Install and configure the Master Plugin


This page explains how to install, configure, and upgrade the Master Plugin. The Master Plugin enables your masters to communicate with SaltStack Config. The Master Plugin includes a variety of settings you can adjust to improve performance, which is particularly useful for large or busy environments. For more information about the Master Plugin and how it fits in SaltStack Config architecture, see Salt masters and the Master Plugin.

Typically, you install the Master Plugin on every master in your environment that communicates with SaltStack Config. For example, if you are using a configuration with more than one master (sometimes called a multi-master setup), each master needs to the Master Plugin.

For more information about updating performance-related settings, see the Master Plugin page in the SaltStack Config Help Documentation embedded in the SaltStack Config user interface. For help finding the documentation, see Finding Enterprise Documentation.


As part of VMware’s initiative to remove problematic terminology, the term Salt master will be replaced with Salt controller in SaltStack Config and related products and documentation. This terminology update may take a few release cycles before it is fully complete.


Installing and configuring the Master Plugin is one post-installation step in a series of several steps that should be followed in a specific order. First, complete one of the installation scenarios and then read the Install the license key post-installation page.

When do you need to install the Master Plugin?

You need to install the Master Plugin on all of your masters after a fresh installation of SaltStack Config. The Master Plugin is not necessary on masters that do not need to communicate with SaltStack Config.

If you used the Single-node installation installation scenario, you do not need to install the Master Plugin on the node on which you installed SaltStack Config and its related architecture. The installer automatically installs the Master Plugin on the master node. However, the Master Plugin is installed only on the master where you ran the installer. If you have multiple masters, you still need to install the Master Plugin on your other masters.

If you recently upgraded to a newer version of SaltStack Config, you should also re-install the Master Plugin. For the full instructions on upgrading and installing the Master Plugin after an upgrade, see Upgrade from a previous version.

If you are manually installing SaltStack Config (not recommended), you should complete the following before you install the Master Plugin:

  • Install and configure the PostgreSQL database
  • Install and configure the Redis database
  • Enable SSL (optional)

Install the Master Plugin

To install the Master Plugin on your master:

  1. Log in to your master.

  2. If necessary, download the Master Plugin wheel. See Downloads.

  3. Install the Master Plugin by manually installing the updated Python wheel. Use the following example commands, replacing the exact name of the wheel file:

    sudo pip3 install SSEAPE-file-name.whl --prefix /usr
    sudo pip3 install SSEAPE-file-name.whl


    Some users might need to alter the syntax to pip3.6 or pip36 for their operating systems.

After installing the Master Plugin, proceed to the next section.

Configure the Master Plugin

To configure the master after installing the Master Plugin:

  1. Log in to your master and verify the /etc/salt/master.d directory exists, or create it.

  2. Generate the master configuration settings.


    If you want to preserve your settings when upgrading your installation, make a backup of your existing Master Plugin configuration file before running this step. Then copy relevant settings from your existing configuration to the newly generated file.

    sudo sseapi-config --all > /etc/salt/master.d/raas.conf

    If running this command causes an error, it might be related to the method you used when initially installing Salt. If you installed Salt through the all-in-one installer, your SaltStack Config installation likely includes an offline packager, called the Salt Crystal, that requires special upgrade instructions. For more information, see Troubleshooting.

  3. Edit the generated raas.conf file and update the values as follows to validate the certificate the API (RaaS) users and set its IP address.

    Value Description

    Validates the certificate the API (RaaS) uses. The default is True.

    If you are using your own CA-issued certificates, set this value to True and configure the sseapi_ssl_ca, sseapi_ssl_cert, and sseapi_ssl_cert: settings.

    Otherwise, set this to False to not validate the certificate.

    sseapi_ssl_validate_cert: False
    sseapi_server HTTP IP address of your RaaS node, for example,, or if SSL is enabled.

    Sets the age (in seconds) after which old, potentially stale jobs are skipped. For example, to skip jobs older than a day, set it to:

    sseapi_command_age_limit: 86400

    Skipped jobs will continue to exist in the database and display with a status of Completed in the SaltStack Config user interface.

    Some environments may need the master to be offline for long periods of time and will need the master to run any jobs that were queued after it comes back online. If this applies to your environment, set the age limit to 0.

  1. OPTIONAL: This step is necessary for manual installations only. To verify you can connect to SSL before connecting the Master Plugin, edit the generated raas.conf file to update the following values. If you do not update these values, the Master Plugin uses the default generated certificate.

    Value Description
    sseapi_ssl_ca The path to a CA file.
    sseapi_ssl_cert The path to the certificate. The default value is /etc/pki/raas/certs/localhost.crt.
    sseapi_ssl_key The path to the certificate’s private key. The default value is /etc/pki/raas/certs/localhost.key.
    id Comment this line out by adding a # at the beginning. It is not required.
  2. Restart the Salt master service.

    sudo systemctl restart salt-master
  3. OPTIONAL: You might want to run a test job to ensure the Master Plugin is now enabling communication between the master and the RaaS node.

    salt -v '*'

Even if no activity shows, for example because no minions are connected, this is likely a sign of a correct configuration.

Next steps

After installing and configuring the Master Plugin, you must complete additional post-installation steps. The next step is to log in to the SaltStack Config user interface for the first time. To continue the post-installation process, see Log in for the first time and change default credentials.