MASTER

Default: salt

The hostname or IP address of the master. See ipv6 for IPv6 connections to the master.

Default: salt

master: salt

master: localhost:1234

master: ‘[2001:db8:85a3:8d3:1319:8a2e:370:7348]:1234‘

master:
  - address1
  - address2

master: module.function
master_type: func

master:
  - address1
  - address2
master_type: failover

IPV6

Default: None

Whether the master should be connected over IPv6. By default salt minion will try to automatically detect IPv6 connectivity to master.

ipv6: True

MASTER_URI_FORMAT

Specify the format in which the master address will be evaluated. Valid options are default or ip_only. If ip_only is specified, then the master address will not be split into IP and PORT, so be sure that only an IP (or domain name) is set in the master configuration setting.

master_uri_format: ip_only

MASTER_TOPS_FIRST

Default: False

SLS targets defined using the Master Tops system are normally executed after any matches defined in the Top File. Set this option to True to have the minion execute the Master Topsstates first.

master_tops_first: True

MASTER_TYPE

Default: str

The type of the master variable. Can be str, failover, func or disable.

master_type: failover

If this option is set to failover, master must be a list of master addresses. The minion will then try each master in the order specified in the list until it successfully connects.master_alive_interval must also be set, this determines how often the minion will verify the presence of the master.

master_type: func

If the master needs to be dynamically assigned by executing a function instead of reading in the static master value, set this to func. This can be used to manage the minion‘s master setting from an execution module. By simply changing the algorithm in the module to return a new master ip/fqdn, restart the minion and it will connect to the new master.

As of version 2016.11.0 this option can be set to disable and the minion will never attempt to talk to the master. This is useful for running a masterless minion daemon.

master_type: disable

MAX_EVENT_SIZE

Default: 1048576

Passing very large events can cause the minion to consume large amounts of memory. This value tunes the maximum size of a message allowed onto the minion event bus. The value is expressed in bytes.

max_event_size: 1048576

MASTER_FAILBACK

Default: False

If the minion is in multi-master mode and the :conf_minion`master_type` configuration option is set to failover, this setting can be set to True to force the minion to fail back to the first master in the list if the first master is back online.

master_failback: False

MASTER_FAILBACK_INTERVAL

Default: 0

If the minion is in multi-master mode, the :conf_minion`master_type` configuration is set to failover, and the master_failback option is enabled, the master failback interval can be set to ping the top master with this interval, in seconds.

master_failback_interval: 0

MASTER_ALIVE_INTERVAL

Default: 0

Configures how often, in seconds, the minion will verify that the current master is alive and responding. The minion will try to establish a connection to the next master in the list if it finds the existing one is dead.

master_alive_interval: 30

MASTER_SHUFFLE

Default: False

If master is a list of addresses and :conf_minion`master_type` is failover, shuffle them before trying to connect to distribute the minions over all available masters. This uses Python‘s random.shuffle method.

master_shuffle: True

RANDOM_MASTER

Default: False

If master is a list of addresses, and :conf_minion`master_type` is set to failover shuffle them before trying to connect to distribute the minions over all available masters. This uses Python‘s random.shuffle method.

random_master: True

RETRY_DNS

Default: 30

Set the number of seconds to wait before attempting to resolve the master hostname if name resolution fails. Defaults to 30 seconds. Set to zero if the minion should shutdown and not retry.

retry_dns: 30

MASTER_PORT

Default: 4506

The port of the master ret server, this needs to coincide with the ret_port option on the Salt master.

master_port: 4506

PUBLISH_PORT

Default: 4505

The port of the master publish server, this needs to coincide with the publish_port option on the Salt master.

publish_port: 4505

SOURCE_INTERFACE_NAME

The name of the interface to use when establishing the connection to the Master.

Configuration example:

source_interface_name: bond0.1234

SOURCE_ADDRESS

The source IP address or the domain name to be used when connecting the Minion to the Master. See ipv6 for IPv6 connections to the Master.

Configuration example:

source_address: if-bond0-1234.sjc.us-west.internal

SOURCE_RET_PORT

The source port to be used when connecting the Minion to the Master ret server.

Configuration example:

source_ret_port: 49017

SOURCE_PUBLISH_PORT

The source port to be used when connecting the Minion to the Master publish server.

Configuration example:

source_publish_port: 49018

USER

Default: root

The user to run the Salt processes

user: root

SUDO_USER

Default: ‘‘

The user to run salt remote execution commands as via sudo. If this option is enabled then sudo will be used to change the active user executing the remote command. If enabled the user will need to be allowed access via the sudoers file for the user that the salt minion is configured to run as. The most common option would be to use the root user. If this option is set the user option should also be set to a non-root user. If migrating from a root minion to a non root minion the minion cache should be cleared and the minion pki directory will need to be changed to the ownership of the new user.

sudo_user: root

PIDFILE

Default: /var/run/salt-minion.pid

The location of the daemon‘s process ID file

pidfile: /var/run/salt-minion.pid

ROOT_DIR

Default: /

This directory is prepended to the following options: pki_dir, cachedir, log_file, sock_dir, and pidfile.

root_dir: /

CONF_FILE

Default: /etc/salt/minion

The path to the minion‘s configuration file.

conf_file: /etc/salt/minion

PKI_DIR

Default: /etc/salt/pki/minion

The directory used to store the minion‘s public and private keys.

pki_dir: /etc/salt/pki/minion

ID

Default: the system‘s hostname

Explicitly declare the id for this minion to use. Since Salt uses detached ids it is possible to run multiple minions on the same machine but with different ids.

id: foo.bar.com

MINION_ID_CACHING

Default: True

Caches the minion id to a file when the minion‘s id is not statically defined in the minion config. This setting prevents potential problems when automatic minion id resolution changes, which can cause the minion to lose connection with the master. To turn off minion id caching, set this config to False.

