Broadcom Tanzu Salt end of support (Oct 2028): your options
Broadcom set October 2028 as end of support for its standalone Salt console (SaltStack Config, Aria Automation Config, Tanzu Salt). What that means and the three realistic paths.
If you run Salt with VMware's commercial console on top, the product has had five names in six years: SaltStack Enterprise, vRealize Automation SaltStack Config, VMware Aria Automation Config, VMware Tanzu Salt, and now VMware Cloud Foundation SaltStack (VCF Salt). The name matters less than the date: Broadcom's own knowledge base article KB 413088 says the standalone Tanzu Salt solution has an end of support date of October 2028, "or the end of any contract expiration date, whichever comes first."
Someone on your team has to decide what happens before then. These are the facts and the options.
What actually ends, and what does not#
Two different things share the word "Salt":
| What it is | Status | |
|---|---|---|
| Open-source Salt | The master, the minions, states, pillars, the event bus | Actively maintained. Salt 3008 LTS is the current release, with critical fixes through June 2028 (Salt support lifecycle). |
| The commercial console | SaltStack Config / Aria Automation Config / Tanzu Salt: the web UI, RBAC, job scheduling, compliance content | Standalone support ends October 2028. Broadcom now sells Salt mainly inside VMware Cloud Foundation. |
Your minions, states, and pillars are open-source Salt. They keep working whatever happens to the console. What you lose at the end of support is the layer your team uses every day: the UI, role-based access, scheduling, reporting and the compliance content.
Why many teams are not waiting until 2028#
- Salt 3008 and the console do not mix cleanly. Broadcom's KB 448159 says the master plugin shipped with the console is incompatible with Salt 3008, and the patched plugin is not available through the product's own UI. Salt 3006 leaves active support before 2028, so you will face this upgrade either way. See Salt 3008 and SaltStack Config.
- Licensing. Broadcom's program terms for VMware SaltStack (May 2025) license it per CPU core, with a minimum of 16 cores per processor, and do not allow deploying it on cloud services (program terms).
- The compliance add-on is already gone. SaltStack SecOps stopped being sold standalone in January 2024, and its listed replacement, Tanzu Guardrails, reached end of life in October 2024. See replacing SaltStack SecOps.
Your three realistic options#
1. Move into VMware Cloud Foundation#
If you are already all-in on VCF and its pricing works for you, this is the path of least change. Check how Salt is licensed under your VCF agreement before assuming it is included; Broadcom documents a separate Salt license key.
2. Run plain open-source Salt with no console#
Salt itself does everything the console drove: states, highstate, scheduling through the Salt scheduler, reactors. Some teams are fine on the command line. What you give up is the shared UI, role-based access for people who should not have a shell on the master, compliance reporting, and an audit trail auditors accept. If those mattered enough to buy a console once, they still matter.
3. Keep your Salt, change the console#
This is the option Gardience exists for. Gardience is a supported console on open-source Salt (3006, 3007 and
- for Windows and Linux. It keeps your masters' states, pillars, keys, and minions, and adds:
- a web console with roles, single sign-on (SAML, OpenID Connect), Active Directory or LDAP;
- patching and a scored STIG/CIS-aligned baseline with one-click fixes and drift repair;
- two-person approval, change windows, and machine locks;
- a tamper-evident audit log with a signed evidence pack for auditors;
- an AI assistant that turns plain English into the exact Salt command or state, and runs nothing until a person approves it;
- flat yearly pricing per fleet size instead of per core.
It can attach to your existing Salt master or install its own, and it runs fully offline for air-gapped sites.
A migration plan that fits in a quarter#
- Inventory what you use in the console today: job templates, schedules, compliance policies, RBAC roles.
- Stand up the replacement next to it, on a test master or attached to an existing one, and point a few minions at it while you compare.
- Move schedules and jobs into runbooks and schedules; move compliance checks to the baseline.
- Upgrade the masters to Salt 3008 LTS once nothing depends on the old plugin.
- Retire the console before your renewal date, not after it.
Questions#
Does my Salt stop working in October 2028?#
No. Open-source Salt keeps running. The commercial console's standalone support ends, and with it the UI, access control, reporting, and compliance content your team relies on.
Can I upgrade to Salt 3008 and keep SaltStack Config?#
Broadcom's KB 448159 says the bundled master plugin is incompatible with Salt 3008 and the patched plugin is not available through the product UI. Plan the console decision and the 3008 upgrade together.
Do I have to rewrite my states to leave the Broadcom console?#
No. States, pillars, and minions are open-source Salt. A console built on open-source Salt, such as Gardience, uses them as they are.
How long does a switch take?#
For most fleets, a quarter is comfortable: a few weeks running side by side, then moving schedules and compliance checks, then the 3008 upgrade. Gardience offers a free migration assessment and a 90-day trial.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare