[3006.x] salt-ssh pillar fixes

changelog/59802.fixed.md

@@ -0,0 +1 @@
+Fixed merging of complex pillar overrides with salt-ssh states

changelog/60002.fixed.md

@@ -0,0 +1 @@
+Fixed gpg pillar rendering with salt-ssh

changelog/62230.fixed.md

@@ -0,0 +1 @@
+Made salt-ssh states not re-render pillars unnecessarily

changelog/65483.fixed.md

@@ -0,0 +1 @@
+Ensured the pillar in SSH wrapper modules is the same as the one used in template rendering when overrides are passed

salt/client/ssh/__init__.py

@@ -1196,9 +1196,11 @@ def run_wfunc(self):
                 for grain in self.target["grains"]:
                     opts_pkg["grains"][grain] = self.target["grains"][grain]
 
+            # Pillar compilation needs the master opts primarily,
+            # same as during regular operation.
             popts = {}
-            popts.update(opts_pkg["__master_opts__"])
             popts.update(opts_pkg)
+            popts.update(opts_pkg["__master_opts__"])
             pillar = salt.pillar.Pillar(
                 popts,
                 opts_pkg["grains"],

salt/client/ssh/state.py

@@ -31,10 +31,17 @@ class SSHState(salt.state.State):
     Create a State object which wraps the SSH functions for state operations
     """
 
-    def __init__(self, opts, pillar=None, wrapper=None, context=None):
+    def __init__(
+        self,
+        opts,
+        pillar_override=None,
+        wrapper=None,
+        context=None,
+        initial_pillar=None,
+    ):
         self.wrapper = wrapper
         self.context = context
-        super().__init__(opts, pillar)
+        super().__init__(opts, pillar_override, initial_pillar=initial_pillar)
 
     def load_modules(self, data=None, proxy=None):
         """
@@ -49,6 +56,28 @@ def load_modules(self, data=None, proxy=None):
         )
         self.rend = salt.loader.render(self.opts, self.functions)
 
+    def _gather_pillar(self):
+        """
+        The opts used during pillar rendering should contain the master
+        opts in the root namespace. self.opts is the modified minion opts,
+        containing the original master opts in __master_opts__.
+        """
+        _opts = self.opts
+        popts = {}
+        # Pillar compilation needs the master opts primarily,
+        # same as during regular operation.
+        popts.update(_opts)
+        popts.update(_opts.get("__master_opts__", {}))
+        # But, salt.state.State takes the parameters for get_pillar from
+        # the opts, so we need to ensure they are correct for the minion.
+        popts["id"] = _opts["id"]
+        popts["saltenv"] = _opts["saltenv"]
+        popts["pillarenv"] = _opts.get("pillarenv")
+        self.opts = popts
+        pillar = super()._gather_pillar()
+        self.opts = _opts
+        return pillar
+
     def check_refresh(self, data, ret):
         """
         Stub out check_refresh
@@ -69,10 +98,24 @@ class SSHHighState(salt.state.BaseHighState):
 
     stack = []
 
-    def __init__(self, opts, pillar=None, wrapper=None, fsclient=None, context=None):
+    def __init__(
+        self,
+        opts,
+        pillar_override=None,
+        wrapper=None,
+        fsclient=None,
+        context=None,
+        initial_pillar=None,
+    ):
         self.client = fsclient
         salt.state.BaseHighState.__init__(self, opts)
-        self.state = SSHState(opts, pillar, wrapper, context=context)
+        self.state = SSHState(
+            opts,
+            pillar_override,
+            wrapper,
+            context=context,
+            initial_pillar=initial_pillar,
+        )
         self.matchers = salt.loader.matchers(self.opts)
         self.tops = salt.loader.tops(self.opts)