Master SaltStack Access Control & Syndic Setup

Published by: DevOps Nexus | Category: SaltStack Tutorials | Skill Level: Intermediate

In this in-depth guide, you’ll learn how to configure SaltStack access control, use the syndic setup to manage multiple masters, and define granular user permissions without compromising your infrastructure’s security. This tutorial is ideal for intermediate-level DevOps professionals looking to optimize automation workflows using SaltStack.

🔐 What is SaltStack Access Control?

SaltStack provides a robust access control system that uses publisher ACLs to restrict or grant command execution access to specific users or groups. With this setup:

• You can allow developers to run only approved commands
• Admins can audit which users executed what jobs
• Integration with external authentication systems (LDAP, PAM) is seamless

📡 Understanding SaltStack Syndic for Multi-Master Configuration

The syndic daemon allows SaltStack to support multiple masters in a hierarchical architecture. The syndic master acts as a minion to its upstream master while acting as a master to downstream minions.

Benefits of a Syndic Setup:

• Scalability for large infrastructures
• Redundancy and fault tolerance
• Better separation of operational domains

⚙️ Setting User Permissions in SaltStack

Salt uses ACLs configured in the /etc/salt/master file. Here's an example:

publish_acl:
  dev_user:
    - test.ping
    - cmd.run
  admin:
    - .*

This ensures dev_user can only run test.ping and cmd.run, while admin has full access.

📁 Job Management and Logs

Salt assigns each job a unique JID and stores execution info in the /var/cache/salt/master/jobs directory. Use modules like:

• saltutil.find_job
• saltutil.kill_job
• jobs.lookup_jid

These help manage running or past jobs with precision.

📦 Automating with SLS Formulas & Highstate

SLS (Salt State) files allow reusable automation. You can create a package installation script like this:

web-setup:
  pkg.installed:
    - pkgs:
      - apache2
      - php
      - mysql-server

To apply, use:

salt 'webminion' state.sls web-setup

Using Highstate

The highstate command executes all states defined in the top.sls file across specific minions. Use:

salt '*' state.highstate

🛠️ Troubleshooting SaltStack

Common fixes:

• Ensure file_roots is set properly
• Move files from /etc/salt to /srv/salt
• Enable logging with appropriate log levels (debug/info/error)

📘 Want to dive deeper? Read our full SaltStack DevOps Guide or watch the full series on YouTube.

📌 Useful Timestamps

• 00:11 – What is SaltStack Access Control
• 09:20 – Configuring ACL and LDAP Authentication
• 16:03 – Minion Execution, Runners, Job IDs
• 23:59 – Writing SLS Formulas
• 50:32 – Highstate Usage and Top.sls
• 57:32 – Salt Logging Configuration

🔗 Related Reads

• How to Install SaltStack on Ubuntu 22.04
• SaltStack vs Ansible: Which One to Use?
• Mastering SaltStack Orchestration with Reactors

Let us know in the comments how you're using SaltStack in your infrastructure!