Salt Master on Ubuntu 24.04 by cloudimg

Salt Master on Ubuntu 24.04 by cloudimg

Salt is an open source platform for configuration management and remote execution. A Salt master publishes commands and state to Salt minions and collects their returns, so you can describe how a fleet of machines should be configured, apply that description, and run ad hoc commands across the whole fleet in seconds.

This image is a Salt master appliance, and it ships as a working one. A local minion is already connected to the master and accepted, and a small state and pillar tree is in place, so `salt '*' test.ping` and `salt '*' state.apply` both do something real the moment the VM boots.

### Built for the fact that a Salt master is a control plane

Anything that can command a Salt master can command every machine it manages, as root. Internet exposed masters have been compromised at scale. Salt's trust model is minion key based, not password based, so this image is built around that:

• No key material in the image at all. No master key pair, no minion key pair, no accepted minion key and no minion id. Every machine generates its own identity on first boot.
• The transport is closed by default. Ports 4505 and 4506 are bound to 127.0.0.1, so SSH is the only routable listener on a freshly launched VM. Opening it to remote minions is a documented, deliberate opt in.
• Automatic key acceptance is off, with no autosign file and no autosign grains directory, and authentication cannot be disabled. A guard reads the effective merged configuration through Salt's own loader and stops the master starting if any of that is weakened.
• The local minion is accepted by identity, not by arrival order — only after its key is confirmed byte for byte to be this machine's own.
• No HTTP control plane. salt-api and web servers are not installed.

### Provenance and licensing

Salt 3008.2, the newest release of the current long term support branch, installed from the Salt Project's own packages and verified by SHA-256 content hash, with the licence inside the shipped artifact tied to the exact upstream commit. Every Python distribution in the image is licence audited into an inventory that ships on the machine.

### Included

• Salt 3008.2 master and minion, pinned by content hash
• A local minion already accepted, and a working state and pillar tree
• A fingerprint helper that makes Salt's own key verification workflow usable
• A step by step cloudimg deployment guide and 24/7 support