How can I pass a secret from a Salt Master to a Minion without using a Pillar?

Question

I am looking to understand how I can reduce duplication of secrets. For example SSL Certificates. I want to have the Salt Master pull the Certificate from a Secure Source (Azure Key Vault) and then 'share' that value with a targeted Minion(s).

I want to restrict Key Vault (Secret store) access to the Salt Master. What I have not been able to find out is how can I send or share that secret securely with the Minion. I am wanting to avoid the old school manner of storing the value in GPG messages.

Answer 1

You don't need to store in in a GPG message in order to include it in pillar.

Simply fetch the secret in the pillar template, for example:

cert: '{{ salt["sdb.get"]("sdb://myvault/certs/" ~ grains["id"]) }}'

If only the master can fetch secrets from the vault, then pillar is the only way to securely deliver them to minions.

Note that if pillar caching is enabled, the result will be stored on-disk on the master (readable by the salt user). However, so are the credentials required to fetch the secret in the first place.