<p>You don't need to store in in a GPG message in order to include it in pillar.</p>
<p>Simply fetch the secret in the pillar template, for example:</p>
<pre class="lang-yaml prettyprint-override"><code>cert: '{{ salt[&quot;sdb.get&quot;](&quot;sdb://myvault/certs/&quot; ~ grains[&quot;id&quot;]) }}'
</code></pre>
<p>If only the master can fetch secrets from the vault, then pillar is the only way to securely deliver them to minions.</p>
<p>Note that if pillar caching is enabled, the result will be stored on-disk on the master (readable by the salt user). However, so are the credentials required to fetch the secret in the first place.</p>

CC BY-SA 4.0
2022-09-12T14:44:11.437Z
2022-09-12T16:08:48.633Z
2022-09-12T16:08:48.633Z
OrangeDog
<p>I am looking to understand how I can reduce duplication of secrets. For example SSL Certificates. I want to have the Salt Master pull the Certificate from a Secure Source (Azure Key Vault) and then 'share' that value with a targeted Minion(s).</p>
<p>I want to restrict Key Vault (Secret store) access to the Salt Master. What I have not been able to find out is how can I send or share that secret securely with the Minion. I am wanting to avoid the old school manner of storing the value in GPG messages.</p>

<salt><secret-management>
How can I pass a secret from a Salt Master to a Minion without using a Pillar?
Steven K7FAQ
# How can I pass a secret from a Salt Master to a Minion without using a Pillar?

(Asked by: username_0 on 2022-02-02)

I am looking to understand how I can reduce duplication of secrets. For example SSL Certificates. I want to have the Salt Master pull the Certificate from a Secure Source (Azure Key Vault) and then 'share' that value with a targeted Minion(s).

I want to restrict Key Vault (Secret store) access to the Salt Master. What I have not been able to find out is how can I send or share that secret securely with the Minion. I am wanting to avoid the old school manner of storing the value in GPG messages.

**Tags:** salt, secret-management


---

## 1 answers

### Answer by username_1 on 2022-09-12. Score: 0

You don't need to store in in a GPG message in order to include it in pillar.
Simply fetch the secret in the pillar template, for example:
cert: '{{ salt["sdb.get"]("sdb://myvault/certs/" ~ grains["id"]) }}'

If only the master can fetch secrets from the vault, then pillar is the only way to securely deliver them to minions.
Note that if pillar caching is enabled, the result will be stored on-disk on the master (readable by the salt user). However, so are the credentials required to fetch the secret in the first place.


---

