SaltStack salt-cloud event reactor driven orchestration for automatic complex minion initialization

new_cloud_minion.sls

## /salt/reactor/common/new_cloud_minion.sls
post_bootstrap_setup:
  runner.state.orchestrate:
    - mods: orch.selinux_relabel_reboot_highstate
    - pillar:
        event_tag: {{ tag }}
        event_data: {{ data }}

reactor.conf.yaml

## /etc/salt/master.d/reactor.conf
reactor:
  - 'salt/cloud/*/created':
    - /srv/salt/reactor/common/new_cloud_minion.sls

selinux_relabel_reboot_highstate.sls

## /srv/salt/orch/selinux_relabel_reboot_highstate.sls
{% set tag = salt.pillar.get('event_tag') %}
{% set data = salt.pillar.get('event_data') %}
{% set minion_name = data.get('name') %}
 
ping_minion:
  salt.function:
    - tgt: '{{ minion_name }}'
    - name: test.ping
  
set_selinux_permissive:
  salt.state:
    - tgt: '{{ minion_name }}'
    - sls:
      - selinux
    - require:
      - salt: ping_minion

getenforce_permissive:
  salt.function:
    - tgt: '{{ minion_name }}'
    - name: cmd.run
    - arg: ['getenforce && getenforce | grep permissive > /dev/null || echo SELinux not permissive']
    - watch:
      - salt: set_selinux_permissive
 
selinux_relabel_reboot:
  salt.function:
    - tgt: '{{ minion_name }}'
    - name: cmd.run
    - arg:
      - 'shutdown -r +1 SELinux relabel'
    - onfail:
      - salt: set_selinux_permissive
      - salt: getenforce_permissive
 
wait_for_reboots:
  salt.wait_for_event:
    - name: salt/minion/{{ minion_name }}/start
    - id_list:
      - {{ minion_name }}
    - watch:
      - salt: selinux_relabel_reboot
 
finish_setup:
  salt.state:
    - tgt: '{{ minion_name }}'
    - highstate: True
    - watch:
      - salt: wait_for_reboots

Thanks: Nate Brooks, for helping with this.