Merge pull request saltstack#39252 from gtmanfred/extmod_whitelist

Allow specifying which modules should be used when running saltutil.sync_*

doc/ref/configuration/master.rst

@@ -245,6 +245,40 @@ each of Salt's module types such as ``runners``, ``output``, ``wheel``,
 
     extension_modules: /root/salt_extmods
 
+``extmod_whitelist``
+--------------------
+
+.. versionadded:: Nitrogen
+
+By using this dictionary, the modules that are synced to the master's extmod cache using `saltutil.sync_*` can be
+limited.  If nothing is set to a specific type, then all modules are accepted.  To block all modules of a specific type,
+whitelist an empty list.
+
+.. code-block:: yaml
+
+    extmod_whitelist:
+      modules:
+        - custom_module
+      engines:
+        - custom_engine
+      pillars: []
+
+Valid options:
+  - modules
+  - states
+  - grains
+  - renderers
+  - returners
+  - output
+  - proxy
+  - runners
+  - wheel
+  - engines
+  - queues
+  - pillar
+  - utils
+  - sdb
+
 .. conf_master:: module_dirs
 
 ``module_dirs``

doc/ref/configuration/minion.rst

@@ -1197,6 +1197,38 @@ below.
     providers:
       service: systemd
 
+``extmod_whitelist``
+--------------------
+
+.. versionadded:: Nitrogen
+
+By using this dictionary, the modules that are synced to the minion's extmod cache using `saltutil.sync_*`can be
+limited.  If nothing is set to a specific type, then all modules are accepted.  To block all modules of a specific type,
+whitelist an empty list.
+
+.. code-block:: yaml
+
+    extmod_whitelist:
+      modules:
+        - custom_module
+      engines:
+        - custom_engine
+      pillars: []
+
+Valid options:
+  - beacons
+  - sdb
+  - modules
+  - states
+  - grains
+  - renderers
+  - returners
+  - proxy
+  - engines
+  - output
+  - utils
+  - pillar
+
 
 Top File Settings
 =================
@@ -1416,6 +1448,10 @@ enabled and can be disabled by changing this value to ``False``.
 
     clean_dynamic_modules: True
 
+.. note::
+
+    If ``extmod_whitelist`` is specified, modules which are not whitelisted will also be cleaned here.
+
 .. conf_minion:: environment
 
 ``environment``

salt/config/__init__.py

@@ -992,6 +992,9 @@ def _gather_buffer_space():
     # Controls whether the scheduler is set up before a connection
     # to the master is attempted.
     'scheduler_before_connect': bool,
+
+    # Whitelist specific modules to be synced
+    'extmod_whitelist': dict,
 }
 
 # default configurations
@@ -1248,6 +1251,7 @@ def _gather_buffer_space():
     'beacons_before_connect': False,
     'scheduler_before_connect': False,
     'cache': 'localfs',
+    'extmod_whitelist': {},
 }
 
 DEFAULT_MASTER_OPTS = {
@@ -1527,6 +1531,8 @@ def _gather_buffer_space():
     'thin_extra_mods': '',
     'min_extra_mods': '',
     'ssl': None,
+    'extmod_whitelist': {},
+    'clean_dynamic_modules': True,
 }