{"id":2434,"date":"2026-09-24T08:50:58","date_gmt":"2026-09-24T12:50:58","guid":{"rendered":"https:\/\/enterpriseadmins.org\/blog\/?p=2434"},"modified":"2026-09-24T08:50:58","modified_gmt":"2026-09-24T12:50:58","slug":"replacing-aria-automation-config-with-vmware-salt-single-node-in-my-homelab","status":"publish","type":"post","link":"https:\/\/enterpriseadmins.org\/blog\/virtualization\/replacing-aria-automation-config-with-vmware-salt-single-node-in-my-homelab\/","title":{"rendered":"Replacing Aria Automation Config with VMware Salt (Single-Node) in My Homelab"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A couple of years ago I ran SaltStack Config (later rebranded Aria Automation Config) in my homelab for automated Linux patching.  For various reasons, I stopped maintaining it and reverted to rather infrequent, manual patching.  Recently I decided it was time to get back into automated patching.  My old Salt deployment had been neglected for some time so instead of just restarting it, I decided to setup VMware Salt (the productized version included in the <a href=\"https:\/\/techdocs.broadcom.com\/us\/en\/vmware-cis\/acc\/advanced-cyber-compliance\/9-1.html\">Advanced Cyber Compliance<\/a> addon), from scratch.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Picking a deployment model<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">VMware Salt supports a few deployment topologies.  For a homelab, the choice was easy: the single-node (all-in-one) model, where the Salt Master, Salt RaaS server (including Postgres and Valkey\/Redis), all run on one VM.  It&#8217;s the simplest option to stand up since there&#8217;s only one VM, but it&#8217;s worth knowing the trade-offs before you commit to it even for a lab:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Everything competes for the same CPU\/RAM\/disk I\/O, so it can bog down under heavy load (lots of minions, frequent jobs)<\/li>\n\n\n\n<li>It&#8217;s a single point of failure and a single attack surface<\/li>\n\n\n\n<li>VMware explicitly does not consider this a production-grade topology; it&#8217;s meant for PoC, testing, and small labs<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For a homelab with a modest minion count, that&#8217;s a completely reasonable set of trade-offs. If you&#8217;re planning something larger, look at the Basic Enterprise or Distributed Enterprise models instead.  Details about each option can be found in the <a href=\"https:\/\/techdocs.broadcom.com\/us\/en\/vmware-cis\/other\/vmware-salt\/8-18\/using-vmware-salt\/installation-for-administrators-and-deployment.html\">official documentation<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Building the VM<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The documentation specifically calls out support for Red Hat Enterprise Linux (RHEL) 9. I built the target VM on Rocky Linux 9.8, using the template created <a href=\"https:\/\/enterpriseadmins.org\/blog\/virtualization\/building-a-rocky-linux-9-8-template-vm-by-hand\/\">in this post<\/a>.  Rocky Linux is an open-source enterprise operating system designed to be 100% bug-for-bug compatible with Red Hat Enterprise Linux.  I then installed some prerequisites called out in the documentation, and enabled persistent firewall rules using the following commands:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install python3 python3.11-devel\nsudo dnf config-manager --set-enabled crb\nsudo dnf install epel-release\nsudo dnf install libsodium\n\nfirewall-cmd --zone=public --add-service=https --permanent\nfirewall-cmd --zone=public --add-port=4505-4506\/tcp --permanent\nfirewall-cmd --reload<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Installing VMware Salt<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With prerequisites in place, I extracted the installer and ran the single-node setup script:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tar -xzf VMware_Salt_RaaS-8.18.3-25253633.el9_Installer.tar.gz\ncd sse-installer\n.\/setup_single_node.sh<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Licensing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After installing, I noticed a warning banner that the license would expire soon (2 weeks). I added a license key using the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \"&lt;your-license-key&gt;\" &gt; \/etc\/raas\/vra_license &amp;&amp; chown raas:raas \/etc\/raas\/vra_license &amp;&amp; systemctl restart raas<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Replacing the default SSL cert<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By default, the web UI ships with a self-signed certificate (<code>localhost.crt<\/code>\/<code>localhost.key<\/code>).  I don&#8217;t like clicking the &#8216;continue anyway&#8217; link every time I access a &#8216;secure&#8217; page in my lab, so I generated a proper CSR, got it signed, and swapped it in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/etc\/pki\/raas\/certs\/\nvi cm-vcfsalt-01.crt  # &lt;press i &amp; paste cert contents&gt;\nvi cm-vcfsalt-01.key  # &lt;press i &amp; paste key contents&gt;\nchown raas:raas cm-vcfsalt-01.crt cm-vcfsalt-01.key\nchmod 400 cm-vcfsalt-01.crt cm-vcfsalt-01.key<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then point <code>\/etc\/raas\/raas<\/code> at the new files by editing the tls_crt and tls_key properties and restart the <code>raas<\/code> service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tls_crt: \/etc\/pki\/raas\/certs\/cm-vcfsalt-01.crt\ntls_key: \/etc\/pki\/raas\/certs\/cm-vcfsalt-01.key\nsystemctl restart raas<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Accepting the master key<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Last step for a fresh install: log in to the web UI, go to Administration &#8211;&gt; Master Keys (or use the &#8220;pending master keys&#8221; banner), and accept the default master key so minions can actually check in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/enterpriseadmins.org\/blog\/scripting\/migrating-salt-minions-to-a-new-master\/\">next post<\/a> will cover repointing existing salt minions from the old master to this new one.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A couple of years ago I ran SaltStack Config (later rebranded Aria Automation Config) in my homelab for automated Linux patching. For various reasons, I stopped maintaining it and reverted to rather infrequent, manual patching. Recently I decided it was &hellip; <a href=\"https:\/\/enterpriseadmins.org\/blog\/virtualization\/replacing-aria-automation-config-with-vmware-salt-single-node-in-my-homelab\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[9,4],"tags":[],"class_list":["post-2434","post","type-post","status-publish","format-standard","hentry","category-lab-infrastructure","category-virtualization"],"_links":{"self":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/2434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/comments?post=2434"}],"version-history":[{"count":3,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/2434\/revisions"}],"predecessor-version":[{"id":2439,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/2434\/revisions\/2439"}],"wp:attachment":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/media?parent=2434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/categories?post=2434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/tags?post=2434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}