From 4423e93880bc8c1222c884164d82fe30c8073e16 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 25 Jan 2022 12:57:05 -0500
Subject: [PATCH] prevent path.repo from being put in elasticsearch.yml if the
 symlink doesnt exist

---
 salt/elasticsearch/config.map.jinja | 11 +++++++++++
 salt/elasticsearch/init.sls         |  7 ++-----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/salt/elasticsearch/config.map.jinja b/salt/elasticsearch/config.map.jinja
index c3f2b2067..c44e39e0d 100644
--- a/salt/elasticsearch/config.map.jinja
+++ b/salt/elasticsearch/config.map.jinja
@@ -33,4 +33,15 @@
     {% endif %}
 {% endif %}
 
+{# merge with the elasticsearch pillar #}
 {% set ESCONFIG = salt['pillar.get']('elasticsearch:config', default=ESCONFIG.elasticsearch.config, merge=True) %}
+
+{# remove elasticsearch.config.path.repo values if a symlink /nsm/elasticsearch/repo{{ repo }} doesn't exist #}
+{% if salt['pillar.get']('elasticsearch:config:path:repo', False) %}
+  {% for repo in pillar.elasticsearch.config.path.repo %}
+    {# retcode is 1 if symlink doesn't exist #}
+    {% if salt['cmd.retcode']('test -L /nsm/elasticsearch/repo'~repo) %}
+      {% do ESCONFIG.path.repo.remove(repo) %}
+    {% endif %}
+  {% endfor %}
+{% endif %}
diff --git a/salt/elasticsearch/init.sls b/salt/elasticsearch/init.sls
index b7d2b8b70..62870bcc2 100644
--- a/salt/elasticsearch/init.sls
+++ b/salt/elasticsearch/init.sls
@@ -325,12 +325,9 @@ so-elasticsearch:
       - /opt/so/conf/elasticsearch/users_roles:/usr/share/elasticsearch/config/users_roles:ro
       - /opt/so/conf/elasticsearch/users:/usr/share/elasticsearch/config/users:ro
       {% endif %}
-      {% if ES_PATH_REPO %}
-        {% for repo in ES_PATH_REPO %}
-          # /nsm/elasticsearch/repo{{ repo }} must exist as a symlink for the bind to be created
-          {% if salt['cmd.retcode']('test ! -L /nsm/elasticsearch/repo'~repo) %}
+      {% if ESCONFIG.path.repo %}
+        {% for repo in ESCONFIG.path.repo %}
       - /nsm/elasticsearch/repo{{ repo }}:{{ repo }}:rw
-          {% endif %}
         {% endfor %}
       {% endif %}
     - watch: