Salt Cheat-Sheet

Salt (SaltStack) is a configuration management and remote execution tool. A master sends commands and states to minions, or salt-call --local and salt-ssh run without a master. Use it to keep machines in a declared state and to run one command across many hosts.

Documentation: Salt docs · Salt install guide Project: Salt Project

Verification: options checked against the --help output of Salt 3008.5 (installed with pip in a throwaway Python 3.11 container; it needed a C compiler). salt-call --local was run for test.ping, grains.*, pillar.items, state.apply (with test=True), state.single, state.sls, sys.* and --out=json; the example states below were applied twice and the second run changed nothing. No master, minion connection, salt-key exchange or salt-ssh login was tested, so those rows are from --help only. Output details change between releases.

Related sheets: Ansible, Ansible-Playbook, Puppet, Terraform, Vagrant.

Run Without a Master #

--local makes salt-call read states from the local file roots and skip the master.

Minimal minion config for local use, saved as <DIR>/minion:

file_client: local
file_roots:
  base:
    - /srv/salt
pillar_roots:
  base:
    - /srv/pillar

Remote Execution From the Master #

Run on the master. The target comes first, then the function.

Quote * so the shell does not expand it.

Minion Keys #

Minions send a public key to the master. Accept only the ones you recognise.

Introspection #

Salt 3008 printed pillar values as ********** in pillar.items and pillar.get output in the test run. That is a display default; check the release notes for how to show them.

States #

A state file describes desired state. top.sls assigns state files to minions.

# /srv/salt/top.sls
base:
  '*':
    - demo

# /srv/salt/demo.sls
saltdemo_file:
  file.managed:
    - name: /tmp/saltdemo.txt
    - source: salt://motd.jinja
    - template: jinja
    - mode: '0644'

saltdemo_cmd:
  cmd.run:
    - name: echo changed
    - onchanges:
      - file: saltdemo_file

{# /srv/salt/motd.jinja #}
Hello {{ grains['id'] }} ({{ pillar['app']['greeting'] }})

# /srv/pillar/top.sls and /srv/pillar/app.sls
base:
  '*':
    - app

app:
  greeting: hello-from-pillar

Common requisites: require, watch, onchanges, onfail, unless, onlyif, creates keep states ordered and idempotent.

Salt SSH #

Agentless: runs over SSH using a roster file instead of a minion.

Roster file (/etc/salt/roster; format from the documentation, not tested):

web1:
  host: 192.0.2.10
  user: deploy
  sudo: true

Other Tools #

Troubleshooting #

See Also #

• Ansible
• Puppet
• Chef
• Terraform