For more information, please see Issue #7558 and Pull Request #8488.

minion_id_caching: True

APPEND_DOMAIN

Default: None

Append a domain to a hostname in the event that it does not exist. This is useful for systems where socket.getfqdn() does not actually result in a FQDN (for instance, Solaris).

append_domain: foo.org

MINION_ID_LOWERCASE

Default: False

Convert minion id to lowercase when it is being generated. Helpful when some hosts get the minion id in uppercase. Cached ids will remain the same and not converted.

minion_id_lowercase: True

CACHEDIR

Default: /var/cache/salt/minion

The location for minion cache data.

This directory may contain sensitive data and should be protected accordingly.

cachedir: /var/cache/salt/minion

COLOR_THEME

Default: ""

Specifies a path to the color theme to use for colored command line output.

color_theme: /etc/salt/color_theme

APPEND_MINIONID_CONFIG_DIRS

Default: [] (the empty list) for regular minions, [‘cachedir‘] for proxy minions.

Append minion_id to these configuration directories. Helps with multiple proxies and minions running on the same machine. Allowed elements in the list: pki_dir, cachedir, extension_modules. Normally not needed unless running several proxies and/or minions on the same machine.

append_minionid_config_dirs:
  - pki_dir
  - cachedir

VERIFY_ENV

Default: True

Verify and set permissions on configuration directories at startup.

verify_env: True

CACHE_JOBS

Default: False

The minion can locally cache the return data from jobs sent to it, this can be a good way to keep track of the minion side of the jobs the minion has executed. By default this feature is disabled, to enable set cache_jobs to True.

cache_jobs: False

GRAINS

Default: (empty)

Statically assigns grains to the minion.

grains:
  roles:
    - webserver
    - memcache
  deployment: datacenter4
  cabinet: 13
  cab_u: 14-15

GRAINS_CACHE

Default: False

The minion can locally cache grain data instead of refreshing the data each time the grain is referenced. By default this feature is disabled, to enable set grains_cache to True.

grains_cache: False

GRAINS_DEEP_MERGE

Default: False

The grains can be merged, instead of overridden, using this option. This allows custom grains to defined different subvalues of a dictionary grain. By default this feature is disabled, to enable set grains_deep_merge to True.

grains_deep_merge: False

For example, with these custom grains functions:

def custom1_k1():
    return {‘custom1‘: {‘k1‘: ‘v1‘}}

def custom1_k2():
    return {‘custom1‘: {‘k2‘: ‘v2‘}}

Without grains_deep_merge, the result would be:

custom1:
  k1: v1

With grains_deep_merge, the result will be:

custom1:
  k1: v1
  k2: v2

GRAINS_REFRESH_EVERY

Default: 0

The grains_refresh_every setting allows for a minion to periodically check its grains to see if they have changed and, if so, to inform the master of the new grains. This operation is moderately expensive, therefore care should be taken not to set this value too low.

Note: This value is expressed in minutes.

A value of 10 minutes is a reasonable default.

grains_refresh_every: 0

FIBRE_CHANNEL_GRAINS

Default: False

The fibre_channel_grains setting will enable the fc_wwn grain for Fibre Channel WWN‘s on the minion. Since this grain is expensive, it is disabled by default.

fibre_channel_grains: True

ISCSI_GRAINS

Default: False

The iscsi_grains setting will enable the iscsi_iqn grain on the minion. Since this grain is expensive, it is disabled by default.

iscsi_grains: True

MINE_ENABLED

Default: True

Determines whether or not the salt minion should run scheduled mine updates. If this is set to False then the mine update function will not get added to the scheduler for the minion.

mine_enabled: True

MINE_RETURN_JOB

Default: False

Determines whether or not scheduled mine updates should be accompanied by a job return for the job cache.

mine_return_job: False

MINE_FUNCTIONS

Default: Empty

Designate which functions should be executed at mine_interval intervals on each minion. See this documentation on the Salt Mine for more information. Note these can be defined in the pillar for a minion as well.

example minion configuration file

mine_functions:
  test.ping: []
  network.ip_addrs:
    interface: eth0
    cidr: ‘10.0.0.0/8‘

MINE_INTERVAL

Default: 60

The number of minutes between mine updates.

mine_interval: 60

SOCK_DIR

Default: /var/run/salt/minion

The directory where Unix sockets will be kept.

sock_dir: /var/run/salt/minion

OUTPUTTER_DIRS

Default: []

A list of additional directories to search for salt outputters in.

outputter_dirs: []

BACKUP_MODE

Default: ‘‘

Make backups of files replaced by file.managed and file.recurse state modules under cachedir in file_backup subdirectory preserving original paths. Refer to File State Backups documentation for more details.

backup_mode: minion

ACCEPTANCE_WAIT_TIME

Default: 10

The number of seconds to wait until attempting to re-authenticate with the master.

acceptance_wait_time: 10

ACCEPTANCE_WAIT_TIME_MAX

Default: 0

The maximum number of seconds to wait until attempting to re-authenticate with the master. If set, the wait will increase by acceptance_wait_time seconds each iteration.

acceptance_wait_time_max: 0

REJECTED_RETRY

Default: False

If the master rejects the minion‘s public key, retry instead of exiting. Rejected keys will be handled the same as waiting on acceptance.

