Currently the CI job fails with module not found errror.
AttributeError: 'module' object has no attribute 'check_refresh

The reason is new version of salt tries to call
salt.utils.pkg.check_refresh which is not available in 2016.11.3 but is
available in 2016.11.6.
Reference:
1. https://github.com/saltstack/salt/blob/v2016.11.3/salt/states/pkg.py
2. https://github.com/saltstack/salt/blob/v2016.11.6/salt/states/pkg.py#L1819

The fix proposed here is to use pkg.installed instead of pkg.latest.
It's not a good idea to always update salt whenever the salt state is
run, this may introduce failures unknown to the user. There is a pipeline
to update packages which should be used for updating to latest.
pkg.latest generally isn't a good way to write idempotent formulas. See
official salt docs: "Generally it is better for the installed function
to be used, as latest will update the package whenever a new package is
available."

Change-Id: I8da5c36c1613e54768993080f2514afc920c49f8

Optimize 'noservices' condition

Change-Id: I9e48e113656dd9f1ce644e98650276b36e444009

1. Remove implicit creation of "local_trusted_symlink".
   To install a system-wide certificates the linux.system.cert
   state or 'trusted_ca_minion' option must be used.

2. A ca-cert file may exist on a file-system and
   not be pulled from mine. So, in this case
   the following state be incorrect:

   - watch:
     - x509: ca_file

   To support this case, we need to replace `watch` statement
   with `watch_in`.

Change-Id: If41d050b56913d72da1ef7981f30780fec5d6d95

Change-Id: I3f8ada34bf7e6e356bf6805d98eb0fa4bd66d8d3

Salt master service name

Change-Id: If674097ad41df6118ffede78e02d143d5b8c9e6d

Change-Id: Ie6cf0a8361524b594b60119b25f6d336b6797ece

Update readme trusted_ca_minions

This reverts commit 6b2a592dc9.

SOA relations modeling

Change-Id: Icd6334902ca47d83ae263905d65ef91b8e6a7335

1:
In case of trust_salt_ca usage, the salt.minion.cert state
generates broken certs body due to a space replacing:

-----BEGINCERTIFICATE-----
  MIIFzzCCA7egAwIBAgIITiyuuFgl1S4wDQYJKoZIhvcNAQELBQAwSjELMAkGA1UE
  BhMCY3oxFzAVBgNVBAMMDlNhbHQgT
  ....

To fix it the "x509.pem_managed" is used.

2:
If a symlink to CA cert is already exists, then the state is failing.
The force=True (replace) is used now to avoid the issue.

Change-Id: I4a2bd7c882e179560657a3dc7edf18c7e5835492

Change-Id: I73a4a14734651f6483fae169a2290e9c5b377d76

fix ca cert render indent issue

formula, service symlinks. force/makedirs True

version to be specified for salt formula

Change-Id: Ic64656c6fc3d4f561226d884b8bfb535dd537e14

fix prepending whitespaces starting 2nd line

Change-Id: I7b4dc2001e07b047964f4ebbbbe0b23db7819566

Change-Id: I484f7156dc82ca528307857f41018f4048467f78

Change-Id: Ie1f1397817b47f299107e4f44dfb4c5ffe1c010c

Terse output is not enough for debugging.

Change-Id: Ida9a4ef0a2ad053fc370d3833d716d9e8d38d814

This option can configure default output of state calls. Terse (default
option) will make each call to be on single line and make salt output
better.

Change-Id: Id0987561e34a84fb26a796729d6ab3de3b9ae8e5

Change-Id: I6f1292779858c45f9cf6f4caf3657ee000b2cf06

Update virt.sls

Change-Id: I2b8ee84718e10d6261f1c93ca02ff4b60977e37f

Add ability to specify custom node name in reclass.

minor, lint/syntax

fix minion proxy, if devices not defined

Change-Id: I1e1269268a81d8cd01b5fe9328f63e8bf85e941b

We can have this failing because of bad mine data:
salt['mine.get'](cert.host, 'x509.get_pem_entries')

Without this change, dependency between salt_minion_cert_*_all and
ca_file is just ignored and salt_minion_cert_*_all state fails because
it can't find appropriate file.

Change-Id: I2a5dd12e08159bf110ff0d9879ebf0ad5d9d97c1

Change-Id: I2aba1213b1dda46aee929b8ea583c41316e3eb0b

fix make test in tests_minion_pki_cert

fix, ca crt rollout for trusted_ca_minions