SaltStack Cheat Sheet
Reference for Salt states, the salt CLI, grains, pillars, and remote execution for configuration management at scale.
2 PagesAdvancedJan 28, 2026
Basic State (SLS)
A state file installing and running nginx.
yaml
nginx_pkg: pkg.installed: - name: nginxnginx_config: file.managed: - name: /etc/nginx/nginx.conf - source: salt://nginx/files/nginx.conf.jinja - template: jinja - require: - pkg: nginx_pkgnginx_service: service.running: - name: nginx - enable: true - watch: - file: nginx_config
Remote Execution
Common salt CLI commands to target and control minions.
bash
salt '*' test.ping # Ping all minionssalt 'web*' cmd.run 'uptime' # Run command on matching minionssalt 'web*' state.apply # Apply the highstatesalt 'web*' state.apply nginx # Apply a specific statesalt-key -L # List minion keyssalt-key -A # Accept all pending keys
Core Concepts
Key SaltStack terminology.
- master / minion- Central server (master) controls managed nodes (minions) over ZeroMQ
- state (SLS)- YAML file declaring desired system state, executed via state modules
- grains- Static, minion-collected facts (OS, IP, hardware) used for targeting
- pillar- Secure, minion-specific key-value data (e.g. secrets) pushed from the master
- top.sls- Maps states to minions/environments, defining the highstate
- execution module- Ad-hoc functions (pkg, cmd, service) runnable via 'salt' remote exec
top.sls
Maps which states apply to which minions.
yaml
base: 'web*': - nginx - common 'db*': - postgres - common
Orchestration
Coordinate multi-stage, multi-minion rollouts from the master using the orchestrate runner.
yaml
# salt://orch/deploy.sls, run with: salt-run state.orchestrate orch.deploydrain_lb: salt.state: - tgt: 'lb*' - sls: loadbalancer.drainupdate_web_batch: salt.state: - tgt: 'web*' - sls: webapp.deploy - batch: 2 - require: - salt: drain_lbrestore_lb: salt.state: - tgt: 'lb*' - sls: loadbalancer.restore - require: - salt: update_web_batch
Reactor System
React to Salt events in real time by wiring the reactor engine to run states or execution modules.
yaml
# /etc/salt/master.d/reactor.confreactor: - 'salt/minion/*/start': - salt://reactor/highstate_on_start.sls - 'myapp/deploy/requested': - salt://reactor/run_deploy.sls# salt://reactor/run_deploy.slsdeploy_app: local.state.apply: - tgt: {{ data['minion_id'] }} - arg: - webapp.deploy# Fire a custom event from a minion or the master:# salt-call event.send 'myapp/deploy/requested' "{'minion_id': 'web1'}"
Jinja in State Files
Use Jinja templating with pillar and grains data to generate dynamic state files.
yaml
{% set app_port = salt['pillar.get']('myapp:port', 8080) %}{% set os_family = grains['os_family'] %}myapp_config: file.managed: - name: /etc/myapp/config.yml - source: salt://myapp/files/config.yml.jinja - template: jinja - context: port: {{ app_port }}{% if os_family == 'Debian' %}install_deps: pkg.installed: - pkgs: - libssl-dev{% elif os_family == 'RedHat' %}install_deps: pkg.installed: - pkgs: - openssl-devel{% endif %}
Advanced Salt Ecosystem
Tools and subsystems used to scale and extend Salt beyond basic state application.
- salt-ssh- Agentless mode that pushes states over SSH to minions without a running salt-minion daemon
- salt-cloud- Provisions and manages VMs across cloud providers, auto-registering them as minions
- mine- Cache of function results (e.g. IPs) periodically pushed by minions and shared with other minions
- beacons- Minion-side monitors that watch for OS-level events (file changes, load, service status) and fire events
- returners- Modules that send job/state results to external systems (databases, message queues, APIs)
- orchestrate runner- Master-side runner (state.orchestrate) for sequencing multi-minion, multi-stage workflows
- GPG pillar- Pillar renderer that decrypts GPG-encrypted values inline for secret storage
Advanced Requisites
Go beyond require/watch with onchanges, prereq, and listen for finer-grained state ordering.
yaml
app_config: file.managed: - name: /etc/app/config.yml - source: salt://app/files/config.ymlrestart_app_on_config_change: cmd.run: - name: systemctl restart app - onchanges: - file: app_configbackup_before_upgrade: cmd.run: - name: /usr/local/bin/backup-app.sh - prereq: - pkg: app_upgradeapp_upgrade: pkg.latest: - name: myappreload_nginx_on_any_change: cmd.run: - name: nginx -s reload - listen: - file: /etc/nginx/nginx.conf - file: /etc/nginx/sites-enabled/*
Pro Tip
Use compound target matching, e.g. salt -C 'G@os:Ubuntu and web*' state.apply, to precisely target minions by combining grains, roles, and glob patterns in one command.
Was this cheat sheet helpful?
Explore Topics
#SaltStack#SaltStackCheatSheet#DevOps#Advanced#BasicStateSLS#RemoteExecution#CoreConcepts#TopSls#CommandLine#CheatSheet#SkillVeris