rejected_retry: False

RANDOM_REAUTH_DELAY

Default: 10

When the master key changes, the minion will try to re-auth itself to receive the new master key. In larger environments this can cause a syn-flood on the master because all minions try to re-auth immediately. To prevent this and have a minion wait for a random amount of time, use this optional parameter. The wait-time will be a random number of seconds between 0 and the defined value.

random_reauth_delay: 60

MASTER_TRIES

Default: 1

The number of attempts to connect to a master before giving up. Set this to -1 for unlimited attempts. This allows for a master to have downtime and the minion to reconnect to it later when it comes back up. In ‘failover‘ mode, which is set in the master_type configuration, this value is the number of attempts for each set of masters. In this mode, it will cycle through the list of masters for each attempt.

master_tries is different than auth_tries because auth_tries attempts to retry auth attempts with a single master. auth_tries is under the assumption that you can connect to the master but not gain authorization from it. master_tries will still cycle through all of the masters in a given try, so it is appropriate if you expect occasional downtime from the master(s).

master_tries: 1

AUTH_TRIES

Default: 7

The number of attempts to authenticate to a master before giving up. Or, more technically, the number of consecutive SaltReqTimeoutErrors that are acceptable when trying to authenticate to the master.

auth_tries: 7

AUTH_TIMEOUT

Default: 60

When waiting for a master to accept the minion‘s public key, salt will continuously attempt to reconnect until successful. This is the timeout value, in seconds, for each individual attempt. After this timeout expires, the minion will wait for acceptance_wait_time seconds before trying again. Unless your master is under unusually heavy load, this should be left at the default.

auth_timeout: 60

AUTH_SAFEMODE

Default: False

If authentication fails due to SaltReqTimeoutError during a ping_interval, this setting, when set to True, will cause a sub-minion process to restart.

auth_safemode: False

PING_INTERVAL

Default: 0

Instructs the minion to ping its master(s) every n number of minutes. Used primarily as a mitigation technique against minion disconnects.

ping_interval: 0

RANDOM_STARTUP_DELAY

Default: 0

The maximum bound for an interval in which a minion will randomly sleep upon starting up prior to attempting to connect to a master. This can be used to splay connection attempts for cases where many minions starting up at once may place undue load on a master.

For example, setting this to 5 will tell a minion to sleep for a value between 0 and 5 seconds.

random_startup_delay: 5

RECON_DEFAULT

Default: 1000

The interval in milliseconds that the socket should wait before trying to reconnect to the master (1000ms = 1 second).

recon_default: 1000

RECON_MAX

Default: 10000

The maximum time a socket should wait. Each interval the time to wait is calculated by doubling the previous time. If recon_max is reached, it starts again at the recon_default.

Short example:

• reconnect 1: the socket will wait ‘recon_default‘ milliseconds
• reconnect 2: ‘recon_default‘ * 2
• reconnect 3: (‘recon_default‘ * 2) * 2
• reconnect 4: value from previous interval * 2
• reconnect 5: value from previous interval * 2
• reconnect x: if value >= recon_max, it starts again with recon_default

recon_max: 10000

RECON_RANDOMIZE

Default: True

Generate a random wait time on minion start. The wait time will be a random value between recon_default and recon_default + recon_max. Having all minions reconnect with the same recon_default and recon_max value kind of defeats the purpose of being able to change these settings. If all minions have the same values and the setup is quite large (several thousand minions), they will still flood the master. The desired behavior is to have time-frame within all minions try to reconnect.

recon_randomize: True

LOOP_INTERVAL

Default: 1

The loop_interval sets how long in seconds the minion will wait between evaluating the scheduler and running cleanup tasks. This defaults to 1 second on the minion scheduler.

loop_interval: 1

PUB_RET

Default: True

Some installations choose to start all job returns in a cache or a returner and forgo sending the results back to a master. In this workflow, jobs are most often executed with --async from the Salt CLI and then results are evaluated by examining job caches on the minions or any configured returners. WARNING: Setting this to False will disable returns back to the master.

pub_ret: True

RETURN_RETRY_TIMER

Default: 5

The default timeout for a minion return attempt.

return_retry_timer: 5

RETURN_RETRY_TIMER_MAX

Default: 10

The maximum timeout for a minion return attempt. If non-zero the minion return retry timeout will be a random int between return_retry_timer and return_retry_timer_max

return_retry_timer_max: 10

CACHE_SREQS

Default: True

The connection to the master ret_port is kept open. When set to False, the minion creates a new connection for every return to the master.

cache_sreqs: True

IPC_MODE

Default: ipc

Windows platforms lack POSIX IPC and must rely on slower TCP based inter- process communications. Set ipc_mode to tcp on such systems.

ipc_mode: ipc

TCP_PUB_PORT

Default: 4510

Publish port used when ipc_mode is set to tcp.

tcp_pub_port: 4510

TCP_PULL_PORT

Default: 4511

Pull port used when ipc_mode is set to tcp.

tcp_pull_port: 4511

TRANSPORT

Default: zeromq

Changes the underlying transport layer. ZeroMQ is the recommended transport while additional transport layers are under development. Supported values are zeromq, raet(experimental), and tcp (experimental). This setting has a significant impact on performance and should not be changed unless you know what you are doing!

transport: zeromq

SYNDIC_FINGER

Default: ‘‘

The key fingerprint of the higher-level master for the syndic to verify it is talking to the intended master.

syndic_finger: ‘ab:30:65:2a:d6:9e:20:4f:d8:b2:f3:a7:d4:65:50:10‘

PROXY_HOST

Default: ‘‘

The hostname used for HTTP proxy access.

