It makes sense to backup the salt state to a git repo since there shouldn't be any sensitive data in there.
But what about the pillar data? Should I just create a separate git repo for that, or put it in an S3 bucket, or encrypt the data somehow?
3
-
2You can encrypt your pillar data with PGP and secure the key on your salt-master, so that your pillar data does not show private information in your git repository. Salt can render state files with a PGP renderer.– Vasili SyrakisMay 11, 2015 at 9:58
-
Nice, that is probably close to what I want.– syvexMay 11, 2015 at 15:33
-
Good to hear! I have put my comment down as an answer with more details for you.– Vasili SyrakisMay 12, 2015 at 0:41
Add a comment
|
1 Answer
You can encrypt your pillar data with GPG and secure the key on your salt-master, so that your pillar data does not show private information in your git repository.
Salt can render state files with a GPG renderer.
You can set something like this in your master configuration to enable the renderer:
renderer: jinja | yaml | gpg
An example format is as follows:
secret-data: |
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
hQEMAweRHKaPCfNeAQf9GLTN16hCfXAbPwU6BbBK0unOc7i9/etGuVc5CyU9Q6um
QuetdvQVLFO/HkrC4lgeNQdM6D9E8PKonMlgJPyUvC8ggxhj0/IPFEKmrsnv2k6+
cnEfmVexS7o/U1VOVjoyUeliMCJlAz/30RXaME49Cpi6No2+vKD8a4q4nZN1UZcG
RhkhC0S22zNxOXQ38TBkmtJcqxnqT6YWKTUsjVubW3bVC+u2HGqJHu79wmwuN8tz
m4wBkfCAd8Eyo2jEnWQcM4TcXiF01XPL4z4g1/9AAxh+Q4d8RIRP4fbw7ct4nCJv
Gr9v2DTF7HNigIMl4ivMIn9fp+EZurJNiQskLgNbktJGAeEKYkqX5iCuB1b693hJ
FKlwHiJt5yA8X2dDtfk8/Ph1Jx2TwGS+lGjlZaNqp3R1xuAZzXzZMLyZDe5+i3RJ
skqmFTbOiA==
=Eqsm
-----END PGP MESSAGE-----
You can also apply the renderer on a file-by-file basis by adding the following line to the top of any pillar with gpg data in it:
#!yaml|gpg
See the documentation here:
http://docs.saltstack.com/en/latest/ref/renderers/all/salt.renderers.gpg.html
answered May 12, 2015 at 0:40
