It makes sense to backup the salt state to a git repo since there shouldn't be any sensitive data in there.
But what about the pillar data? Should I just create a separate git repo for that, or put it in an S3 bucket, or encrypt the data somehow?
It makes sense to backup the salt state to a git repo since there shouldn't be any sensitive data in there.
But what about the pillar data? Should I just create a separate git repo for that, or put it in an S3 bucket, or encrypt the data somehow?
You can encrypt your pillar data with GPG and secure the key on your salt-master, so that your pillar data does not show private information in your git repository.
Salt can render state files with a GPG renderer.
You can set something like this in your master configuration to enable the renderer:
renderer: jinja | yaml | gpg
An example format is as follows:
secret-data: |
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
hQEMAweRHKaPCfNeAQf9GLTN16hCfXAbPwU6BbBK0unOc7i9/etGuVc5CyU9Q6um
QuetdvQVLFO/HkrC4lgeNQdM6D9E8PKonMlgJPyUvC8ggxhj0/IPFEKmrsnv2k6+
cnEfmVexS7o/U1VOVjoyUeliMCJlAz/30RXaME49Cpi6No2+vKD8a4q4nZN1UZcG
RhkhC0S22zNxOXQ38TBkmtJcqxnqT6YWKTUsjVubW3bVC+u2HGqJHu79wmwuN8tz
m4wBkfCAd8Eyo2jEnWQcM4TcXiF01XPL4z4g1/9AAxh+Q4d8RIRP4fbw7ct4nCJv
Gr9v2DTF7HNigIMl4ivMIn9fp+EZurJNiQskLgNbktJGAeEKYkqX5iCuB1b693hJ
FKlwHiJt5yA8X2dDtfk8/Ph1Jx2TwGS+lGjlZaNqp3R1xuAZzXzZMLyZDe5+i3RJ
skqmFTbOiA==
=Eqsm
-----END PGP MESSAGE-----
You can also apply the renderer on a file-by-file basis by adding the following line to the top of any pillar with gpg data in it:
#!yaml|gpg
See the documentation here:
http://docs.saltstack.com/en/latest/ref/renderers/all/salt.renderers.gpg.html