proxy_host: proxy.my-domain

PROXY_PORT

Default: 0

The port number used for HTTP proxy access.

proxy_port: 31337

PROXY_USERNAME

Default: ‘‘

The username used for HTTP proxy access.

proxy_username: charon

PROXY_PASSWORD

Default: ‘‘

The password used for HTTP proxy access.

proxy_password: obolus

DOCKER.COMPARE_CONTAINER_NETWORKS

Default: {‘static‘: [‘Aliases‘, ‘Links‘, ‘IPAMConfig‘], ‘automatic‘: [‘IPAddress‘, ‘Gateway‘, ‘GlobalIPv6Address‘, ‘IPv6Gateway‘]}

Specifies which keys are examined by docker.compare_container_networks.

docker.compare_container_networks:
  static:
    - Aliases
    - Links
    - IPAMConfig
  automatic:
    - IPAddress
    - Gateway
    - GlobalIPv6Address
    - IPv6Gateway

DISABLE_MODULES

Default: [] (all execution modules are enabled by default)

The event may occur in which the administrator desires that a minion should not be able to execute a certain module.

However, the sys module is built into the minion and cannot be disabled.

This setting can also tune the minion. Because all modules are loaded into system memory, disabling modules will lower the minion‘s memory footprint.

Modules should be specified according to their file name on the system and not by their virtual name. For example, to disable cmd, use the string cmdmod which corresponds to salt.modules.cmdmod.

disable_modules:
  - test
  - solr

DISABLE_RETURNERS

Default: [] (all returners are enabled by default)

If certain returners should be disabled, this is the place

disable_returners:
  - mongo_return

WHITELIST_MODULES

Default: [] (Module whitelisting is disabled. Adding anything to the config option will cause only the listed modules to be enabled. Modules not in the list will not be loaded.)

This option is the reverse of disable_modules. If enabled, only execution modules in this list will be loaded and executed on the minion.

Note that this is a very large hammer and it can be quite difficult to keep the minion working the way you think it should since Salt uses many modules internally itself. At a bare minimum you need the following enabled or else the minion won‘t start.

whitelist_modules:
  - cmdmod
  - test
  - config

MODULE_DIRS

Default: []

A list of extra directories to search for Salt modules

module_dirs:
  - /var/lib/salt/modules

RETURNER_DIRS

Default: []

A list of extra directories to search for Salt returners

returner_dirs:
  - /var/lib/salt/returners

STATES_DIRS

Default: []

A list of extra directories to search for Salt states

states_dirs:
  - /var/lib/salt/states

GRAINS_DIRS

Default: []

A list of extra directories to search for Salt grains

grains_dirs:
  - /var/lib/salt/grains

RENDER_DIRS

Default: []

A list of extra directories to search for Salt renderers

render_dirs:
  - /var/lib/salt/renderers

UTILS_DIRS

Default: []

A list of extra directories to search for Salt utilities

utils_dirs:
  - /var/lib/salt/utils

CYTHON_ENABLE

Default: False

Set this value to true to enable auto-loading and compiling of .pyx modules, This setting requires that gcc and cython are installed on the minion.

cython_enable: False

ENABLE_ZIP_MODULES

Default: False

Set this value to true to enable loading of zip archives as extension modules. This allows for packing module code with specific dependencies to avoid conflicts and/or having to install specific modules‘ dependencies in system libraries.

enable_zip_modules: False

PROVIDERS

Default: (empty)

A module provider can be statically overwritten or extended for the minion via the providers option. This can be done on an individual basis in an SLS file, or globally here in the minion config, like below.

providers:
  service: systemd

MODULES_MAX_MEMORY

Default: -1

Specify a max size (in bytes) for modules on import. This feature is currently only supported on *NIX operating systems and requires psutil.

modules_max_memory: -1

EXTMOD_WHITELIST/EXTMOD_BLACKLIST

By using this dictionary, the modules that are synced to the minion‘s extmod cache using saltutil.sync_* can be limited. If nothing is set to a specific type, then all modules are accepted. To block all modules of a specific type, whitelist an empty list.

extmod_whitelist:
  modules:
    - custom_module
  engines:
    - custom_engine
  pillars: []

extmod_blacklist:
  modules:
    - specific_module

Valid options:

• beacons
• clouds
• sdb
• modules
• states
• grains
• renderers
• returners
• proxy
• engines
• output
• utils
• pillar

STATE_TOP

Default: top.sls

The state system uses a "top" file to tell the minions what environment to use and what modules to use. The state_top file is defined relative to the root of the base environment.

state_top: top.sls

STATE_TOP_SALTENV

This option has no default value. Set it to an environment name to ensure that only the top file from that environment is considered during a highstate.

state_top_saltenv: dev

TOP_FILE_MERGING_STRATEGY

Default: merge

When no specific fileserver environment (a.k.a. saltenv) has been specified for a highstate, all environments‘ top files are inspected. This config option determines how the SLS targets in those top files are handled.

When set to merge, the base environment‘s top file is evaluated first, followed by the other environments‘ top files. The first target expression (e.g. ‘*‘) for a given environment is kept, and when the same target expression is used in a different top file evaluated later, it is ignored. Because base is evaluated first, it is authoritative. For example, if there is a target for ‘*‘for the foo environment in both the base and foo environment‘s top files, the one in the foo environment would be ignored. The environments will be evaluated in no specific order (aside from base coming first). For greater control over the order in which the environments are evaluated, use env_order. Note that, aside from the base environment‘s top file, any sections in top files that do not match that top file‘s environment will be ignored. So, for example, a section for the qa environment would be ignored if it appears in the devenvironment‘s top file. To keep use cases like this from being ignored, use the merge_all strategy.

