(release-3008.0)=
Salt 3008.0 release notes#
Salt Resources#
Salt 3008.0 introduces Salt Resources — a first-class targeting primitive for things a minion manages on behalf of the master, like SSH hosts, virtual appliances, API endpoints, or any other "remote thing" that can't or shouldn't run a minion of its own.
A managing minion can manage many resources of many types. Each
resource is addressable by id, by type, or by per-resource grains —
the same targeting forms (-G, -L, -C, glob, list) work
identically against resources and minions.
Highlights:
New compound targeting engine
T@<type>[:<id>]selects resources by type, by full SRN, or both. Grain targeting (-G,G@) and PCRE grain targeting (-P,P@) augment matches with per-resource grain dicts the master cached at registration time.The master keeps an mmap-backed registry of which minion manages which resource (
salt.utils.resource_registry). Lookups and inserts are O(1); the registry survives master restarts.A managing minion builds a per-resource execution and state loader keyed by resource type. Per-type modules live under
salt/resources/<type>/{modules,states,grains}/(or under any Salt extension'ssaltext/<ext>/resources/<type>/tree), with override files winning their slot by directory order. Standard Salt modules fill any slot a resource type doesn't override.Merge-mode
state.apply/state.highstate/state.slsagainst resource targets folds per-resource state results into one combined block on the managing minion, prefixed by resource id, matching how any other minion looks to the master.New escape-hatch dunder
__minion__gives per-resource execution and state modules explicit access to the managing minion's loader when they need to do something on the host.New operator runners:
salt-run resource.list_grains,salt-run resource.show_grains,salt-run resource.refresh.New
salt-callflags-r/--resources,--tgt, and--tgt-typemake resource dispatch available from masterless and local troubleshooting workflows.
Two reference resource types ship with Salt: dummy
(filesystem-backed, for tests and tutorials) and ssh (over the salt-ssh
transport). Extension authors can ship their own resource types via a
standard salt.loader entry point — no core changes required.
See the Salt Resources documentation for the conceptual overview, the tutorial for a 10-minute walk-through, and the authoring guide for shipping your own resource type.
Changelog#
Removed#
Remove commuity extensions from Salt codebase #65970
Remove deprecated module search path priority (
features.enable_deprecated_module_search_path_priority) #66025Remove the orchestration key from salt.runner and salt.wheel return data. #66151
Removed linode-python package dependency for retired Linode API v3 #68871
Removed legacy
salt.transport.ipcmodule and unusedPushChannel/PullChannelfactories; local events useipc_publish_client/ipc_publish_server(TCP transport). #69001
Deprecated#
Deprecated the use of egrep in favor of grep -E #65608
Changed#
Make sure every auth event has the 'act' key set #56200
Ansiblegate discover_playbooks was changed to find playbooks as either *.yml or *.yaml files #66048
re-work the aptpkg module to remove system libraries that onedir and virtualenvs do not have access. Streamline testing, and code use to needed libraries only. #66056
Made gpg modules respect user's GNUPGHOME if set in shell environment #66313
Made
gpg.presentattempt to refresh keys if they are expired #66314Made x509_v2 the default x509 modules. Until they are removed in the next major release, you can still revert to the old modules by setting
features: {x509_v2: false}in the configuration #66384Included Salt extensions in Salt-SSH thin archive #66559
Add support for additional options in several mac_brew_pkg methods #66611
Make test_pip and test_fileserver tests compatible with venv execution #66703
Do not use
ssl.PROTOCOL_TLSwhich has been #66767deprecated in #66767
Python 3.10 will be removed in the future. #66767
Remove warning when running
slsutil.rendereron non-SLS files #67067PillarCache: reimplement using salt.cache #68030
fix minion data cache organization/move pillar and grains to dedicated cache banks #68030
salt.cache: allow cache.store() to set expires per key #68030
Provide token storage using the salt.cache interface #68039
Update packaged python from 3.10 to 3.11 #68148
Added ceph to the specialFSes to match on name for set_fstab #68207
Removed
