Hello,

In our setup we have two main repositories.
- One is a private repo that has our api keys, etc.  This is private to our company and we only want to allow the salt-master to have access to these files.
- The other is a public repo that holds our open source software.

** see example at bottom of this email

We are looking for an automated method to checkout a version of our git_code_repo (develop, production, etc), checkout the correlating git_config_repo submodule, and apply the resources.file variables to our templated config.yml file.

Now my gut thought would be to somehow get the git_config_repo into the pillar variables and then template that info into our config.yml file, but I suspect that the pillar data is compiled before the git_code_repo is checked out via the salt/sls files.

Can anyone help me understand what is possible given this requirement?  I have some written psuedo code below to help my explanation.

One thing that comes to mind is somehow having the pillar/sls file require a checkout of a git repository, but since pillar doesn't control folder states I don't see how that can happen.

thanks!


git_config_repo (private):
resources.file (has keywords to be applied to our config file for our deployment)
{
  SoftwareKey_production = 123
  SoftwareKey_development = 321
}


git_code_repo (open source):
config.yml
{
  API_KEY: {{ SoftwareKey_production if pillar["release"] == 'production' else SoftwareKey_development }}
}


Repo relationships (config release tied to a code release)
git_code_repo
 -- submodule:
   git_config_repo