When set to same, then for each environment, only that environment‘s top file is processed, with the others being ignored. For example, only the dev environment‘s top file will be processed for the dev environment, and any SLS targets defined for dev in the base environment‘s (or any other environment‘s) top file will be ignored. If an environment does not have a top file, then the top file from the default_top config parameter will be used as a fallback.

When set to merge_all, then all states in all environments in all top files will be applied. The order in which individual SLS files will be executed will depend on the order in which the top files were evaluated, and the environments will be evaluated in no specific order. For greater control over the order in which the environments are evaluated, use env_order.

top_file_merging_strategy: same

ENV_ORDER

Default: []

When top_file_merging_strategy is set to merge, and no environment is specified for a highstate, this config option allows for the order in which top files are evaluated to be explicitly defined.

env_order:
  - base
  - dev
  - qa

DEFAULT_TOP

Default: base

When top_file_merging_strategy is set to same, and no environment is specified for a highstate (i.e. environment is not set for the minion), this config option specifies a fallback environment in which to look for a top file if an environment lacks one.

default_top: dev

STARTUP_STATES

Default: ‘‘

States to run when the minion daemon starts. To enable, set startup_states to:

• highstate: Execute state.highstate
• sls: Read in the sls_list option and execute the named sls files
• top: Read top_file option and execute based on that file on the Master

startup_states: ‘‘

SLS_LIST

Default: []

List of states to run when the minion starts up if startup_states is set to sls.

sls_list:
  - edit.vim
  - hyper

TOP_FILE

Default: ‘‘

Top file to execute if startup_states is set to top.

top_file: ‘‘

RENDERER

Default: yaml_jinja

The default renderer used for local state executions

renderer: yaml_jinja

TEST

Default: False

Set all state calls to only test if they are going to actually make changes or just post what changes are going to be made.

test: False

STATE_VERBOSE

Default: True

Controls the verbosity of state runs. By default, the results of all states are returned, but setting this value to False will cause salt to only display output for states that failed or states that have changes.

state_verbose: True

STATE_OUTPUT

Default: full

The state_output setting controls which results will be output full multi line:

• full, terse - each state will be full/terse
• mixed - only states with errors will be full
• changes - states with changes and errors will be full

full_id, mixed_id, changes_id and terse_id are also allowed; when set, the state ID will be used as name in the output.

state_output: full

STATE_OUTPUT_DIFF

Default: False

The state_output_diff setting changes whether or not the output from successful states is returned. Useful when even the terse output of these states is cluttering the logs. Set it to True to ignore them.

state_output_diff: False

AUTOLOAD_DYNAMIC_MODULES

Default: True

autoload_dynamic_modules turns on automatic loading of modules found in the environments on the master. This is turned on by default. To turn off auto-loading modules when states run, set this value to False.

autoload_dynamic_modules: True

Default: True

clean_dynamic_modules keeps the dynamic modules on the minion in sync with the dynamic modules on the master. This means that if a dynamic module is not on the master it will be deleted from the minion. By default this is enabled and can be disabled by changing this value to False.

clean_dynamic_modules: True

SALTENV

Normally the minion is not isolated to any single environment on the master when running states, but the environment can be isolated on the minion side by statically setting it. Remember that the recommended way to manage environments is to isolate via the top file.

saltenv: dev

LOCK_SALTENV

Default: False

For purposes of running states, this option prevents using the saltenv argument to manually set the environment. This is useful to keep a minion which has the saltenv option set to devfrom running states from an environment other than dev.

lock_saltenv: True

SNAPPER_STATES

Default: False

The snapper_states value is used to enable taking snapper snapshots before and after salt state runs. This allows for state runs to be rolled back.

For snapper states to function properly snapper needs to be installed and enabled.

snapper_states: True

SNAPPER_STATES_CONFIG

Default: root

Snapper can execute based on a snapper configuration. The configuration needs to be set up before snapper can use it. The default configuration is root, this default makes snapper run on SUSE systems using the default configuration set up at install time.

snapper_states_config: root

FILE_CLIENT

Default: remote

The client defaults to looking on the master server for files, but can be directed to look on the minion by setting this parameter to local.

file_client: remote

USE_MASTER_WHEN_LOCAL

Default: False

When using a local file_client, this parameter is used to allow the client to connect to a master for remote execution.

use_master_when_local: False

FILE_ROOTS

Default:

base:
  - /srv/salt

When using a local file_client, this parameter is used to setup the fileserver‘s environments. This parameter operates identically to the master config parameter of the same name.

file_roots:
  base:
    - /srv/salt
  dev:
    - /srv/salt/dev/services
    - /srv/salt/dev/states
  prod:
    - /srv/salt/prod/services
    - /srv/salt/prod/states

FILESERVER_FOLLOWSYMLINKS

Default: True

By default, the file_server follows symlinks when walking the filesystem tree. Currently this only applies to the default roots fileserver_backend.

fileserver_followsymlinks: True

FILESERVER_IGNORESYMLINKS

Default: False

If you do not want symlinks to be treated as the files they are pointing to, set fileserver_ignoresymlinks to True. By default this is set to False. When set to True, any detected symlink while listing files on the Master will not be returned to the Minion.

fileserver_ignoresymlinks: False

FILESERVER_LIMIT_TRAVERSAL

Default: False

By default, the Salt fileserver recurses fully into all defined environments to attempt to find files. To limit this behavior so that the fileserver only traverses directories with SLS files and special Salt directories like _modules, set fileserver_limit_traversal to True. This might be useful for installations where a file root has a very large number of files and performance is impacted.

