saltstack/salt — pull request #14370 by felskrone (2014-07-21 17:56:04+00:00)
Title: Keystore abstraction

Currently salt stores its keys on the salt-master in the pki-directories. In Mutlimaster-(PKI)-Modes, that requires a shared keystore over all salt-masters to have the keystore always in sync. A shared-storage for multiple servers adds a lot of complexity and also requires even more complex failover-strategies for desaster-scenarios.
A keystore abstracted from the salt-master-service and implemented (for example) in a redis-database would make such a setup a lot easier.

This is a first approach to abstract the keystore from the master itself and make it more modular. The goal is to have various keystores like redis, mysql, etc. while still keeping the default local file-keystore for zeromq and raet (which could of course also be moved to a keystore-module).

While this PR only extends salt-key to query a sample mysql-keystore-module, the salt-master would of course also be extended to query the same keystore for auth-requests, etc.

This is not intended as a real PR yet. Its more a request for comments, if this is something that would be welcomed by the salt-developers and if the approach is in a way thats acceptable.