salt-ssh & masterless

Agentless and standalone modes.

Not every environment can run a minion agent or an always-connected bus, so Salt offers two alternatives. salt-ssh runs Salt over SSH with no minion installed — agentless, like Ansible — trading the bus’s speed for zero footprint on targets, useful for machines you cannot or should not put an agent on. It uses a roster file (its inventory) instead of accepted minion keys.

# /etc/salt/roster
web1:
  host: 10.0.1.5
  user: deploy
  sudo: True
---
$ salt-ssh 'web1' state.apply nginx     # applies states over SSH, no minion needed

Masterless minions

The other mode is masterless: a minion applies states from its own local file_roots with salt-call --local, no master at all. This suits immutable images (bake the states in, converge at boot), highly isolated hosts, or CI where you do not want a master dependency. You lose central orchestration and the event bus, but gain simplicity and independence — the node manages itself from local code.

# masterless: apply the highstate from local state files, no master
$ salt-call --local state.highstate
# minion config points file_roots at a local path (or a cloned Git repo)