fileserver_limit_traversal: False

HASH_TYPE

Default: sha256

The hash_type is the hash to use when discovering the hash of a file on the local fileserver. The default is sha256, but md5, sha1, sha224, sha384, and sha512 are also supported.

hash_type: sha256

PILLAR_ROOTS

Default:

base:
  - /srv/pillar

When using a local file_client, this parameter is used to setup the pillar environments.

pillar_roots:
  base:
    - /srv/pillar
  dev:
    - /srv/pillar/dev
  prod:
    - /srv/pillar/prod

ON_DEMAND_EXT_PILLAR

Default: [‘libvirt‘, ‘virtkey‘]

When using a local file_client, this option controls which external pillars are permitted to be used on-demand using pillar.ext.

on_demand_ext_pillar:
  - libvirt
  - virtkey
  - git

DECRYPT_PILLAR

Default: []

A list of paths to be recursively decrypted during pillar compilation.

decrypt_pillar:
  - ‘foo:bar‘: gpg
  - ‘lorem:ipsum:dolor‘

Entries in this list can be formatted either as a simple string, or as a key/value pair, with the key being the pillar location, and the value being the renderer to use for pillar decryption. If the former is used, the renderer specified by decrypt_pillar_default will be used.

DECRYPT_PILLAR_DELIMITER

Default: :

The delimiter used to distinguish nested data structures in the decrypt_pillar option.

decrypt_pillar_delimiter: ‘|‘
decrypt_pillar:
  - ‘foo|bar‘: gpg
  - ‘lorem|ipsum|dolor‘

DECRYPT_PILLAR_DEFAULT

Default: gpg

The default renderer used for decryption, if one is not specified for a given pillar key in decrypt_pillar.

decrypt_pillar_default: my_custom_renderer

DECRYPT_PILLAR_RENDERERS

Default: [‘gpg‘]

List of renderers which are permitted to be used for pillar decryption.

decrypt_pillar_renderers:
  - gpg
  - my_custom_renderer

PILLARENV

Default: None

Isolates the pillar environment on the minion side. This functions the same as the environment setting, but for pillar instead of states.

pillarenv: dev

PILLARENV_FROM_SALTENV

Default: False

When set to True, the pillarenv value will assume the value of the effective saltenv when running states. This essentially makes salt ‘*‘ state.sls mysls saltenv=dev equivalent to salt ‘*‘ state.sls mysls saltenv=dev pillarenv=dev. If pillarenv is set, either in the minion config file or via the CLI, it will override this option.

pillarenv_from_saltenv: True

PILLAR_RAISE_ON_MISSING

Default: False

Set this option to True to force a KeyError to be raised whenever an attempt to retrieve a named value from pillar fails. When this option is set to False, the failed attempt returns an empty string.

MINION_PILLAR_CACHE

Default: False

The minion can locally cache rendered pillar data under cachedir/pillar. This allows a temporarily disconnected minion to access previously cached pillar data by invoking salt-call with the --local and --pillar_root=:conf_minion:cachedir/pillar options. Before enabling this setting consider that the rendered pillar may contain security sensitive data. Appropriate access restrictions should be in place. By default the saved pillar data will be readable only by the user account running salt. By default this feature is disabled, to enable set minion_pillar_cache to True.

minion_pillar_cache: False

FILE_RECV_MAX_SIZE

Default: 100

Set a hard-limit on the size of the files that can be pushed to the master. It will be interpreted as megabytes.

file_recv_max_size: 100

PASS_TO_EXT_PILLARS

Specify a list of configuration keys whose values are to be passed to external pillar functions.

Suboptions can be specified using the ‘:‘ notation (i.e. option:suboption)

The values are merged and included in the extra_minion_data optional parameter of the external pillar function. The extra_minion_data parameter is passed only to the external pillar functions that have it explicitly specified in their definition.

If the config contains

opt1: value1
opt2:
  subopt1: value2
  subopt2: value3

pass_to_ext_pillars:
  - opt1
  - opt2: subopt1

the extra_minion_data parameter will be

{‘opt1‘: ‘value1‘,
 ‘opt2‘: {‘subopt1‘: ‘value2‘}}

OPEN_MODE

Default: False

Open mode can be used to clean out the PKI key received from the Salt master, turn on open mode, restart the minion, then turn off open mode and restart the minion to clean the keys.

open_mode: False

MASTER_FINGER

Default: ‘‘

Fingerprint of the master public key to validate the identity of your Salt master before the initial key exchange. The master fingerprint can be found by running "salt-key -F master" on the Salt master.

master_finger: ‘ba:30:65:2a:d6:9e:20:4f:d8:b2:f3:a7:d4:65:11:13‘

KEYSIZE

Default: 2048

The size of key that should be generated when creating new keys.

keysize: 2048

PERMISSIVE_PKI_ACCESS

Default: False

Enable permissive access to the salt keys. This allows you to run the master or minion as root, but have a non-root group be given access to your pki_dir. To make the access explicit, root must belong to the group you‘ve given access to. This is potentially quite insecure.

permissive_pki_access: False

VERIFY_MASTER_PUBKEY_SIGN

Default: False

Enables verification of the master-public-signature returned by the master in auth-replies. Please see the tutorial on how to configure this properly Multimaster-PKI with Failover Tutorial

verify_master_pubkey_sign: True

If this is set to True, master_sign_pubkey must be also set to True in the master configuration file.

