Separating a secret pillar repository, and spreading SSL certificates among hosts.

etc-salt-master-d-pillars.conf

## in /etc/salt/master.d/pillars.conf

pillar_roots:
  base:
    - /srv/pillar
    - /srv/private/pillar

pillar-top.sls

## In /srv/pillar/top.sls

base:
  'db*':
    - backup
    - rsync.shares
    - rsync.backup
    - monitor.db
    - mysql
  'db1*':
    - mysql.db1   # Each db host has its own file that way

private-pillar-mysql-init.sls

## In /srv/private/pillar/mysql/init.sls

mysql:
  ssl:
    ca-cert.pem: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----
    ca-key.pem: |
      -----BEGIN RSA PRIVATE KEY-----
      ...
      -----END RSA PRIVATE KEY-----

{% if grains['host'] == 'db8' %}
    server.pem: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----
{% endif %}

salt-mysql-certificates.sls

## In /srv/salt/mysql/certificates.sls:

/etc/mysql/certs:
  file.managed:
    - user: mysql
    - group: mysql
    - mode: 750

/etc/mysql/server.pem:
  file.managed:
    - user: mysql
    - group: mysql
    - mode: 640
    - contents: {{ salt['pillar.get']('mysql:ssl:server.pem') }}

/etc/mysql/ca-key.pem:
  file.managed:
    - user: mysql
    - group: mysql
    - mode: 640
    - contents: {{ salt['pillar.get']('mysql:ssl:ca-key.pem') }}

/etc/mysql/ca-cert.pem:
  file.managed:
    - user: mysql
    - group: mysql
    - mode: 640
    - contents: {{ salt['pillar.get']('mysql:ssl:ca-cert.pem') }}

I made a better version here: https://gist.github.com/renoirb/7728455