Skip to main content
SaltStack Support

Enterprise Installation: Upgrading

In an existing installation, SaltStack Enterprise can be upgraded to the latest version. If you are upgrading your SaltStack Enterprise installation, refer to the following upgrade instructions. Do not attempt to install using the installer or manual installation instructions.

These upgrade instructions cover an upgrade from SaltStack Enterprise version 5.5.1 to version 6.0.1. A best practice is to always upgrade from the latest major version of SaltStack Enterprise to the new release.

Or if upgrading from a version earlier than 5.5.1, you might upgrade in increments from one major release to the next for best results.For instructions on upgrading to earlier SaltStack Enterprise versions, see SaltStack Support Portal.

Download the Python egg

Download the latest Python egg.

All operating systems

Download the RPM

Red Hat/CentOS

What to back up prior to the upgrade

Files / Directories

  • /etc/raas/raas
  • /etc/raas/pki/ - this contains hidden files, so back up the entire directory
  • /etc/salt/master.d/raas.conf - located on each Salt Master
  • postgres.conf - if local PostgreSQL
  • pg_hba.conf - if local PostgreSQL


When upgrading your raas server, the database schema will need to be updated. Make sure to create a backup of your database before the upgrade.

To back up your database, first look up your PostgreSQL database name.

Backing up your database
  1. Log in as the postgres user.

    $ sudo su - postgres
  2. Get your database name.

    $ psql # enter postgresql
    $ \l # list databases

    To exit PostgreSQL and log out as postgres user, press ctrl-d and then run:

  3. Copy database contents to file. An example of this command is:

       pg_dump -U salt_eapi raas_db_name > postgres_raas_backup_$(date +%Y-%m-%d).sql

    See PostgreSQL database backups for more information.


  1. Back up your database. See Backing up your database.

  2. Save any changes you made to the default file system, pillar data, and jobs as new files or jobs.

  3. Note any pillar assignments that are made to the default targets. These need to be re-assigned after upgrade.

On the SaltStack Enterprise server

  1. Stop the raas service.

     $ sudo systemctl stop raas
  2. Back up or remove the log file(s) at /var/log/raas/raas. This provides a clean log file if troubleshooting is required.

  3. Back up or rename the /etc/raas/raas config file. You’ll need to restore this file after upgrading.

  4. Remove the currently installed version of Enterprise API.

     $ sudo yum remove raas
  5. Upgrade SaltStack Enterprise server by installing the latest RPM. For example:

     $ sudo yum install raas-6.0.1+3.el7.x86_64.rpm

    To download the RPM, see Download the RPM.

  6. Restore the backup of the /etc/raas/raas config file.

  7. Update permissions for the raas user:

    $ sudo chown raas:raas /var/log/raas/raas
    $ sudo chown -R raas:raas /etc/raas/
    $ sudo chown -R raas:raas /etc/pki/raas/certs/*.crt
    $ sudo chown -R raas:raas /etc/pki/raas/certs/*.key
    $ sudo chmod 400 /etc/pki/raas/certs/*.crt
    $ sudo chmod 400 /etc/pki/raas/certs/*.key
    $ sudo chown -R raas:raas /srv/raas
    $ sudo chown -R raas:raas /opt/saltstack
  8. Add new section to /etc/raas/raas:

    SaltStack Enterprise version 6.0 and later contains the SecOps security modules (additional licensing required). The following configuration options in /etc/raas/raas are specific to this module.

       ingest_override: true
       locke_dir: locke
       post_ingest_cleanup: true
       username: 'secops'
       content_url: ''
       download_enabled: true
       download_frequency: 86400
       stats_snapshot_interval: 3600
       compile_stats_interval: 10
       ingest_on_boot: True
       content_lock_timeout: 60
       content_lock_block_timeout: 120
  9. Upgrade the raas database with:

    $ sudo su - raas
    $ raas upgrade

    Depending on the size of your database, the upgrade can take anywhere from several minutes to over an hour.

    If you encounter errors, check the /var/log/raas/raas logfile for more information.

    After the upgrade, exit the session for the raas user with:

  10. Start the Enterprise API service.

    $ sudo systemctl enable raas
    $ sudo systemctl start raas

On each connected Salt Master

  1. Stop the salt-master service.

     $ sudo systemctl stop salt-master
  2. Delete the SSEAPI Python module:

    Delete the prior version of the SSEAPE module (this is the SaltStack Enterprise plugin for the Salt Master). For example:

    $ sudo rm -rf /usr/lib/python2.7/site-packages/SSEAPE*
    $ sudo rm /usr/lib/python2.7/dist-packages/SSEAPE*
  3. Manually upgrade the Salt Master plugin by installing the updated Python egg.

     $ sudo easy_install-2.7 SSEAPE-6.0.1+3-py2.7.egg
  4. Update the eAPI Master paths.

    • Edit /etc/salt/master.d/eAPIMasterPaths.conf to reference the path to the new egg version.
    • If you are upgrading from a version of SaltStack Enterprise prior to 5.4, use the following command to generate the paths:

      $ sudo yum install PyYAML
      $ sudo sseapi-config --ext-modules > /etc/salt/master.d/eAPIMasterPaths.conf
      $ sudo apt-get install python-yaml
      $ sudo sseapi-config --ext-modules > /etc/salt/master.d/eAPIMasterPaths.conf
    • Be sure to remove any of the path references from /etc/salt/master.d/raas.conf, as these were relocated in a previous release of SaltStack Enterprise.
  5. Add - job_completion: {} to the engines section of /etc/salt/master.d/raas.conf.

  6. Start the salt-master service.

     $ sudo systemctl start salt-master
  • Was this article helpful?