networkxmodule dependency by adding MultiDiGraph implementation tosalt.utils.requisiteto avoid extra dependencies. #68748Expanded Thorium documentation with concrete examples and added unit coverage for the documented Thorium workflows. #68857
Add stub 3008.0 release notes (and template) so
tools docs manand CIprepare-releasecan resolve the current-release doc target. Excludedoc/topics/proposals/*.mdfrom Sphinx so stand-alone proposal files do not fail strict man builds. #68964
Fixed#
Fixed recursive prereq requisites to report recursive requisite error. #8210
Fixed erroneous recursive requisite error when a prereq is used in combination with onchanges_any. #47154
Fixed an infinite loop in
requisite_anywhen a requisite state was not found. #50436Refactoring the redis code obsoletes this issue as return values are either decoded directly or passed to salt.payload for parsing. #54734
Fixed
OSError: The operation completed successfullyraised byCreateProcessWithTokenWon Windows when the underlying advapi32 call fails. The error code is now read fromctypes.get_last_error()(the ctypes-saved slot) instead ofwin32api.GetLastError()(the live Windows slot, which may be reset to 0 before it is read). #57848Fixed dependency resolution to not be quadratic. #59123
Fix regex cache exception during sort in sweep function #59437
Fixed requisites by parallel states on parallel states being evaluated synchronously (blocking state execution for other parallel states) #59959
Fix bug when specifying template_source using net.load_template #60515
During the redis refactor the documentation was updated to reference the Redis Cluster pip package. #60899, #66193
firewalld: normalize new rich rules before comparing to old ones #61235
Fix regression that prevented salt-minion from running interval-based jobs on startup by default. #61964
Fixed performance when state_aggregate is enabled. #62439
Fixed LGPO
get_policy_infoincorrectly returning a "multiple policies" error when duplicate ADMX policy definitions (e.g.TerminalServer.admxandTerminalServer-Server.admx) resolve to the same full path. #62732Fixed issue with salt-ssh hanging due to non-exposed host key acceptance prompt #62782
Repaired zypper repositories being reconfigured without changes #63402
Fix calculation of SLS context vars when trailing dots on targetted state #63411
Catch StrictUndefined in salt jinja custom filters. #64915
Put default
optimization_orderto LazyLoader to prevent possible fails on testing #65266Fixed aggregation to correctly honor requisites. #65304
Fixed some instances of deprecated datetime.datetime.utcnow() #65604
Introduce pruning option in file.keyvalue #65631
fix 65703 by using OrderedDict instead of a index that breaks. . #65703
Simplify timezone.compare_zone to primarily rely get_zone() #65719
Handle regular expressions which do not not use grouping #65722
fix consul.acl_create rule creation #65788
Fix salt-cloud get_cloud_config_value for list objects #65789
Prevent exceptions with fileserver.update when called via state #65819
Fix granting of privileges on Postgres functions #65839
Made Salt Cloud Hetzner module detect image architecture from instance type #65888
Optimize async calls with using async wrapped method in thread only if io loop is already running #65983
salt.auth.pam: fallback to use running Python in case /usr/bin/python3 is not found #66035
Fix file.is_link hangs on paths that are hung mounts #66096
Fix file.managed and file.serialize default tmp_dir to relative path #66098
Make win_timezone recognize Qyzylorda timezone #66176
Remove firing useless events with JID as a tag #66279
Made gpg modules create GNUPGHOME if it does not exist #66312
Fixed an issue where conflicting top level keys in the static grains file #66445
(usually
/etc/salt/grains) would break all grains states, and prevent static #66445grains from being loaded. #66445
Fixed beacon delete not calling the beacon's close function, causing resource #66449
leaks (e.g. inotify file descriptors) and CPU spin after deleting beacons at #66449
runtime via
beacons.delete. Also fixed inotify file descriptor leak during #66449beacon refresh when the Beacon instance is replaced. #66449
Fixed a regression where setting
ipv6: truein the minion configuration #66603caused the minion to fail to start on Windows. Three IPC socket paths in the #66603
TCP transport hardcoded
AF_INETor127.0.0.1regardless of the IPv6 #66603setting: the IPC publish server/client addresses in
salt.transport.base, #66603the
