my combined top.sls

base:
  '*':
    - ssh
    - salt
  'G@roles:cms':
    - match: compound
    - cms
  'G@roles:cms and not G@env:prod':
    - match: compound
    - cms_creds
  'G@roles:trendbot':
    - match: compound
    - kafka
    - microservice
    
# these work in local file_roots mode, but fail to resolve in git pillar mode
# if I put them in a separate top.sls in the secrets repo, they work in git pillar mode but are ignored in file_roots mode.
  'G@env:prod':
    - match: compound
    - prod.aws
  'G@roles:salt-master and G@env:prod':
    - match: compound
    - prod.salt
  'G@roles:cms and G@env:prod':
    - match: compound
    - prod.cms

my ext_pillar config

ext_pillar:
  - git: master git@github-salt:sprightco/salt.git root=pillar
  - git: master git@github-secrets:sprightco/secrets.git root=pillar

my main pillar

other:salt [master] keith $ find pillar
pillar
pillar/cms.sls
pillar/cms_creds.sls
pillar/kafka.sls
pillar/microservice.sls
pillar/salt.sls
pillar/ssh.sls
pillar/top.sls

my secrets pillar

other:secrets [master] keith $ find pillar
pillar
pillar/prod
pillar/prod/aws.sls
pillar/prod/cms.sls
pillar/prod/salt.sls

my vagrant minion file

pillar_roots:
  base:
    - /srv/pillar/base    # mapped via config.vm.synced_folder "./pillar", "/srv/pillar/base"
    - /srv/pillar/secrets # mapped via config.vm.synced_folder "../secrets/pillar", "/srv/pillar/secrets"