Salt Project Package Repo

Debian 11 (Bullseye)

Debian 11 (Bullseye) ARM64

Debian 10 (buster) PY3

Debian 9 (stretch) PY3

Redhat / CentOS 8 PY3

Redhat / CentOS 7 PY3

Ubuntu 20 (focal) PY3

Ubuntu 20 (focal) PY3 ARM64

Ubuntu 18 (bionic) PY3

SUSE / OpenSUSE / SLES

1. Refresh the package list:

   sudo zypper refresh

2. Packages are available in the standard SUSE repositories. Install the salt-minion, salt-master, or other Salt components:
   • sudo zypper install salt-master
   • sudo zypper install salt-minion
   • sudo zypper install salt-ssh
   • sudo zypper install salt-syndic
   • sudo zypper install salt-cloud
   • sudo zypper install salt-api
   • sudo zypper install salt-proxy
3. Enable and start service for salt-minion, salt-master, or other Salt components:
   • sudo systemctl enable salt-master && sudo systemctl start salt-master
   • sudo systemctl enable salt-minion && sudo systemctl start salt-minion
   • sudo systemctl enable salt-syndic && sudo systemctl start salt-syndic
   • sudo systemctl enable salt-api && sudo systemctl start salt-api
4. (Upgrade only) Restart all upgraded services, for example:
   • sudo systemctl restart salt-minion

Post-installation

For more information on next steps, reference Post-installation configuration

Fedora

1. Packages are available in the standard Fedora repositories. Install the salt-minion, salt-master, or other Salt components:
   • sudo dnf install salt-master
   • sudo dnf install salt-minion
   • sudo dnf install salt-ssh
   • sudo dnf install salt-syndic
   • sudo dnf install salt-cloud
   • sudo dnf install salt-api
2. Enable and start service for salt-minion, salt-master, or other Salt components:
   • sudo systemctl enable salt-master && sudo systemctl start salt-master
   • sudo systemctl enable salt-minion && sudo systemctl start salt-minion
   • sudo systemctl enable salt-syndic && sudo systemctl start salt-syndic
   • sudo systemctl enable salt-api && sudo systemctl start salt-api

Post-installation

For more information on next steps, reference Post-installation configuration

Windows PY3

EXE: Silent Installation Options

The installer can be run silently by providing the /S option at the command line. The options /master and /minion-name allow for configuring the master hostname and minion name, respectively. Here’s an example of running a silent installation from the command line:

Salt-Minion-3004-2-Py3-AMD64-Setup.exe /S /master=yoursaltmaster /minion-name=yourminionname

MSI: Silent Installation Options

The installer can be run silently by providing the /quiet and /norestart option at the command line. The options MASTER and MINION_ID allow for configuring the master hostname and minion name, respectively. Here’s an example of running a silent installation from the command line:

msiexec /i Salt-Minion-3004-2-Py3-AMD64.msi /quiet /norestart MASTER=yoursaltmaster MINION_ID=yourminionname

Post-installation

For more information on next steps, reference Post-installation configuration

macOS PY3

Initial Configuration

After the installation completes, run the following to configure the Salt minion ID, the Salt master location, and to start the required services.

sudo salt-config -i yourminionname -m yoursaltmaster

Start and Stop the Minion Service

On OS X, the Salt minion configuration file is in the standard /etc/salt/minion location. To stop the Salt minion, run the following:

sudo launchctl stop com.saltstack.salt.minion

To start the Salt minion, run the following:

sudo launchctl start com.saltstack.salt.minion

Post-installation

For more information on next steps, reference Post-installation configuration

Amazon Linux 2 PY3

Raspbian 11 (bullseye)

Raspbian 10 (buster) PY3

Raspbian 9 (stretch) PY3

Bootstrap - Multi-Platform

Salt Bootstrap is a shell script that detects the target platform and selects the best installation method. (Supported Platforms)

On the Salt master

Run these commands on the system that you want to use as the central management point.

