You also wouldn't expose your database just because it's password-protected?
I bet all these public servers have a firewall running to protect other services.
Shouldn't be hard to include the saltstack port(s) and whitelist the relevant IP addresses.
Also,the main difference with your example is that the clients that connect to webservers and vpns are either not known in advance or don't have static IP addresses.
You also wouldn't expose your database just because it's password-protected?
I bet all these public servers have a firewall running to protect other services.
Shouldn't be hard to include the saltstack port(s) and whitelist the relevant IP addresses.
Also,the main difference with your example is that the clients that connect to webservers and vpns are either not known in advance or don't have static IP addresses.