:
+
+```sh
+docker run --name salt_stack -it --rm \
+    --volume $(pwd)/keys/:/etc/salt-docker/keys/ \
+    cdalvaro/saltstack-master:2018.3.2 app:gen-signed-keys other_master_sign
+```
+
+The newly created keys will appear inside `keys/generated/other_master_sign` directory.
+
 ### Available Configuration Parameters
 
 Please refer the docker run command options for the `--env-file` flag where you can specify all required environment variables in a single file. This will save you from writing a potentially long docker run command. Alternatively you can use docker-compose.
@@ -94,8 +121,12 @@ Below is the list of available options that can be used to customize your SaltSt
 
 | Parameter | Description |
 |-----------|-------------|
-| `SALT_LOG_LEVEL` | The level of messages to send to the console. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: 'warning' |
-| `SALT_LEVEL_LOGFILE` | The level of messages to send to the log file. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: 'warning' |
+| `SALT_LOG_LEVEL` | The level of messages to send to the console. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: `warning` |
+| `SALT_LEVEL_LOGFILE` | The level of messages to send to the log file. One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'. Default: `warning` |
+| `SALT_MASTER_SIGN_PUBKEY` | Sign the master auth-replies with a cryptographic signature of the master's public key. Possible values: 'True' or 'False'. Default: `False` |
+| `SALT_MASTER_USE_PUBKEY_SIGNATURE` | Instead of computing the signature for each auth-reply, use a pre-calculated signature. This option requires `SALT_MASTER_SIGN_PUBKEY` set to 'True'. Possible values: 'True' or 'False'. Default: `True` |
+| `SALT_MASTER_SIGN_KEY_NAME` | The customizable name of the signing-key-pair without suffix. Default: `master_sign` |
+| `SALT_MASTER_PUBKEY_SIGNATURE` | The name of the file in the master's pki-directory that holds the pre-calculated signature of the master's public-key. Default: `master_pubkey_signature` |
 
 Any parameter not listed in the above table and available in the following [link](https://docs.saltstack.com/en/latest/ref/configuration/examples.html#configuration-examples-master), can be set by creating the directory `confs` and adding into it a `.conf` file with the desired parameters:
 
@@ -111,8 +142,8 @@ EOF
 docker run --name salt_master -d \
     --publish 3505:3505/tcp --publish 3506:3506/tcp \
     --env 'SALT_LOG_LEVEL=info' \
-    --read-only --volume ./srv/:/srv/ \
-    --volume ./confs/:/etc/salt-docker/confs/ \
+    --read-only --volume $(pwd)/srv/:/srv/ \
+    --volume $(pwd)/confs/:/etc/salt-docker/confs/ \
     cdalvaro/saltstack-master:2018.3.2
 ```