# Download
curl -fsSL https://bootstrap.saltproject.io -o install_salt.sh
curl -fsSL https://bootstrap.saltproject.io/sha256 -o install_salt_sha256

# Verify file integrity
SHA_OF_FILE=$(sha256sum install_salt.sh | cut -d' ' -f1)
SHA_FOR_VALIDATION=$(cat install_salt_sha256)
if [[ "$SHA_OF_FILE" == "$SHA_FOR_VALIDATION" ]]; then
    # After verification, run script to bootstrap master
    echo "Success! Installing..."
    sudo sh install_salt.sh -P -M -x python3
else
    # If hash check fails, don't attempt install
    echo "WARNING: This file is corrupt or has been tampered with."
fi

Your Salt master can manage itself, so a Salt minion is installed along with the Salt master. If you do not want to install the minion, also pass the -N option.

On each Salt minion

Run these commands on each system that you want to manage using Salt.

Linux or macOS / OSX

# Download
curl -fsSL https://bootstrap.saltproject.io -o install_salt.sh
curl -fsSL https://bootstrap.saltproject.io/sha256 -o install_salt_sha256

# Verify file integrity
SHA_OF_FILE=$(sha256sum install_salt.sh | cut -d' ' -f1)
SHA_FOR_VALIDATION=$(cat install_salt_sha256)
if [[ "$SHA_OF_FILE" == "$SHA_FOR_VALIDATION" ]]; then
    # After verification, run Linux or macOS / OSX minion install
    echo "Success! Installing..."
    sudo sh install_salt.sh -P -x python3
else
    # If hash check fails, don't attempt install
    echo "WARNING: This file is corrupt or has been tampered with."
fi

Windows bootstrap

# Windows: Using Windows PowerShell or PowerShell Core
# Download
Invoke-WebRequest -Uri https://winbootstrap.saltproject.io -OutFile C:\Temp\bootstrap-salt.ps1
Invoke-WebRequest -Uri https://winbootstrap.saltproject.io/sha256 -OutFile C:\Temp\bootstrap-salt-sha256

# Verify file integrity
$FileSha = (Get-FileHash C:\Temp\bootstrap-salt.ps1).hash
$ValidatedSha = Get-Content C:\Temp\bootstrap-salt-sha256
if ("$FileSha" -eq "$ValidatedSha") {
    # After verification, run Windows minion install
    Write-Output "Success! Installing..."
    Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
    C:\Temp\bootstrap-salt.ps1
    Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser
} else {
    # If hash check fails, don't attempt install
    Write-Error "WARNING: This file is corrupt or has been tampered with."
}

Post-installation

For more information on next steps, reference Post-installation configuration

Single-binary (BETA)

Single-binaries of salt are primarily used by Heist, but they can be downloaded for simplified lab use. It is highly recommended that users instead install salt via the appropriate package for their target OS, as those packages include several configurations (configuring services, users, etc.) that would have to be manually configured when downloading single-binary forms of salt.

Verify GPG key fingerprint and file integrity

It’s best practice, for security considerations and file integrity purposes, to confirm that the downloaded file is the file that was released by Salt Project.

Linux downloads

gpg needs to be available. If gpg isn’t present, it can be installed via gnupg2 (or, at times, gnupg) on most systems. The following examples should work for Linux.

• Example: yum install gnupg2
• Example: apt install gnupg2

The following will download the single-binary and verify the download before attempting to extract from the .tar.gz:

# Download latest salt and files required for file integrity verification
# This example covers the latest amd64 download for Linux systems
curl -fsSL https://repo.saltproject.io/salt/singlebin/3004/salt-3004_SHA512.asc -O
curl -fsSL https://repo.saltproject.io/salt/singlebin/3004/salt-3004_SHA512 -O
curl -fsSL https://repo.saltproject.io/salt/singlebin/3004/salt-3003-3-linux-amd64.tar.gz -O