MASTER_SIGN_KEY_NAME

Default: master_sign

The filename without the .pub suffix of the public key that should be used for verifying the signature from the master. The file must be located in the minion‘s pki directory.

master_sign_key_name: <filename_without_suffix>

AUTOSIGN_GRAINS

Default: not defined

The grains that should be sent to the master on authentication to decide if the minion‘s key should be accepted automatically.

Please see the Autoaccept Minions from Grains documentation for more information.

autosign_grains:
  - uuid
  - server_id

ALWAYS_VERIFY_SIGNATURE

Default: False

If verify_master_pubkey_sign is enabled, the signature is only verified if the public-key of the master changes. If the signature should always be verified, this can be set to True.

always_verify_signature: True

CMD_BLACKLIST_GLOB

Default: []

If cmd_blacklist_glob is enabled then any shell command called over remote execution or via salt-call will be checked against the glob matches found in the cmd_blacklist_glob list and any matched shell command will be blocked.

cmd_blacklist_glob:
  - ‘rm * ‘
  - ‘cat /etc/* ‘

CMD_WHITELIST_GLOB

Default: []

If cmd_whitelist_glob is enabled then any shell command called over remote execution or via salt-call will be checked against the glob matches found in the cmd_whitelist_glob list and any shell command NOT found in the list will be blocked. If cmd_whitelist_glob is NOT SET, then all shell commands are permitted.

cmd_whitelist_glob:
  - ‘ls * ‘
  - ‘cat /etc/fstab‘

SSL

Default: None

TLS/SSL connection options. This could be set to a dictionary containing arguments corresponding to python ssl.wrap_socket method. For details see Tornado and Pythondocumentation.

Note: to set enum arguments values like cert_reqs and ssl_version use constant names without ssl module prefix: CERT_REQUIRED or PROTOCOL_SSLv23.

ssl:
    keyfile: <path_to_keyfile>
    certfile: <path_to_certfile>
    ssl_version: PROTOCOL_TLSv1_2

REACTOR

Default: []

Defines a salt reactor. See the Reactor documentation for more information.

reactor: []

REACTOR_REFRESH_INTERVAL

Default: 60

The TTL for the cache of the reactor configuration.

reactor_refresh_interval: 60

REACTOR_WORKER_THREADS

Default: 10

The number of workers for the runner/wheel in the reactor.

reactor_worker_threads: 10

REACTOR_WORKER_HWM

Default: 10000

The queue size for workers in the reactor.

reactor_worker_hwm: 10000

MULTIPROCESSING

Default: True

If multiprocessing is enabled when a minion receives a publication a new process is spawned and the command is executed therein. Conversely, if multiprocessing is disabled the new publication will be run executed in a thread.

multiprocessing: True

PROCESS_COUNT_MAX

Default: -1

Limit the maximum amount of processes or threads created by salt-minion. This is useful to avoid resource exhaustion in case the minion receives more publications than it is able to handle, as it limits the number of spawned processes or threads. -1 is the default and disables the limit.

process_count_max: -1

LOG_FILE

Default: /var/log/salt/minion

The minion log can be sent to a regular file, local path name, or network location. See also log_file.

Examples:

log_file: /var/log/salt/minion

log_file: file:///dev/log

log_file: udp://loghost:10514

LOG_LEVEL

Default: warning

The level of messages to send to the console. See also log_level.

log_level: warning

LOG_LEVEL_LOGFILE

Default: info

The level of messages to send to the log file. See also log_level_logfile. When it is not set explicitly it will inherit the level set by log_level option.

log_level_logfile: warning

LOG_DATEFMT

Default: %H:%M:%S

The date and time format used in console log messages. See also log_datefmt.

log_datefmt: ‘%H:%M:%S‘

LOG_DATEFMT_LOGFILE

Default: %Y-%m-%d %H:%M:%S

The date and time format used in log file messages. See also log_datefmt_logfile.

log_datefmt_logfile: ‘%Y-%m-%d %H:%M:%S‘

LOG_FMT_CONSOLE

Default: [%(levelname)-8s] %(message)s

The format of the console logging messages. See also log_fmt_console.

log_fmt_console: ‘%(colorlevel)s %(colormsg)s‘
log_fmt_console: ‘[%(levelname)-8s] %(message)s‘

LOG_FMT_LOGFILE

Default: %(asctime)s,%(msecs)03d [%(name)-17s][%(levelname)-8s] %(message)s

The format of the log file logging messages. See also log_fmt_logfile.

log_fmt_logfile: ‘%(asctime)s,%(msecs)03d [%(name)-17s][%(levelname)-8s] %(message)s‘

LOG_GRANULAR_LEVELS

Default: {}

This can be used to control logging levels more specifically. See also log_granular_levels.

ZMQ_MONITOR

Default: False

To diagnose issues with minions disconnecting or missing returns, ZeroMQ supports the use of monitor sockets to log connection events. This feature requires ZeroMQ 4.0 or higher.

To enable ZeroMQ monitor sockets, set ‘zmq_monitor‘ to ‘True‘ and log at a debug level or higher.

A sample log event is as follows:

[DEBUG   ] ZeroMQ event: {‘endpoint‘: ‘tcp://127.0.0.1:4505‘, ‘event‘: 512,
‘value‘: 27, ‘description‘: ‘EVENT_DISCONNECTED‘}

All events logged will include the string ZeroMQ event. A connection event should be logged as the minion starts up and initially connects to the master. If not, check for debug log level and that the necessary version of ZeroMQ is installed.

