VMware Tanzu Salt alternative: keep your Salt, change the console
Gardience is a VMware Tanzu Salt alternative built on the same open-source Salt, so your states, pillars, keys, and agents carry over unchanged. Broadcom ends standalone Tanzu Salt support in October 2028 and sells it by quote. Gardience runs on Salt 3008 LTS today, adds patching, STIG scans, and CMMC evidence, and costs $15,000 a year at 1,000 machines.
- Oct 2028end of standalone Tanzu Salt support (Broadcom KB 413088)
- 0states, pillars, or agents to rewrite
- 3008 LTSSalt release Gardience runs today
- $15,000a year at 1,000 machines, public price
VMware Tanzu Salt is Broadcom's commercial console for Salt, sold before as SaltStack Enterprise, vRealize Automation SaltStack Config, and VMware Aria Automation Config. Gardience is a supported console on current open-source Salt for Windows and Linux. The engine underneath is the same; the console, the price, and the support horizon are what change.
How does Gardience compare to Tanzu Salt (SaltStack Config, Aria Automation Config)?
#| VMware Tanzu Salt | Gardience | |
|---|---|---|
| Pricing model | Quote only; per CPU core, 16-core minimum per processor (program terms, May 2025) | Flat yearly price per fleet |
| Price at 1,000 machines | Not published | $15,000 a year (Team), Windows and Linux |
| Windows | Yes | Yes: every Windows Server from 2016 to 2025, plus Windows 10 and 11 |
| Linux | Yes | Yes: RHEL, Oracle, Rocky, SUSE, Ubuntu, Debian, and Amazon Linux, each verified on real machines |
| How it reaches machines | Salt agent | Salt agent; your existing agents keep running |
| Offline (air-gapped) install | Yes | Yes: fully offline from one signed bundle |
| Patching | States you write, or the SecOps add-on | Built in: pilot and broad rings, change windows, second-person approval |
| Vulnerabilities | SecOps add-on, no longer sold standalone since January 2024 | CVE matching with CISA KEV due dates and EPSS |
| DISA STIG checklists for eMASS | SecOps compliance content | Yes: Windows Server 2016 to 2025, Windows 10 and 11, RHEL family, SLES, and Ubuntu, with DISA STIG scans and a STIG Viewer checklist per machine |
| CMMC Level 2 | Not part of Tanzu Salt | Covers all 110 requirements: live SPRS score, SSP, POA&M, signed evidence pack |
| Approvals and audit | Roles and job history | Two-person approval, change windows, tamper-evident audit log |
| Ansible playbooks | No | Runs your existing playbooks over Salt, Windows included |
| Support horizon | Standalone support ends October 2028 | Current open-source Salt (3006, 3007, and 3008 LTS), signed releases |
Why do teams leave Tanzu Salt?
#- A dated end. Broadcom's KB 413088 gives standalone Tanzu Salt an end of support of October 2028, "or the end of any contract expiration date, whichever comes first."
- Salt 3008 breaks the console. Broadcom's KB 448159 says the bundled master plugin is incompatible with Salt 3008 until a patched plugin is installed by hand on every master. Salt 3006 loses critical fixes in June 2027, so the upgrade is coming either way.
- The compliance add-on is gone. SaltStack SecOps stopped being sold standalone in January 2024, and its listed replacement, Tanzu Guardrails, reached end of life in October 2024.
- No public price. Tanzu Salt is sold by quote only, inside Broadcom licensing whose minimums have changed more than once since the VMware acquisition.
What do you keep when you move?
#- Your states and pillars. They are open-source Salt and run unchanged.
- Your agents and keys. Point a test group at Gardience, or attach Gardience to the master you run today.
- Your master, if you want it. Attach mode connects Gardience to your existing Salt master, with an undo that puts the master's configuration back exactly as it was.
How does the move work?
#| Step | What you do | Time |
|---|---|---|
| 1 | Install Gardience next to Tanzu Salt on a Linux server | About 5 minutes |
| 2 | Attach it to your master, or point a test group of agents at it | Under an hour |
| 3 | Move schedules and jobs into runbooks; move compliance checks to the baseline and STIG scans | A few weeks |
| 4 | Upgrade masters to Salt 3008 LTS once nothing depends on the old plugin | One change window |
| 5 | Retire the Tanzu Salt console before your renewal date | At renewal |
Migration help from Broadcom's console, with your team, one group at a time, starts at $5,000 one time (services). The step-by-step plan is on switching from Tanzu Salt.
When does staying on Tanzu Salt make sense?
#If you are inside a VMware Cloud Foundation agreement that already pays for Tanzu Salt and you have years left on it, staying until near the October 2028 date is reasonable. Plan the move now, test Gardience on a group of agents, and move group by group before your renewal, so the change is not rushed.
Questions
#Does my Salt stop working in October 2028?
#No. Open-source Salt keeps running. What ends is standalone support for the commercial console: its UI, access control, reporting, and compliance content.
Do I have to rewrite my states to leave Tanzu Salt?
#No. States, pillars, keys, and agents are open-source Salt, and Gardience uses them as they are.
Can Gardience run on Salt 3008?
#Yes. Gardience runs on Salt 3006, 3007, and 3008 LTS, and mixed fleets work side by side. See supported platforms.
What replaces SaltStack SecOps?
#Gardience includes CVE matching with CISA KEV and EPSS, a scored STIG/CIS-aligned baseline on Windows and Linux, DISA STIG scans with STIG Viewer checklists for eMASS on Windows and Linux, and CMMC Level 2 evidence, with no add-on to buy.
Sources: Broadcom KB 413088 and KB 448159; Broadcom VMware SaltStack program terms (May 2025); Salt Project version support lifecycle; reporting on Broadcom core minimums by heise and it-daily. Seen November 3, 2026.
Read more
- Broadcom Tanzu Salt end of support (Oct 2028): your options
- Keep your Salt master, add a console: a blueprint for Salt and Tanzu Salt shops
- Salt 3008 not communicating with SaltStack Config: the fix
- SaltStack SecOps is gone: STIG and CIS compliance on Salt now
- Salt 3006 end of life: planning the move to Salt 3008 LTS
- repo.saltproject.io is gone: install and pin Salt in 2026
Planning a move from Tanzu Salt?
Book a migration call and bring your hardest state file or playbook. We walk through what carries over, what changes, and a plan that runs both side by side. Gardience Team is $15,000 a year at 1,000 machines.
Book a migration callThe Tanzu Salt migration planSee pricing