TCPPullerserver socket, and the_TCPPubServerPublisherclient #66603socket. On Windows, mixing an
AF_INET6socket with the IPv4 loopback #66603address (or vice-versa) is rejected by the OS. All three paths now use #66603
::1withAF_INET6whenipv6: trueis set, and127.0.0.1#66603with
AF_INETotherwise. #66603Make "status.diskusage" more robust and prevent crashes when stats cannot be obtained #66646
Use
--cachedirparameter for settingextension_moduleswith salt-call. #66742Don't schedule
__master_alivejobs ifmaster_alive_intervalis not specified #66757Make x509 module compatible with
cryptographymodule newer than43.0.0#66818Fixed Python 3.13 compatibility regarding urllib.parse module #66898
make salt.channel.server.handle_message codepath more defensive #66909
Fix the installation of pip modules with special characters in the module name #66988
Repaired mount.fstab_present always returning pending changes #67065
dictupdate.update: throw a TypeError when trying to merge a list with a mapping when
merge_lists=True. #67092Remove usage of spwd #67119
Fixed order chunks not handling a state with both require and order first or last #67120
Fixed pkg.install in test mode would not detect FreeBSD packages installed by their origin name #67126
Fix virtual grains for VMs running on Nutanix AHV #67180
The redis refactor fixed the incorrect handling of the cache.list function. #67250
Fixed creating relative directory symlinks on Windows, ensured listing targets of symlinks in file_roots always produces POSIX-style paths #67766
Avoid loading
salt.utils.cryptmodule instead ofcryptif it's missing in Python as it was deprecated and removed in Python 3.13. #67797Fixed docstring error in salt/modules/file.py that misnamed an option "user" when it should have been "owner". #67911
salt.key: check_minion_cache performance optimization #68030
when a file is managed, and the same file is cleaned, an incorrect message is displayed saying "removed: Removed due to clean" when the file isn't actually removed. Now the correct message is returned. #68052
log_beacon - remove verbose minion log output #68055
Fix that the state
saltmod.statecan be used on a masterless minion with salt-ssh likesaltmod.functioncurrently does. #68116Fixed ssh_known_hosts.present failure when ssh host keys changed #68132
grains.disks: fix exception with incompatible output of Get-PhysicalDisk #68184
Made osfinger report major&minor version for NixOS #68230
Fix tests failing on AlmaLinux 10 and other clones #68246
Speedup wheel key.finger call by removing redundant processing calls. #68251
Fixed cp.cache_file when using Tornado > 6.4 #68328
Stop mutating locals, which is unsupported in Py >=3.13 #68445
Add
blockdevstate module back in to core #68465Adds the
blockdevstate module back into the core Salt repo as it is critical functionality that shouldn't have been pulled out in the module migration #68465Adds
mdadmandlvmgrains modules back in to core. #68470Restores the modules that had been removed as part of the community module #68470
migration. They are core bits of functionality and the associated execution and #68470
states modules had not been removed. #68470
Fixed grains.list_present state to correctly handle multiple calls within the same state run. #68520
Fixed
salt.utils.platformto properly handle__salt_system_encoding__when synced as an extension module. #68520Improved
network.tracerouteparsing to be more robust across different traceroute versions. #68520Added retry logic to
saltutil.wheelintegration test to improve reliability in CI. #68520Improved architecture detection in
salt-sshto better support ARM64 platforms. #68520Fixed
salt-sshextension module syncing to avoid accidentally bundling core Salt modules and to correctly load wrapper modules. #68520Ensured
salt-sshrelenv tests skip gracefully if the relenv tarball is unavailable in the test environment. #68520Fixed
mine.getrunner to correctly handle master's ID when ACLs are enabled. #68520Fixed
win_useradd.get_user_sidto correctly handle non-string input. #68520Improved reliability of
state.runningintegration test forsalt-ssh. #68520Fixed high CPU usage in minion asynchronous authentication loop when masters are unreachable. #68520
Added support for running Salt tools using
python -m tools. #68520Adds
aliasstate module back in to core. #68574Restores the module that had been removed as part of the #68574
community module migration. The associated execution module #68574
had not been migrated. #68574
