Ensure pki dir is in correct state and change modes for consul certs

app/consul/ca.sls

@@ -6,13 +6,13 @@
   file.directory:
     - user: {{ salt.pillar.get("consul:user", "root") }}
     - group: {{ salt.pillar.get("consul:group", "root") }}
-    - dir_mode: 0700
-    - file_mode: 0700
+    - dir_mode: 0660
+    - file_mode: 0660
     - makedirs: true
 
 {{ ca_path | path_join("certificate.pem") }}:
   file.managed:
     - user: {{ salt.pillar.get("consul:user", "root") }}
     - group: {{ salt.pillar.get("consul:group", "root") }}
-    - mode: 0700
+    - mode: 0660
     - contents_pillar: "consul:tls:ca:certificate"

app/consul/tls.sls

@@ -19,14 +19,14 @@ include:
   file.managed:
     - user: {{ salt.pillar.get("consul:user", "root") }}
     - group: {{ salt.pillar.get("consul:group", "root") }}
-    - mode: 0700
+    - mode: 0660
     - contents_pillar: "consul:tls:client:certificate"
 
 {{ consul_key_file }}:
   file.managed:
     - user: {{ salt.pillar.get("consul:user", "root") }}
     - group: {{ salt.pillar.get("consul:group", "root") }}
-    - mode: 0700
+    - mode: 0660
     - contents_pillar: "consul:tls:client:key"
 
 {% elif "consul_server" in grains["roles"] -%}
@@ -35,14 +35,14 @@ include:
   file.managed:
     - user: {{ salt.pillar.get("consul:user", "root") }}
     - group: {{ salt.pillar.get("consul:group", "root") }}
-    - mode: 0700
+    - mode: 0660
     - contents_pillar: "consul:tls:server:certificate"
 
 {{ consul_key_file }}:
   file.managed:
     - user: {{ salt.pillar.get("consul:user", "root") }}
     - group: {{ salt.pillar.get("consul:group", "root") }}
-    - mode: 0700
+    - mode: 0660
     - contents_pillar: "consul:tls:server:key"
 
 {% endif %}

base/files.sls

@@ -7,6 +7,15 @@
     - group: root
     - mode: 0744
 
+# /etc/pki is a directory that any application should be able to store their sensitive
+# PKI things in, which means any user should be able to read the basedir contents, but
+# not necessarily the inner contents beyond that.
+/etc/pki:
+  file.directory:
+    - user: root
+    - group: root
+    - mode: 0644
+
 logdna root tls certificate:
   file.managed:
     - name: /etc/ld-root-ca.crt