We've several deployment cases where it makes sense to avoid duplicate between Salt deployment and Jenkins deployment.

A solution could be to use the reactor system and the Salt HTTP API:

• An event is sent to the API through /hook/<event> URL, for example /hook/deploy/acme
• The Salt event bus receives the salt/netapi/hook/deploy/acme event
• The reactor is configured with instructions to run states if it receives the salt/netapi/hook/deploy/acme event

That requires:

• To install salt-api and CherryPi on Complector, see https://docs.saltproject.io/en/latest/ref/netapi/all/salt.netapi.rest_cherrypy.html
• To provision new TLS certificates or to use the Vault ones, as they're already correctly qualified for complector.nasqueron.drake and the IP address
• To configure rest_cherrypy in the Salt configuration files
• A new directory in rOPS to host reactor files, at root to avoid them to be hidden in roles/salt-primary/reactor/files
• Units to provision both reactors files and salt API stuff in roles/salt-primary