Fixed mongodb tops module authentication to be compatible with pymongo v4+ by passing credentials directly to MongoClient instead of using the deprecated authenticate() method #68659
Improved the rejected authentication warning message to include the minion ID, #68671
making it easier for administrators to identify which minions need upgrading. #68671
This PR fixes a bug where corrupted grains cache files cause unhandled #68678
SaltDeserializationErrorexceptions, resulting in CRITICAL errors. #68678The fix adds proper exception handling to gracefully recover from corrupted #68678
cache by regenerating grains. #68678
Fix ansible.playbooks extra_vars quoting to prevent passing broken variables to ansible-playbook. #68787
Make
x86_64_v2to be handled properly withsalt.modules.yumpkgmodule as a possible package architecture. #68789Make
salt-sshwork without issues usingdomain\usernotation for remote user with SSH. #68790Fixed source package builds (DEB/RPM) failing with
LookupError: hatchling is already being builtby addinghatchlingto the--only-binaryallow-list so pip uses its universal wheel instead of attempting a circular source build. #68858Use a 30 second
saltCLI timeout in the reauth scenario tests so Windows CI does not time out ontest.pingafter master/minion restart (default was often 5s). #68924Fix logging in potentially dead process in reap_stray_processes fixture #68927
Fix dynamic version discovery on a new release branch before the first
v<major>*tag exists:git describestill anchored on the previous line (e.g.v3007.13) is lifted to the unreleased codename baseline (e.g.3008.0) while keeping the commit offset and SHA. #68964Remove deprecations. #68985
salt/auth/pki.py (removed) #68985
salt/features.py (removed) #68985
salt/modules/nxos.py (modified) #68985
debpkg include 0/1 as valid options when parsing bool values in deb822 #68996
Drain cancelled tasks on PublishClient close so the TCP transport no longer prints
[ERROR ] Task was destroyed but it is pending!at the end of every salt command. #68998Upgrade packaged python to 3.14 #69014
LoadAuth.get_toknow distinguishes between corrupt token blobs (removed from the store) and transient backend errors such as Redis connection drops or NFS hangs (token kept, request treated as not-authenticated). Previously a single backend hiccup could log every authenticated user out by deleting valid tokens. #69073Fix pip install -e salt #69101
Relenv 0.22.11 #69129
Update python 3.14 to 3.14.5 #69129
Update sqlite to 3.53.1.0 (CVE-2025-70873) #69129
Update expat to 2.8.1 (CVE-2026-41080 and CVE-2026-45186) #69129
Fix master crash when
presence_events: Trueis set on Python 3.14 by skipping the sharedsecretsdict duringiter_transport_optsdeepcopy. #69146Fixed
lgpo_reg.value_absentfailing when the Registry.pol entry was already absent but the registry value still existed.lgpo_reg.delete_valuewas returning early before reaching the registry cleanup code, causing the state to see no changes and report failure. The registry value is now removed regardless of whether the pol entry was present. #69203Fixed
!!binaryYAML tag failing with "Incorrect padding" when base64 padding characters are omitted. Salt's YAML loader now tolerates unpadded base64 values, restoring behavior that worked on Salt 3006 (Python 3.10). #69207Fixed the
yamlJinja filter returningNULLwhen applied to Pillar #69218lists or dicts. Pillar containers are wrapped in
MaskedDict/ #69218MaskedListfor repr redaction; representers are now registered so the #69218YAML dumper serializes them as their underlying list / dict. #69218
Added#
Added proxy option to
gitfs,git_pillarandwinrepofor specifying a proxy server used to connect to git repositories #30990Added
shadow.verify_passwordtosalt.modules.win_shadow, which #41347validates a Windows user's password via
LogonUserwith #41347LOGON32_LOGON_NETWORK(Microsoft's recommended approach per #41347KB180548 <https://support.microsoft.com/en-us/help/180548>_) without #41347creating an interactive session. If the check causes an account lockout, #41347
the account is automatically unlocked. Updated
user.presenton Windows #41347to use
shadow.verify_passwordso the password is only changed when it #41347differs from the current value, matching the idempotent behaviour on other #41347
platforms. #41347
Added support for limiting the number of parallel states executing at the same time via
state_max_parallel#49301Added metalink to mod_repo in yumpkg and documented in pkgrepo state #58931