TCP_AUTHENTICATION_RETRIES

Default: 5

The number of times to retry authenticating with the salt master when it comes back online.

Zeromq does a lot to make sure when connections come back online that they reauthenticate. The tcp transport should try to connect with a new connection if the old one times out on reauthenticating.

-1 for infinite tries.

FAILHARD

Default: False

Set the global failhard flag. This informs all states to stop running states at the moment a single state fails

failhard: False

DEFAULT_INCLUDE

Default: minion.d/*.conf

The minion can include configuration from other files. Per default the minion will automatically include all config files from minion.d/*.conf where minion.d is relative to the directory of the minion configuration file.

INCLUDE

Default: not defined

The minion can include configuration from other files. To enable this, pass a list of paths to this option. The paths can be either relative or absolute; if relative, they are considered to be relative to the directory the main minion configuration file lives in. Paths can make use of shell-style globbing. If no files are matched by a path passed to this option then the minion will log a warning message.

# Include files from a minion.d directory in the same
# directory as the minion config file
include: minion.d/*.conf

# Include a single extra file into the configuration
include: /etc/roles/webserver

# Include several files and the minion.d directory
include:
  - extra_config
  - minion.d/*
  - /etc/roles/webserver

TCP_KEEPALIVE

Default: True

The tcp keepalive interval to set on TCP ports. This setting can be used to tune Salt connectivity issues in messy network environments with misbehaving firewalls.

tcp_keepalive: True

TCP_KEEPALIVE_CNT

Default: -1

Sets the ZeroMQ TCP keepalive count. May be used to tune issues with minion disconnects.

tcp_keepalive_cnt: -1

TCP_KEEPALIVE_IDLE

Default: 300

Sets ZeroMQ TCP keepalive idle. May be used to tune issues with minion disconnects.

tcp_keepalive_idle: 300

TCP_KEEPALIVE_INTVL

Default: -1

Sets ZeroMQ TCP keepalive interval. May be used to tune issues with minion disconnects.

tcp_keepalive_intvl‘: -1

UPDATE_URL

Default: False (Update feature is disabled)

The url to use when looking for application updates. Esky depends on directory listings to search for new versions. A webserver running on your Master is a good starting point for most setups.

update_url: ‘http://salt.example.com/minion-updates‘

UPDATE_RESTART_SERVICES

Default: [] (service restarting on update is disabled)

A list of services to restart when the minion software is updated. This would typically just be a list containing the minion‘s service name, but you may have other services that need to go with it.

update_restart_services: [‘salt-minion‘]

WINREPO_CACHE_EXPIRE_MIN

Default: 0

If set to a nonzero integer, then passing refresh=True to functions in the windows pkg module will not refresh the windows repo metadata if the age of the metadata is less than this value. The exception to this is pkg.refresh_db, which will always refresh the metadata, regardless of age.

winrepo_cache_expire_min: 1800

WINREPO_CACHE_EXPIRE_MAX

Default: 21600

If the windows repo metadata is older than this value, and the metadata is needed by a function in the windows pkg module, the metadata will be refreshed.

winrepo_cache_expire_max: 86400

WINREPO_SOURCE_DIR

Default: salt://win/repo-ng/

The source location for the winrepo sls files.

winrepo_source_dir: salt://win/repo-ng/

WINREPO_DIR

Default: C:\salt\srv\salt\win\repo

Location on the minion where the winrepo_remotes are checked out.

winrepo_dir: ‘D:\winrepo‘

WINREPO_DIR_NG

Default: /srv/salt/win/repo-ng

Location on the minion where the winrepo_remotes_ng are checked out for 2015.8.0 and later minions.

winrepo_dir_ng: /srv/salt/win/repo-ng

WINREPO_CACHEFILE

Default: winrepo.p

Path relative to winrepo_dir where the winrepo cache should be created.

winrepo_cachefile: winrepo.p

WINREPO_REMOTES

Default: [‘https://github.com/saltstack/salt-winrepo.git‘]

List of git repositories to checkout and include in the winrepo

winrepo_remotes:
  - https://github.com/saltstack/salt-winrepo.git

To specify a specific revision of the repository, prepend a commit ID to the URL of the repository:

winrepo_remotes:
  - ‘<commit_id> https://github.com/saltstack/salt-winrepo.git‘

Replace <commit_id> with the SHA1 hash of a commit ID. Specifying a commit ID is useful in that it allows one to revert back to a previous version in the event that an error is introduced in the latest revision of the repo.

WINREPO_REMOTES_NG

Default: [‘https://github.com/saltstack/salt-winrepo-ng.git‘]

List of git repositories to checkout and include in the winrepo for 2015.8.0 and later minions.

winrepo_remotes_ng:
  - https://github.com/saltstack/salt-winrepo-ng.git

To specify a specific revision of the repository, prepend a commit ID to the URL of the repository:

winrepo_remotes_ng:
  - ‘<commit_id> https://github.com/saltstack/salt-winrepo-ng.git‘

Replace <commit_id> with the SHA1 hash of a commit ID. Specifying a commit ID is useful in that it allows one to revert back to a previous version in the event that an error is introduced in the latest revision of the repo.

SSH_MERGE_PILLAR

Default: True

Merges the compiled pillar data with the pillar data already available globally. This is useful when using salt-ssh or salt-call --local and overriding the pillar data in a state file:

apply_showpillar:
  module.run:
    - name: state.apply
    - mods:
      - showpillar
    - kwargs:
          pillar:
              test: "foo bar"

If set to True the showpillar state will have access to the global pillar data.

If set to False only the overriding pillar data will be available to the showpillar state.