The Salt agent: the master publishes, the minion decides, executes and reports

TL;DR

Salt puts an agent, salt-minion, on every machine; the agent itself opens two connections to the master: 4505, on which the master publishes jobs to everyone at once, and 4506, on which the minion requests files and pillar and sends back results. The minion is accepted by key, after checking the fingerprint; from then on it decrypts publications with an AES key rotated daily. A job is published once; every minion decides locally whether the target describes it, runs the module and returns; the desired state is written declaratively in SLS (YAML + Jinja), assigned via top.sls and applied idempotently with state.apply, with requisites that enforce ordering and restarts. Pillar brings secrets compiled on the master; beacons and the reactor close the observe → report → repair loop; orchestrate coordinates several minions; network devices come in through proxy minions. Most incidents come from keys (reinstall with the same id), the “salt” DNS name, ports in the wrong direction and targets written as globs.

How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms and tools (Salt, Ansible, Puppet, Chef, Cisco devices). In the animations, the configuration lines used at the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.