Enhance mod_data to Use Global Loader Extensions in salt-ssh

[wirwolf]

Problem

The mod_data function in salt/client/ssh/__init__.py was only discovering modules from the fileserver backend (e.g., _modules, _states directories accessed via fsclient.cache_file()). This caused salt-ssh to ignore:

• Custom modules registered via entry-points
• Modules from extension_modules configuration
• Modules from module_dirs CLI options
• Custom fileserver backends and other loader plugins

This resulted in inconsistent behavior between salt-call (which loads all extensions) and salt-ssh (which ignores them).

Solution

Modified mod_data() to collect modules from three sources:

1. Global Loader Paths

Uses salt.loader._module_dirs() to discover all module directories, including:

• Entry-point registered plugins
• extension_modules from configuration
• module_dirs from CLI
• System-wide module paths

2. File Roots

Directly scans file_roots directories for _modules, _states, etc., avoiding network-dependent fileserver operations that require master connectivity.

3. Error Handling

Wraps all discovery operations in try-except blocks to ensure salt-ssh continues working even if:

• Some module paths are inaccessible
• Entry-point plugins fail to load
• File roots are misconfigured

Benefits

• Consistency: salt-ssh now uses the same module discovery logic as salt-call
• Entry-point support: Custom plugins registered via setuptools entry-points are now available
• No master dependency: Avoids KeyError: 'master_uri' by not using fileserver client operations
• Resilience: Graceful error handling ensures partial failures don't break salt-ssh

Technical Details

Before: Only scanned fileserver via fsclient.cache_file() → required master connection

After:

1. Calls salt.loader._module_dirs(opts, ref, tag=...) for each module type
2. Scans directories directly from filesystem
3. Collects modules from file_roots configuration
4. Builds tarball with all discovered modules for deployment to targets

Key Changes:

• Removed dependency on fsclient.cache_file() which triggers master authentication
• Added direct filesystem scanning of file_roots
• Added comprehensive exception handling
• Preserved backward compatibility with existing module discovery

Impact

All salt-ssh deployments now have access to:

• Custom execution modules
• Custom states
• Custom grains
• Custom renderers
• Custom returners
• Custom fileserver backends (when registered via entry-points)

This resolves the inconsistency where salt-call --local sys.list_fileserver_backends would show custom backends but salt-ssh <target> sys.list_fileserver_backends would not.

Commits signed with GPG?

Yes

Linked issue: #68496

[twangboy]

Please add a changelog and write a test

[wirwolf]

Please add a changelog and write a test

Done
PS. I am not sure of a clear understanding of where I need to add changelog

[twangboy]

The documentation is here:
https://docs.saltproject.io/en/latest/topics/development/changelog.html

Basically, create a file in the changelog directory and the changelog will be updated on the next release based on the content of that file. There are some naming conventions depending on what this PR is doing. This one would probably be 68496.fixed.md.

[wirwolf]

The documentation is here: https://docs.saltproject.io/en/latest/topics/development/changelog.html

Basically, create a file in the changelog directory and the changelog will be updated on the next release based on the content of that file. There are some naming conventions depending on what this PR is doing. This one would probably be 68496.fixed.md.

Fixed

[twangboy]

If you install pre-commit (pip install pre-commit) you can run it before you commit. In your case, I would add a blank line somewhere in the files where pre-commit is failing then run the following:

git add .
pre-commit

Pre-commit will run and make all the changes you're seeing in the failing pre-commit. Repeat those 2 commands until pre-commit comes back clean.

[wirwolf]

Hello @twangboy. Please re-run tests for Windows. I see he has failed because some services are sent
Invoke-WebRequest : 504 Gateway Time-out

[welcome]

Congratulations on your first PR being merged! 🎉