The Salt system is amazingly simple and easy to configure. The two components of the Salt system each have a respective configuration file. The salt-master is configured via the master configuration file, and the salt-minion is configured via the minion configuration file.
The Salt Minion configuration is very simple. Typically, the only value that needs to be set is the master value so the minion knows where to locate its master.
By default, the salt-minion configuration will be in
A notable exception is FreeBSD, where the configuration will be in
The hostname or ipv4 of the master.
The option can can also be set to a list of masters, enabling multi-master mode.
master: - address1 - address2
Changed in version 2014.7.0: The master can be dynamically configured. The
can be set to an module function which will be executed and will assume
that the returning value is the ip or hostname of the desired master. If a
function is being specified, then the
must be set to
func, to tell the minion that the value is a function to
be run and not a fully-qualified domain name.
master: module.function master_type: func
In addition, instead of using multi-master mode, the minion can be
configured to use the list of master addresses as a failover list, trying
the first address, then the second, etc. until the minion successfully
connects. To enable this behavior, set
master: - address1 - address2 master_type: failover
New in version 2014.7.0.
The type of the
master variable. Can be either
If the master needs to be dynamically assigned by executing a function instead
of reading in the static master value, set this to
func. This can be used
to manage the minion's master setting from an execution module. By simply
changing the algorithm in the module to return a new master ip/fqdn, restart
the minion and it will connect to the new master.
If this option is set to
master must be a list of
master addresses. The minion will then try each master in the order specified
in the list until it successfully connects.
New in version 2014.7.0.
Set the number of seconds to wait before attempting to resolve the master hostname if name resolution fails. Defaults to 30 seconds. Set to zero if the minion should shutdown and not retry.
The port of the master ret server, this needs to coincide with the ret_port option on the Salt master.
The user to run the Salt processes
The user to run salt remote execution commands as via sudo. If this option is
enabled then sudo will be used to change the active user executing the remote
command. If enabled the user will need to be allowed access via the sudoers file
for the user that the salt minion is configured to run as. The most common
option would be to use the root user. If this option is set the
should also be set to a non-root user. If migrating from a root minion to a non
root minion the minion cache should be cleared and the minion pki directory will
need to be changed to the ownership of the new user.
The location of the daemon's process ID file
The directory used to store the minion's public and private keys.
Default: the system's hostname
The Setting up a Salt Minion section contains detailed information on how the hostname is determined.
Explicitly declare the id for this minion to use. Since Salt uses detached ids it is possible to run multiple minions on the same machine but with different ids.
Append a domain to a hostname in the event that it does not exist. This is
useful for systems where
socket.getfqdn() does not actually result in a
FQDN (for instance, Solaris).
The location for minion cache data.
This directory may contain sensitive data and should be protected accordingly.
Verify and set permissions on configuration directories at startup.
When marked as True the verify_env option requires WRITE access to the configuration directory (/etc/salt/). In certain situations such as mounting /etc/salt/ as read-only for templating this will create a stack trace when state.highstate is called.
The minion can locally cache the return data from jobs sent to it, this can be
a good way to keep track of the minion side of the jobs the minion has
executed. By default this feature is disabled, to enable set cache_jobs to
The directory where Unix sockets will be kept.
Backup files replaced by file.managed and file.recurse under cachedir.
The number of seconds to wait until attempting to re-authenticate with the master.
When the master key changes, the minion will try to re-auth itself to receive the new master key. In larger environments this can cause a syn-flood on the master because all minions try to re-auth immediately. To prevent this and have a minion wait for a random amount of time, use this optional parameter. The wait-time will be a random number of seconds between 0 and the defined value.
The maximum number of seconds to wait until attempting to re-authenticate with the master. If set, the wait will increase by acceptance_wait_time seconds each iteration.
The interval in milliseconds that the socket should wait before trying to reconnect to the master (1000ms = 1 second).
The maximum time a socket should wait. Each interval the time to wait is calculated by doubling the previous time. If recon_max is reached, it starts again at the recon_default.
Generate a random wait time on minion start. The wait time will be a random value between recon_default and recon_default and recon_max. Having all minions reconnect with the same recon_default and recon_max value kind of defeats the purpose of being able to change these settings. If all minions have the same values and the setup is quite large (several thousand minions), they will still flood the master. The desired behavior is to have time-frame within all minions try to reconnect.
When healing, a dns_check is run. This is to make sure that the originally
resolved dns has not changed. If this is something that does not happen in your
environment, set this value to
The connection to the master ret_port is kept open. When set to False, the minion
creates a new connection for every return to the master.
environment, set this value to
Windows platforms lack POSIX IPC and must rely on slower TCP based inter-
process communications. Set ipc_mode to
tcp on such systems.