Add 'show_changes' arg for file.append and file.prepend states to hide output #59329
Added ssl and verify_ssl arguments to mongodb module and states. #59927
Added two new options,
win_delay_startandwin_install_dir, to pass to #61318the Windows installer in salt-cloud #61318
Add context aware change handling for file state module #63328
Added the ability to access already compiled pillar data during the pillar rendering process via the
__pillar__global in templates and matchers. #64043Allow salt-call arguments --file-root, --pillar-root and --states-dir to be specified multiple times #64486
Adds documentation notes to clarify that Salt's file module only supports numeric mode specifications and does not support symbolic modes. #64624
Added management of SSH keys and certificates #65197
Add option (auth_events_autosign_grains) to add autosign_grains to auth events #65426
Added
use_os_truststoreconfiguration option (defaultFalse) that instructs Salt to use the native operating system certificate store (Windows Certificate Store, macOS Keychain, or Linux system trust) for SSL/TLS verification instead of the bundled certifi CA bundle. Requires thetruststorepackage (Python 3.10+). Also adds theca_truststoregrain that reports which store is active (certifioros). #65439Enable "KeepAlive" probes for Salt SSH executions #65488
Add ability to show diff for new files in file.managed #65546
Added Virtuozzo Linux to Redhat os_family #65600
Pillar dunder is now available in extension modules during pillar render. #65724
Added x509_v2 SSH wrapper module. In addition to the regular calls, it provides a function for statefully managing remote certificates, even when access to the event bus is required #65728
Introduce fibre_channel_host grain #65750
Make
salt-run jobs.masterreturn runner jobs that are currently running on a master. #66007Added file and plaintext sources to
gpg.present, allowed to skip keyserver queries #66173added pkg.which to aptpkg, for finding which package installed a file. #66201
Allow pre-connection scripts to be run on host before any ssh commands #66210
Added port, tls, username and password to the
smtpconfiguration of the highstate returner. #66251Improve macOS defaults support #66466
Added support for specifying different signature verification backends in
file.managed/archive.extracted#66527Added an
asymmetricexecution module for signing/verifying data using raw asymmetric algorithms #66528Added support in service Beacon for only fire matching configured running state #66809
Add --relenv Option to salt-ssh for Using a Onedir Bundled Salt+Python #66877
Add support for state.sls_exists when using salt-ssh #66894
Add detection for OS grains when running in AlmaLinux Kitten #66991
Added a
mergeoption tofile.recurse, which merges subpaths from all existingsources before managing the directory. Handy when using different saltenvs or the TOFS pattern. #67072Add
_authcalls to the master stats #67746Added possibility to load data from multiple inventories with
ansible.targets. #67776Detect openEuler as RedHat family OS. #67796
refactored server-side PKI to support cache interface #67799
optimization: check_compound_minions: defer _pki_minions fetch #67799
refactor: push salt.utils.minions bits into salt.key / optimize matching #67799
Add deb822 apt source format support to aptpkg module #67956
Add subsystem filter to "udev.exportdb" execution module function #68047
Implement SL Micro 6.2 detection to fill the grains with proper values. #68247
Added booleans argument to selinux.booleans #68323
Added mod_aggregate to selinux to combine boolean #68323
Added some type hints to selinux module and made some minor changes to improve readability and performance slightly #68323
Add support for minion_id in log formats #68410
Adds support for including
%(minion_id)sin log formats. Where id is available log messages on the master will have that data added to allow easier correlation of messages to minions. #68410Added feature parity for relenv and thin dir with salt-ssh. All salt-ssh tests pass with both thin dir and relenv. #68531
Added tunable worker pools: partition the master's MWorkers into named pools #68532
and route specific commands (for example
_auth) to dedicated pools so a #68532slow workload cannot starve time-critical traffic. Controlled by the new #68532
worker_poolsandworker_pools_enabledmaster settings; see the "Tunable #68532Worker Pools" topic guide for details. Existing
