Decrypt gpg data in salt masterless
You must copy gpgkeys from salt master to masterless minion If you encrypt data with gpg in salt master.
If gpgkeys is located in /etc/salt/gpgkeys/
in the salt master(default),
you need to copy it to the same path(default) or some place you defined by config file in the masterless minion.
root@salt-master:~# ll /etc/salt/gpgkeys/
total 28
drwx------ 2 root root 4096 Sep 4 2015 ./
drwxr-xr-x 9 root root 4096 Jun 22 23:31 ../
-rw------- 1 root root 1194 Sep 4 2015 pubring.gpg
-rw------- 1 root root 600 Jun 30 03:33 random_seed
-rw------- 1 root root 2495 Sep 4 2015 secring.gpg
-rw------- 1 root root 1280 Sep 4 2015 trustdb.gpg
And you also have to be careful about the permisson when you download it.
If ssh user is not root, /etc/salt/gpgkeys/
is owned by root and you use sftp to download it, you can’t download the directory.
$ sftp salt_master
Connected to salt_master.
sftp> get -r /etc/salt/gpgkeys
Fetching /etc/salt/gpgkeys/ to gpgkeys
Retrieving /etc/salt/gpgkeys
remote readdir("/etc/salt/gpgkeys"): Permission denied
/etc/salt/gpgkeys: Failed to get directory contents
So I copied the directory to a temporary directory which permisson is appropriate for the ssh user to download, and change the owner of the copied directory to the ssh user to download it correctly.
Then I could download it successfully with sftp.