 (all modules are enabled by default)
The event may occur in which the administrator desires that a minion should not be able to execute a certain module. The sys module is built into the minion and cannot be disabled.
This setting can also tune the minion, as all modules are loaded into ram disabling modules will lover the minion's ram footprint.
disable_modules: - test - solr
 (all returners are enabled by default)
If certain returners should be disabled, this is the place
disable_returners: - mongo_return
A list of extra directories to search for Salt modules
module_dirs: - /var/lib/salt/modules
A list of extra directories to search for Salt returners
returners_dirs: - /var/lib/salt/returners
A list of extra directories to search for Salt states
states_dirs: - /var/lib/salt/states
A list of extra directories to search for Salt grains
grains_dirs: - /var/lib/salt/grains
A list of extra directories to search for Salt renderers
render_dirs: - /var/lib/salt/renderers
Set this value to true to enable auto-loading and compiling of
This setting requires that
cython are installed on the minion
The default renderer used for local state executions
state_verbose allows for the data returned from the minion to be more
verbose. Normally only states that fail or states that have changes are
returned, but setting state_verbose to
True will return all states that
The state_output setting changes if the output is the full multi line output for each changed state if set to 'full', but if set to 'terse' the output will be shortened to a single line.
autoload_dynamic_modules Turns on automatic loading of modules found in the
environments on the master. This is turned on by default, to turn of
auto-loading modules when states run set this value to
clean_dynamic_modules keeps the dynamic modules on the minion in sync with
the dynamic modules on the master, this means that if a dynamic module is
not on the master it will be deleted from the minion. By default this is
enabled and can be disabled by changing this value to
Normally the minion is not isolated to any single environment on the master when running states, but the environment can be isolated on the minion side by statically setting it. Remember that the recommended way to manage environments is to isolate via the top file.
The client defaults to looking on the master server for files, but can be
directed to look on the minion by setting this parameter to
When using a local
file_client, this parameter is used to allow
the client to connect to a master for remote execution.
base: - /srv/salt
file_roots: base: - /srv/salt dev: - /srv/salt/dev/services - /srv/salt/dev/states prod: - /srv/salt/prod/services - /srv/salt/prod/states
The hash_type is the hash to use when discovering the hash of a file on the local fileserver. The default is md5, but sha1, sha224, sha256, sha384, and sha512 are also supported.
Open mode can be used to clean out the PKI key received from the Salt master, turn on open mode, restart the minion, then turn off open mode and restart the minion to clean the keys.
Enables verification of the master-public-signature returned by the master in auth-replies. Please see the tutorial on how to configure this properly Multimaster-PKI with Failover Tutorial
New in version 2014.7.0.
If this is set to
master_sign_pubkey must be also set
True in the master configuration file.
The filename without the .pub suffix of the public key that should be used for verifying the signature from the master. The file must be located in the minion's pki directory.
New in version 2014.7.0.
Disable multiprocessing support by default when a minion receives a publication a new process is spawned and the command is executed therein.
The minion log can be sent to a regular file, local path name, or network
location. See also
The level of messages to send to the console. See also
The date and time format used in console log messages. See also
The date and time format used in log file messages. See also
log_datefmt_logfile: '%Y-%m-%d %H:%M:%S'
The format of the console logging messages. See also
log_fmt_console: '[%(levelname)-8s] %(message)s'
%(asctime)s,%(msecs)03.0f [%(name)-17s][%(levelname)-8s] %(message)s
The format of the log file logging messages. See also
log_fmt_logfile: '%(asctime)s,%(msecs)03.0f [%(name)-17s][%(levelname)-8s] %(message)s'
This can be used to control logging levels more specifically. See also
Set the global failhard flag, this informs all states to stop running states at the moment a single state fails
The minion can include configuration from other files. Per default the minion will automatically include all config files from minion.d/*.conf where minion.d is relative to the directory of the minion configuration file.
The minion can include configuration from other files. To enable this, pass a list of paths to this option. The paths can be either relative or absolute; if relative, they are considered to be relative to the directory the main minion configuration file lives in. Paths can make use of shell-style globbing. If no files are matched by a path passed to this option then the minion will log a warning message.
# Include files from a minion.d directory in the same # directory as the minion config file include: minion.d/*.conf # Include a single extra file into the configuration include: /etc/roles/webserver # Include several files and the minion.d directory include: - extra_config - minion.d/* - /etc/roles/webserver
False (Update feature is disabled)
The url to use when looking for application updates. Esky depends on directory listings to search for new versions. A webserver running on your Master is a good starting point for most setups.
 (service restarting on update is disabled)
A list of services to restart when the minion software is updated. This would typically just be a list containing the minion's service name, but you may have other services that need to go with it.