Note security concerns with grains for targeting #59197
Conversation
Given that Vault is used for managing secrets, it seems useful to remind people that grains are generally minion-controlled when talking about using them to assign policies (and consequently give access to secrets). This is related to saltstack#43287, though only warns people of the issue, rather than resolving it by adding (eg) Pillar-based targeting. This change also cleans up some nearby style and formatting issues with the docs.
|
Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here’s some information that may help as you continue your Salt journey.
There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar. |
|
It looks like this is not yet merged -- is there anything I should be doing to push it along? |
|
Congratulations on your first PR being merged! 🎉 |
What does this PR do?
Given that Vault is used for managing secrets, it seems useful to remind
people that grains are generally minion-controlled when talking about
using them to assign policies (and consequently give access to secrets).
This is related to #43287, though only warns people of the issue, rather
than resolving it by adding (eg) Pillar-based targeting.
This change also cleans up some nearby style and formatting issues with
the docs.
What issues does this PR fix or reference?
Related to: #43287 (though that issue suggests Pillar-based targeting, which this doesn't attempt)
Merge requirements satisfied?
[NOTICE] Bug fixes or features added to Salt require tests.
Commits signed with GPG?
No
Please review Salt's Contributing Guide for best practices.
See GitHub's page on GPG signing for more information about signing commits with GPG.