worker_threads#68532configurations remain fully backward compatible. #68532
Added TLS encryption optimization via disable_aes_with_tls config option that eliminates redundant AES encryption when TLS with mutual authentication is active, improving performance while maintaining security through certificate identity verification. #68536
utils.dictdiffer: support diffing of dicts in lists #68726
Add support for nix package manager. #68752
Added a centralized, declarative system for managing Salt's optional dependencies and their version-specific requirements in
salt/utils/versions.py. #68894Pillar data is now wrapped in SafeDict/SafeList with Pydantic SecretStr/SecretBytes for safer logging and output; optional state
no_logand automatic redaction of pillar literals in state returns and minion job logs. #68907Added a fast memory-mapped cache backend (
salt.cache.mmap_cache): #68936an O(1) hash-table store with a segmented heap, durable and multi-process #68936
safe, usable as a drop-in for
localfsvia thecachemaster setting. #68936A specialised variant (
salt.cache.mmap_key) replaces linearpki_dir#68936scans for the master's minion-key store; select it with #68936
keys.cache_driver: mmap_key. Migrate existing data with #68936salt-run cache.migrateandsalt-run pki.migrate_to_mmap. #68936Batch mode now uses a single JID for the entire batch run instead of generating #68941
a separate JID per batch iteration. This enables unified job tracking via #68941
salt-run jobs.lookup_jidand consistent--show-jidoutput across all #68941batch slices. The job cache merges minion lists from each iteration so that #68941
get_loadreturns the complete set of targeted minions. #68941Added OpenTelemetry distributed-tracing support across all Salt #68999
inter-process hops (network and IPC). When
tracing.enabledis true in the #68999master/minion config, salt emits W3C-TraceContext-propagated spans via an #68999
OTLP exporter, covering the CLI, channel layer, master workers, minion #68999
command execution, event bus, reactor, syndic forwarding, salt-ssh, and #68999
salt-api. Trace context travels inside the AES-encrypted Salt envelope so #68999
it remains opaque on the wire. Tracing is opt-in and a complete no-op when #68999
disabled. #68999
Added a per-job
start_eventopt-in (CLI flag--start-event) that asks #69019targeted minions to fire a
salt/job/<jid>/start/<minion_id>event the #69019moment they accept the published job, before the function runs. The payload #69019
mirrors the master's
salt/job/<jid>/newevent minus the function #69019arguments, letting orchestrators confirm reachability without waiting for #69019
the full return. #69019
Added
state.graphandstate.graph_highstateexecution modules and runners to generate a DOT representation of the state dependency graph. #69091Migrate Salt documentation to the PyData Sphinx theme. This update modernizes the documentation UI, improves navigation with a persistent sidebar tree, and fixes issues with embedded video playback. #69185
Added OpenTelemetry metrics support alongside the existing tracing #69200
integration. When
metrics.enabledis true in the master/minion #69200config, salt daemons emit counters (
salt.jobs.published, #69200salt.jobs.completed,salt.auth.attempts,salt.events.fired, #69200salt.returners.calls), histograms (salt.job.duration, #69200salt.minion.exec.duration), and observable gauges #69200(
salt.master.connected_minions.count, #69200salt.master.workers.queue.depth,salt.process.open_fds) via #69200OTLP push or a Prometheus pull endpoint. Metrics are opt-in and a #69200
complete no-op when disabled. See
doc/topics/metrics/index.rst#69200for the full configuration surface and instrument inventory. #69200
Restore the
pillarstackext_pillar module (salt.pillar.stack) that was #69201removed when community extensions were purged. The module is reinstated as a #69201
core ext_pillar so existing PillarStack-based pillar trees continue to work on #69201
3008.x. #69201
Added
lgpo_reg.get_rsop_valueto query the Resultant Set of Policy (RSoP) for a registry key/value and detect whether it is managed by a Domain Group Policy Object. Thelgpo_regmodule functionsset_value,disable_value, anddelete_valuenow log a warning when a Domain GPO is detected for the target value. Thelgpo_regstate functionsvalue_present,value_disabled, andvalue_absentappend the same warning to the state comment so it is visible in state output. #69205