[Bug]: pillar.get nodegroups showing only ****

[gwaters]

What happened?

We upgraded to salt-minion and master 3008.1.0, and pillar.get nodegroups always shows:

 salt-call pillar.get nodegroups
local:
    - **********
    - **********

What it should show:

 salt-call pillar.get nodegroups
local:
    - specialhost
    - specialserver

Packaged version that has the issue:

Name        : salt-minion
Version     : 3008.1
Release     : 0
Architecture: x86_64
Install Date: Mon 15 Jun 2026 10:39:41 AM PDT
Group       : System Environment/Daemons
Size        : 75547
License     : ASL 2.0
Signature   : RSA/SHA256, Thu 11 Jun 2026 05:43:27 AM PDT, Key ID 64cbbc8173d76b3f
Source RPM  : salt-3008.1-0.src.rpm
Build Date  : Thu 11 Jun 2026 05:42:59 AM PDT
Build Host  : 6793d01a240b
Relocations : (not relocatable)
URL         : https://saltproject.io/
Summary     : Client component for Salt, a parallel remote execution system
Description :
The Salt minion is the agent component of Salt. It listens for instructions
from the master, runs jobs, and returns results back to the master.

Reverting back down to 3007.14.0 fixes it.

Type of salt install

Official rpm

Major version

3007.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

rhel-9

salt --versions-report output

Salt Version:
          Salt: 3008.1
 
Python Version:
        Python: 3.14.6 (main, Jun 11 2026, 02:19:05) [GCC 11.2.0]
 
Dependency Versions:
          cffi: 2.0.0
      cherrypy: 18.10.0
  cryptography: 48.0.0
      dateutil: 2.9.0.post0
     docker-py: Not Installed
         gitdb: 4.0.12
     gitpython: 3.1.50
        Jinja2: 3.1.6
       libgit2: Not Installed
  looseversion: 1.3.0
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.1.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 24.0
     pycparser: 3.00
      pycrypto: Not Installed
  pycryptodome: 3.23.0
        pygit2: Not Installed
  python-gnupg: 0.5.6
        PyYAML: 6.0.3
         PyZMQ: 27.1.0
        relenv: 0.22.14
         smmap: 5.0.2
       timelib: 0.3.0
       Tornado: 6.5.7
           ZMQ: 4.3.5
 
Salt Package Information:
  Package Type: onedir
 
System Versions:
          dist: rhel 9.5 Plow
        locale: utf-8
       machine: x86_64
       release: 5.14.0-427.13.1.el9_4.x86_64
        system: Linux
       version: Red Hat Enterprise Linux 9.5 Plow

[welcome]

Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here's some information that may help as you continue your Salt journey.
Please be sure to review our Code of Conduct. Also, check out some of our community resources including:

• Salt's Contributor Guide
• Join our Community Discord
• Salt Project YouTube channel
• GitHub Discussions

There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar.
If you have additional questions, email us at saltproject.pdl@broadcom.com. We're glad you've joined our community and look forward to doing awesome things with you!

[dwoz]

pillar.get accepts unmask=True (added 3008.0):

salt-call pillar.get nodegroups unmask=True

That returns the plain values. The masking default is intentional (#68907) — it scrubs pillar values out of incidental log/return paths. See the unmask parameter in the docstring.