In this blog, we explore a powerful new capability introduced in VMware Cloud Foundation (VCF) 9.1.1 which further enhances compliance and configuration management. Previously, VCF Operations offered Security Posture Management and Configuration Management only from the user interface.
Now, admins have an option to manage compliance and configuration management with programmatic access via the API.
To provide context, we will first walk through the various forms of Salt before introducing our latest enhancement: the VMware Salt for VCF components API.
The open-source Salt API: Where it starts
The open-source Salt Project is a free, community-driven configuration management and remote-execution tool that lets you manage infrastructure at scale. It ships with its own REST API that lets you programmatically trigger and run commands on remote systems, apply configuration states, and orchestrate tasks across nodes. This open-source API is the foundational layer for all Salt deployments. It provides powerful remote execution and state management.
Open-source Salt is CLI-driven with limited built-in reporting, basic role-based access control configured using text files, and does not have a centralized UI by default. The open-source Salt API is best suited for teams that need raw Salt automation and are willing to build their own reporting, governance, and integrations around it.
How open-source Salt is built: The master–minion architecture
Under the hood, open-source Salt uses a master–minion architecture.
A Salt master is a service — a long-running process installed on a virtual machine or physical server — that acts as the central control node. It issues commands, stores configuration files, and coordinates work across the systems it manages.
A Salt minion is a lightweight agent process installed on each individual endpoint (system) you want to manage — whether that’s a VM, physical server, network device or other devices.
The minion receives instructions from the master and reports back results. The Salt master publishes jobs, and the Salt minions decide if the job is applicable to them. This architecture is simple and effective. Each master operates independently – there is no built-in mechanism for tying multiple masters together into a unified, centrally managed system. This limitation is part of what VMware Salt (described below) is designed to address.
VMware Salt and the VMware Salt REST API: The enterprise-grade layer
VMware Salt is an API-driven, database-backed platform used to provide compliance, configuration drift detection and remediation for Windows, Linux and containerized kubernetes-based workloads. VMware Salt provides full role-based access control (RBAC), a web GUI for centralized management and reporting, and support for multi-node and multi-region deployments. VMware Salt is available for VCF as an Advanced Service (licensed add-on).
The VMware Salt REST API is the REST interface exposed by the VMware Salt server, often referred to as the Salt RaaS server. It does everything the open-source Salt API does — triggering core Salt functions — and adds endpoints to provide enterprise-grade capabilities which are supported end-to-end by Broadcom. These capabilities include programmatic control of UI-driven actions such as user management and compliance reporting, scheduled jobs, centralized job data, minion inventory, and environment health data.
Every API call is governed by the server’s RBAC, which helps ensure permissions are enforced for the user or service account making the call. VMware Salt also adds vulnerability scanning and policy-based compliance and remediation.
Simply put, the VMware Salt enterprise API extends the open-source Salt API with full governance, reporting, and compliance.
VMware Salt for VCF Components
From VCF 9.1 onwards, Salt is also used to manage the compliance and configuration of VCF components. The Salt implementation within VCF is called VMware Salt for VCF Components and it is distinct from the VMware Salt solution for workloads.
These capabilities are accessible from the VCF Operations console under Configuration Management and Security Posture Management.
The difference between VMware Salt and VMware Salt for VCF Components is in the endpoints – VMware Salt endpoints are for customer workloads, VMware Salt for VCF Component endpoints are for VCF components only.
VMware Salt for VCF Components is built into VMware Cloud Foundation architecture and supports a single Salt master per VCF instance. VMware Salt for VCF Components is a fleet-level component and a single instance is shared across a VCF fleet. Therefore, the total number of Salt masters in a fleet is equal to the number of VCF instances in that fleet.
The VMware Salt for VCF control-plane is deployed as a set of containerized services on the VCF services runtime node, which is a dedicated hosting platform for the VCF management services cluster.
VMware Salt for VCF components API: The VCF-specific configuration API
The more recent addition introduced with VCF 9.1.1 is the VMware Salt for VCF components API. Built on VMware Salt for VCF Components, this API is designed specifically for programmatically managing configuration and compliance settings across the VCF stack, including vCenter, NSX, SDDC Manager, ESX, and other components. It uses native Salt constructs to implement and maintain desired state consistently across VCF components, exposing more than 300 built-in configuration settings. The VMware Salt for VCF components API specifically targets configuration management of the VCF stack including drift assessment and remediation at scale.
VCF Operations continues to retain the UI console for managing configuration and compliance, while the VMware Salt for VCF components API offers a programmatic alternative, ideal for automating configuration management at scale.
Integrating VMware Salt natively into the VCF stack transforms infrastructure management from a reactive, manual burden into an agile, self-healing execution plane. By pairing Salt’s event-driven architecture and declarative state enforcement with VCF’s unified hybrid cloud model, organizations achieve unprecedented operational speed and continuous compliance at scale.
Instead of relying on slow UI workflows or custom scripts, operators can programmatically declare desired states across thousands of hosts, detect configuration drift in real time, and trigger automated remediation within seconds. Salt acts as the foundational engine that elevates VCF from a bare hyperconverged platform to a fully modern, enterprise-ready software-defined data center capable of self-governance and rapid automated delivery.
The VMware Salt for VCF components API can be referenced from developer.broadcom.com.
The Significance of Salt in the VCF Stack
Salt delivers a unified, end-to-end automation approach that encompasses the entire data center through a single, cohesive ecosystem. By aligning Salt for VCF to core infrastructure, VMware Salt for active workloads, and the open-source Salt Project for all remaining targets, organizations can aggressively eliminate tool sprawl and consolidate their configuration management strategy.
Instead of juggling multiple specialized automation and configuration management platforms, organizations can confidently consolidate their data center tooling to Salt, driving efficiency and unified control from end to end.
This comprehensive approach reduces operational complexity, lowers total cost of ownership, and provides seamless, centralized control across every layer of the enterprise IT landscape.
Summary
The open-source Salt Project provides the core engine and a basic API for remote execution and configuration management — free, powerful, but without enterprise governance.
VMware Salt provides an enterprise platform with a web UI, centralized reporting, RBAC, compliance features, and a broader REST API that covers these capabilities for customer workloads.
The VMware Salt for VCF components API is a specialized interface for managing configuration across the VCF stack at scale and leverages an embedded deployment of Salt in the VCF components. VCF 9.1.1 now provides the option to administer compliance and configuration management programmatically from the VMware Salt for VCF Components API.
Each of the three layers discussed here builds on the one before it. The open-source API is the foundation; the VMware Salt REST API provides a commercial enterprise-grade general-purpose interface for workloads, and the VMware Salt for VCF components API is used for VCF-specific configuration management. These iterations of Salt describe different sets of capabilities and are not to be confused with each other.
The VMware Salt for VCF Components API, introduced in VMware Cloud Foundation (VCF) 9.1.1, establishes a centralized, programmatic API interface that exposes native Salt constructs over REST APIs. This powerful capability elevates infrastructure management from manual tasks across the VCF stack, delivering the speed and agility required for modern operations.
Resources
Blog for further reading: How VMware Salt Automates Compliance across Private Cloud
Documentation: Salt Deployment and Design Guides
Discover more from VMware Cloud Foundation (VCF) Blog
Subscribe to get the latest posts sent to your email.
