From 186bf86e996f17f00d4af0eb7292888881f7cba3 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Wed, 15 Jul 2026 12:14:18 -0400 Subject: [PATCH] soup: require green Elasticsearch cluster before upgrading Change the pre-flight cluster-health gate to wait_for_status=green instead of yellow, so soup only proceeds when the cluster is fully green. --- salt/manager/tools/sbin/soup | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 37e550db2..ec2dcaed5 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -329,13 +329,12 @@ check_pillar_items() { check_cluster_health() { echo "Checking Elasticsearch cluster health." - # Block only if the cluster cannot reach at least 'yellow' status (i.e. it is red or - # unreachable); 'yellow' is normal for many Security Onion deployments. Modeled on the - # wait used in so-elasticsearch-roles-load. - if so-elasticsearch-query "_cluster/health?wait_for_status=yellow&timeout=120s" --fail > /dev/null 2>&1; then - printf "\nThe Elasticsearch cluster is healthy. We can proceed with SOUP.\n\n" + # Require a 'green' cluster before upgrading; anything less (yellow, red, or + # unreachable) blocks. Modeled on the wait used in so-elasticsearch-roles-load. + if so-elasticsearch-query "_cluster/health?wait_for_status=green&timeout=120s" --fail > /dev/null 2>&1; then + printf "\nThe Elasticsearch cluster is healthy (green). We can proceed with SOUP.\n\n" else - printf "\nThe Elasticsearch cluster is not healthy (it did not reach at least 'yellow' status). Please resolve the cluster health issue before running SOUP again.\n\n" + printf "\nThe Elasticsearch cluster is not green. Please resolve the cluster health issue so the cluster is green before running SOUP again.\n\n" exit 0 fi }