Merge pull request #116 from m0duspwnens/master

changes for issues #92 and #96

salt/common/telegraf/etc/telegraf.conf

@@ -76,7 +76,7 @@
   logfile = "/var/log/telegraf/telegraf.log"
 
   ## Override default hostname, if empty use os.Hostname()
-  hostname = "{{ grains.host }}"
+  hostname = "{{ grains.id }}"
   ## If set to true, do no set the "host" tag in the telegraf agent.
   omit_hostname = false
 

salt/ssl/init.sls

@@ -1,15 +1,23 @@
 {% set master = salt['grains.get']('master') %}
 {%- set masterip = salt['pillar.get']('static:masterip', '') -%}
 
+{% if grains['role'] == 'so-master' or grains['role'] == 'so-eval' %}
+    {% set trusttheca_text =  salt['mine.get'](grains.id, 'x509.get_pem_entries')[grains.id]['/etc/pki/ca.crt']|replace('\n', '') %}
+    {% set ca_server = grains.id %}
+{% else %}
+    {% set trusttheca_text =  salt['mine.get'](master, 'x509.get_pem_entries')[master]['/etc/pki/ca.crt']|replace('\n', '') %}
+    {% set ca_server = master %}
+{% endif %}
+
 # Trust the CA
 
 trusttheca:
   x509.pem_managed:
     - name: /etc/ssl/certs/intca.crt
-    - text:  {{ salt['mine.get'](master, 'x509.get_pem_entries')[master]['/etc/pki/ca.crt']|replace('\n', '') }}
+    - text:  {{ trusttheca_text }}
 
-# Install packages needed for the sensor
 {% if grains['os'] != 'CentOS' %}
+# Install packages needed for the sensor
 m2cryptopkgs:
   pkg.installed:
     - skip_suggestions: False
@@ -20,7 +28,7 @@ m2cryptopkgs:
 # Create a cert for the talking to influxdb
 /etc/pki/influxdb.crt:
   x509.certificate_managed:
-    - ca_server: {{ master }}
+    - ca_server: {{ ca_server }}
     - signing_policy: influxdb
     - public_key: /etc/pki/influxdb.key
     - CN: {{ master }}
@@ -37,7 +45,7 @@ m2cryptopkgs:
 # Request a cert and drop it where it needs to go to be distributed
 /etc/pki/filebeat.crt:
   x509.certificate_managed:
-    - ca_server: {{ master }}
+    - ca_server: {{ ca_server }}
     - signing_policy: filebeat
     - public_key: /etc/pki/filebeat.key
     - CN: {{ master }}
@@ -70,7 +78,7 @@ fbcrtlink:
 # Create a cert for the docker registry
 /etc/pki/registry.crt:
   x509.certificate_managed:
-    - ca_server: {{ master }}
+    - ca_server: {{ ca_server }}
     - signing_policy: registry
     - public_key: /etc/pki/registry.key
     - CN: {{ master }}
@@ -85,7 +93,7 @@ fbcrtlink:
 # Create a cert for the reverse proxy
 /etc/pki/masterssl.crt:
   x509.certificate_managed:
-    - ca_server: {{ master }}
+    - ca_server: {{ ca_server }}
     - signing_policy: masterssl
     - public_key: /etc/pki/masterssl.key
     - CN: {{ master }}
@@ -130,7 +138,7 @@ fbcertdir:
 # Request a cert and drop it where it needs to go to be distributed
 /opt/so/conf/filebeat/etc/pki/filebeat.crt:
   x509.certificate_managed:
-    - ca_server: {{ master }}
+    - ca_server: {{ ca_server }}
     - signing_policy: filebeat
     - public_key: /opt/so/conf/filebeat/etc/pki/filebeat.key
     - CN: {{ master }}

salt/utility/bin/eval.sh

@@ -1,5 +1,4 @@
 {%- set ES = salt['pillar.get']('master:mainip', '') -%}
-{%- set MASTER = grains['master'] %}
 # Wait for ElasticSearch to come up, so that we can query for version infromation
 echo -n "Waiting for ElasticSearch..."
 COUNT=0
@@ -27,4 +26,4 @@ fi
 echo "Applying cross cluster search config..."
     curl -s -XPUT http://{{ ES }}:9200/_cluster/settings \
          -H 'Content-Type: application/json' \
-         -d "{\"persistent\": {\"search\": {\"remote\": {\"{{ MASTER }}\": {\"seeds\": [\"127.0.0.1:9300\"]}}}}}"
+         -d "{\"persistent\": {\"search\": {\"remote\": {\"{{ grains.id }}\": {\"seeds\": [\"127.0.0.1:9300\"]}}}}}"