(Fix #63636) terraform roster to use explicit priv value if defined in state

changelog/63636.fixed

@@ -0,0 +1 @@
+Explicit "priv" attribute in terraform state is now correctly used instead of overriden with default / fallback values.

salt/roster/terraform.py

@@ -124,7 +124,9 @@ def _add_ssh_key(ret):
     """
     Setups the salt-ssh minion to be accessed with salt-ssh default key
     """
-    priv = None
+    priv = ret.get("priv", None)
+    if priv and os.path.isfile(priv):
+        return  # Use roster_entry explicitly defined "priv"
     if __opts__.get("ssh_use_home_key") and os.path.isfile(
         os.path.expanduser("~/.ssh/id_rsa")
     ):

tests/pytests/unit/roster/terraform.data/ssh/salt-ssh-custom.rsa

@@ -0,0 +1 @@
+FAKE-SSH-KEY

tests/pytests/unit/roster/terraform.data/terraform-new-specific-priv.tfstate

@@ -0,0 +1,59 @@
+{
+    "version": 4,
+    "terraform_version": "1.2.3",
+    "serial": 1,
+    "lineage": "86545604-7463-4aa5-e9e8-a2a221de98d2",
+    "outputs": {},
+    "resources": [
+        {
+            "mode": "managed",
+            "name": "example",
+            "type": "salt_host",
+            "provider": "provider.libvrt",
+            "instances": [
+                {
+                    "schema_version": 1,
+                    "attributes": {
+                        "host": "192.168.122.106",
+                        "id": "web0",
+                        "passwd": "linux",
+                        "salt_id": "web0",
+                        "timeout": "22",
+                        "user": "root"
+                    }
+                },
+                {
+                    "schema_version": 1,
+                    "attributes": {
+                        "host": "192.168.122.107",
+                        "id": "web1",
+                        "passwd": "linux",
+                        "salt_id": "web1",
+                        "timeout": "22",
+                        "user": "root",
+                        "priv": "tests/pytests/unit/roster/terraform.data/ssh/salt-ssh-custom.rsa"
+                    }
+                }
+            ]
+        },
+        {
+            "mode": "managed",
+            "name": "example",
+            "type": "non_salt_host",
+            "provider": "provider.libvrt",
+            "instances": [
+                {
+                    "schema_version": 1,
+                    "attributes": {
+                        "host": "192.168.122.106",
+                        "id": "web0",
+                        "passwd": "linux",
+                        "salt_id": "web0",
+                        "timeout": "22",
+                        "user": "root"
+                    }
+                }
+            ]
+        }
+    ]
+}

tests/pytests/unit/roster/test_terraform.py

@@ -20,6 +20,12 @@ def roster_file_new():
     return pathlib.Path(__file__).parent / "terraform.data" / "terraform-new.tfstate"
 
 
+@pytest.fixture
+def roster_file_priv():
+    """ Fixture containing a specified "priv" argument. """
+    return pathlib.Path(__file__).parent / "terraform.data" / "terraform-new-specific-priv.tfstate"
+
+
 @pytest.fixture
 def pki_dir():
     return pathlib.Path(__file__).parent / "terraform.data"
@@ -154,6 +160,33 @@ def test_defaults_new_matching(pki_dir, roster_file_new):
         assert expected_result == ret
 
 
+def test_specified_priv(pki_dir, roster_file_priv):
+    """
+    Test the output of a fixture tfstate file which contains libvirt
+    resources using matching
+    """
+    expected_result = {
+        "web0": {
+            "host": "192.168.122.106",
+            "user": "root",
+            "passwd": "linux",
+            "timeout": 22,
+            "priv": str(pki_dir / "ssh" / "salt-ssh.rsa"),
+        },
+        "web1": {
+            "host": "192.168.122.107",
+            "user": "root",
+            "passwd": "linux",
+            "timeout": 22,
+            "priv": "tests/pytests/unit/roster/terraform.data/ssh/salt-ssh-custom.rsa",
+        },
+    }
+
+    with patch.dict(terraform.__opts__, {"roster_file": str(roster_file_priv)}):
+        ret = terraform.targets("*")
+        assert expected_result == ret
+
+
 def test_correct_handler_called_old():
     old_mock = patch.object(terraform, "_do__parse_old_state_file")
     new_mock = patch.object(terraform, "_do_parse_new_state_file")