# Import GPG key for verifying signatures
SALT_GPG_TEMP_DIR=$(mktemp -d)
SALT_KEYRING="${SALT_GPG_TEMP_DIR}/salt-keyring.gpg"
touch "${SALT_KEYRING}"
gpg --homedir "${SALT_GPG_TEMP_DIR}" \
    --no-default-keyring \
    --keyring "${SALT_KEYRING}" \
    --keyserver https://repo.saltproject.io/salt/singlebin/3004/salt-archive-keyring.gpg \
    --recv-keys 754A1A7AE731F165D5E6D4BD0E08A149DE57BFBE

# Steps, with each one only able to execute if previous step passes:
# - Verify signature passes
# - Verify file integrity via sha
# - Extract salt into current dir
gpgv --homedir "${SALT_GPG_TEMP_DIR}" \
     --keyring "${SALT_KEYRING}" salt-3004_SHA512.asc salt-3004_SHA512 && \
       sha512sum -c --ignore-missing salt-3004_SHA512 && \
       tar -xvf salt-3003-3-linux-amd64.tar.gz

# Cleanup temp dir
rm -rf "${SALT_GPG_TEMP_DIR}"

Expected output should include:

gpgv: Good signature from "SaltStack Packaging Team <packaging@saltstack.com>"
salt-3003-3-linux-amd64.tar.gz: OK

Usage

All tools, from the salt repo, are included in the single-binary. Though, because they are contained within a single binary, they must be called differently.

Example:

# Make use of salt-call
sudo ./salt call --local test.versions

Available tools:

• salt master (similar to salt-master)
• salt minion (similar to salt-minion)
• salt call (similar to salt-call)
• salt ssh (similar to salt-ssh)
• salt syndic (similar to salt-syndic)
• salt cloud (similar to salt-cloud)
• salt api (similar to salt-api)
• salt pip

Installing pip packages into Salt

The single-binary includes a new command, salt pip, which makes it easy to install packages from PyPI directly into Salt.

Example:

sudo ./salt pip install <extra-packages>

Post-installation

For more information on next steps, reference Post-installation configuration

Other Platforms

For installation on other platforms and alternative installation methods, see the Salt Installation Instructions.

Unsupported or archived OS versions

We do NOT recommend installing unsupported or archived versions of Salt. These may be impacted by security vulnerabilities. Run at your own risk.

Create a Local Mirror of the Salt Project Package Repo

The Salt Project package repo supports mirroring using an s3 api compatible sync tool such as the aws-cli, or rclone. Note that we use a custom endpoint so we can switch buckets easily. Also note that rclone may warn about the time being off. This warning is shown because we use CloudFront as a cache instead of using s3 directly. You can safely ignore these warning messages. Please sync no more than once per day.

rclone example:

RCLONE_CONFIG_S3_TYPE=s3 RCLONE_CONFIG_S3_PROVIDER=Other RCLONE_CONFIG_S3_ENV_AUTH=false RCLONE_CONFIG_S3_ENDPOINT=https://s3.repo.saltproject.io rclone sync --fast-list --use-server-modtime -v s3:s3/ ./fullrepo/

Please make sure to include the --use-server-modtime flags as not doing so will drastically increase our costs.

If you can’t use the --use-server-modtime flag because your version of rclone is too old, you can use the -c flag:

RCLONE_CONFIG_S3_TYPE=s3 RCLONE_CONFIG_S3_PROVIDER=Other RCLONE_CONFIG_S3_ENV_AUTH=false RCLONE_CONFIG_S3_ENDPOINT=https://s3.repo.saltproject.io rclone sync --fast-list -c -v s3:s3/ ./fullrepo/

aws-cli example:

aws --no-sign-request --endpoint-url https://s3.repo.saltproject.io s3 sync --delete --exact-timestamps s3://s3/ ./fullrepo/

For syncing https://archive.repo.saltproject.io, the endpoint url is https://s3.archive.repo.saltproject.io. Everything else is the same.

Directory Listing