Salt top.sls does not update on `salt-run fileserver.update` with gitfs

Question

I have a single salt minion connected to the salt master. I recently renamed a large .sls from 'webserver.sls' to 'jetty.sls'. I use a gitfs backend with pygit2 and ssh. I have only enabled the gitfs backend. /etc/salt/master:

fileserver_backend:
#  - roots
  - git

gitfs_provider: pygit2
gitfs_remotes:
  - [email protected]:Groomblecom/[repo].git:
    - pubkey: /root/salt-credentials/id_rsa.pub
    - privkey: /root/salt-credentials/id_rsa

However, whenever I run salt-run fileserver.update && salt '*' state.highstate I get an error:

Data failed to compile:
----------
    No matching sls found for 'webserver' in env 'base'

Running salt '*' state.show_sls jetty gives expected (long) output, consistent with what I see in the bitbucket repo. Running salt '*' state.show_top gives the following:

----------
    base:
        - common
        - ingress
        - webserver

This is inconsistent with the top.sls in the bitbucket repo:

base:
  '*':
    - common
  '*ingress*':
    - ingress
    - jetty
    - nginx

Running salt-run fileserver.update or rm -rf /var/cache/salt/* && service salt-master restart has no impact on the outputs.

I would like to know if there is a known bug (and workaround) for this behavior, if there is a way to force a real cache clear, or if I have made a configuration mistake.

Answer 1

The reason for the error is that salt considers all branches, then merges all (!) branches to compile the final top.sls. I had an old branch which was a couple commits behind master, and so still referenced webserver.sls. The solution is pretty simple: just add the following to /etc/salt/master:

gitfs_env_whitelist:
  - master

Or, if your primary branch isn't master, replace master with your branch name.

Answer 2

The reason is that salt merges all branches to compile the final top.sls. I was able to fix it by adding this to /etc/salt/master:

gitfs_env_whitelist:
  - base

Since Salt maps the master branch to the base environment (thanks to gitfs_base), the correct env to whitelist is base, not master.