Salt 3008 not communicating with SaltStack Config: the fix
After upgrading a Salt master to 3008, VMware SaltStack Config / Aria Automation Config / VCF Salt stops talking to it. Broadcom's KB explains why; here are the fixes and the longer-term choice.
You upgraded a Salt master to 3008, and the commercial console (SaltStack Config, Aria Automation Config, Tanzu Salt or VCF Salt) no longer sees it. Jobs do not return, the master shows as disconnected, and nothing in the console's UI fixes it.
This is a known issue. Broadcom's KB 448159 says the master plugin (SSEAPE) bundled with the 8.18.3 console is incompatible with open-source Salt 3008 and later, and that the patched plugin is not available through the standard VMware Salt UI.
Why it happens#
The commercial console does not talk to minions directly. A plugin installed on every Salt master (the SSEAPE plugin) relays jobs, events, and returns between the master and the console. Salt 3008 changed internals the plugin relied on, so a 3008 master with the old plugin cannot hold the connection.
Your options right now#
- Install the patched plugin by hand on every master. Broadcom's KB describes a patched plugin version. It has to be obtained and installed on each master outside the product UI, and repeated on every new master you build. Follow the KB exactly and keep a record of which masters carry which plugin version.
- Roll the master back to 3006 or 3007. This restores the connection, but only buys time: Salt 3007's active support has ended and 3006 is down to critical fixes only, through June 2027 (Salt support lifecycle).
- Hold the upgrade. The same clock applies: every month on 3006 is a month closer to no fixes at all.
The longer-term question#
The plugin problem is a symptom. The standalone console itself has an end of support date of October 2028 (KB 413088), so a hand-patched plugin on every master is a cost you carry for a product that is being wound down. Most teams we talk to use the 3008 upgrade as the moment to decide what their Salt console will be after 2028. See Broadcom Tanzu Salt end of support: your options.
Gardience runs on Salt 3008 LTS today. It uses salt-api and Salt's own modules, not a proprietary master plugin, so a Salt upgrade does not break the console. It keeps your states, pillars, keys, and minions, and adds a web console with roles and single sign-on, patching and a STIG/CIS-aligned baseline for Windows and Linux, two-person approval and a tamper-evident audit log.
Before you upgrade any master to 3008#
- Inventory your masters and which console plugin version each runs.
- Check your minions. A 3008 master serves 3006 and 3007 minions, but plan to move minions to 3008 LTS too.
- Check your repositories. Salt packages moved from repo.saltproject.io to packages.broadcom.com in late 2024. Old repository definitions fail. See installing Salt after repo.saltproject.io.
- Test on one master first, with the console decision already made.
Questions#
Is there a fix inside the SaltStack Config UI?#
According to Broadcom's KB 448159, no: the patched plugin is not available through the standard VMware Salt UI and has to be applied separately.
Will my minions stop working after the master upgrade?#
The minions keep talking to the master. What breaks is the master's connection to the commercial console, so jobs and returns stop showing in the console.
Does Gardience need a plugin on the master?#
No. Gardience talks to the master through salt-api and syncs ordinary Salt modules to the minions, so it works the same on Salt 3006, 3007, and 3008.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare