diff --git a/salt/elasticfleet/files/certs/placeholder b/salt/elasticfleet/files/certs/placeholder new file mode 100644 index 000000000..e69de29bb diff --git a/salt/elasticfleet/init.sls b/salt/elasticfleet/init.sls index d03ec5e5e..ad0f62edd 100644 --- a/salt/elasticfleet/init.sls +++ b/salt/elasticfleet/init.sls @@ -43,7 +43,7 @@ eastatedir: /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8: file.managed: - replace: True - - source: salt://elasticfleet/files/certs/elasticfleet.p8 + - source: salt://elasticfleet/files/certs/elasticfleet-logstash.p8 - mode: 640 - user: 931 - group: 939 @@ -51,7 +51,7 @@ eastatedir: /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt: file.managed: - replace: True - - source: salt://elasticfleet/files/certs/elasticfleet.crt + - source: salt://elasticfleet/files/certs/elasticfleet-logstash.crt - mode: 640 - user: 931 - group: 939 diff --git a/salt/logstash/init.sls b/salt/logstash/init.sls index 35417848d..7f3aef0aa 100644 --- a/salt/logstash/init.sls +++ b/salt/logstash/init.sls @@ -164,9 +164,9 @@ so-logstash: - /etc/pki/filebeat.crt:/usr/share/logstash/filebeat.crt:ro - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro {% endif %} - {% if GLOBALS.role in ['so-fleet'] %} - - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:/usr/share/logstash/filebeat.crt:ro - - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:/usr/share/logstash/filebeat.key:ro + {% if GLOBALS.role in ['so-manager', 'so-managersearch', 'so-standalone', 'so-import', 'so-eval','so-fleet'] %} + - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:/usr/share/logstash/elasticfleet-logstash.crt:ro + - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:/usr/share/logstash/elasticfleet-logstash.key:ro {% endif %} {% if GLOBALS.role in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %} - /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro diff --git a/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf b/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf index ba89001b6..2cb31ed45 100644 --- a/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf +++ b/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf @@ -4,8 +4,8 @@ input { tags => [ "elastic-agent" ] ssl => true ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"] - ssl_certificate => "/usr/share/logstash/filebeat.crt" - ssl_key => "/usr/share/logstash/filebeat.key" + ssl_certificate => "/usr/share/logstash/elasticfleet-logstash.crt" + ssl_key => "/usr/share/logstash/elasticfleet-logstash.key" ssl_verify_mode => "force_peer" ecs_compatibility => v8 } diff --git a/salt/ssl/init.sls b/salt/ssl/init.sls index a28abe8af..3e6ce0512 100644 --- a/salt/ssl/init.sls +++ b/salt/ssl/init.sls @@ -325,6 +325,23 @@ eflogstashcrtlink: - group: socore {% endif %} + +/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8: + file.managed: + - replace: True + - source: salt://elasticfleet/files/certs/elasticfleet-logstash.p8 + - mode: 640 + - user: 931 + - group: 939 + +/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt: + file.managed: + - replace: True + - source: salt://elasticfleet/files/certs/elasticfleet-logstash.crt + - mode: 640 + - user: 931 + - group: 939 + {% endif %} {% if grains['role'] in ['so-manager', 'so-eval', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode', 'so-receiver'] %}