VMware Tanzu Salt alternative: keep Salt, change the console
Broadcom ends support for VMware Tanzu Salt (Aria Automation Config, formerly SaltStack Config) in October 2028 and publishes no price. Gardience runs on the same open-source Salt, keeps your states and agents, and has a public flat price.
If you run VMware Tanzu Salt, known before as Aria Automation Config, vRealize Automation SaltStack Config, and SaltStack Enterprise, three facts shape your next renewal:
- A dated end. Broadcom's own support article gives Tanzu Salt an end of support of October 2028.
- No public price. Tanzu Salt is sold by quote only, inside Broadcom's licensing, whose minimums have changed more than once since the VMware acquisition.
- Upgrades that bite. Broadcom documents that moving masters to Salt 3008 cuts them off from its console until a patched plugin is installed by hand on every master.
Your Salt states, pillars, and agents are not the problem. The console around them is.
Same engine, different console#
Gardience is built on current open-source Salt. Your agents keep running, your states keep working, and your team keeps the Salt it knows. What changes is everything around the engine:
| Tanzu Salt | Gardience | |
|---|---|---|
| Engine | Salt | Salt (current open-source release) |
| Price | Quote only | Public: $6,000 a year up to 250 machines, $15,000 up to 1,000 |
| Support horizon | Ends October 2028 | Current Salt, released and supported |
| Windows and Linux patching | States you write, or the SecOps add-on | Built in, with pilot and broad rings and change windows |
| Vulnerabilities | SecOps add-on | CVE matching with CISA's exploited list and EPSS, fix one CVE on only the exposed machines |
| Compliance | SecOps add-on (CIS and DISA STIG content) | DISA STIG checklists for eMASS, CMMC Level 2 evidence |
| Ansible | No | Runs your existing playbooks over Salt, including on Windows without WinRM |
| Approvals and audit | Roles and job history | Two-person approval steps, tamper-evident audit log |
| Offline install | Yes | Yes, from a signed offline bundle |
How the move works#
- Install Gardience next to what you run today. It takes about five minutes on a Linux server.
- Point a test group of agents at it. Your existing states and pillars come with you.
- Or keep your master. Attach mode connects Gardience to the Salt master you already run, with an undo that puts the master's configuration back exactly as it was.
- Move group by group before your next Broadcom renewal, not after it.
See Switching from Tanzu Salt for the step-by-step plan.
When to stay#
If you are inside a VMware Cloud Foundation agreement that already pays for Tanzu Salt and you have years left on it, staying until near the October 2028 date is reasonable. Plan the move now so it is not rushed.
Start a free 90-day trial, or book a 15-minute demo and bring your hardest state file.
Sources: Broadcom KB 413088 (Tanzu Salt transition and October 2028 end of support); Broadcom KB 448159 (Salt 3008 and the master plugin); Tanzu Salt licensing documentation; reporting on Broadcom core minimums by heise and it-daily. Seen November 3, 2026.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare