mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
separate salt-minion service file
This commit is contained in:
Josh Patterson
@@ -4,6 +4,9 @@
|
||||
# Elastic License 2.0.
|
||||
|
||||
# We do not import GLOBALS in this state because it is called during setup
|
||||
include:
|
||||
- salt.mine_functions
|
||||
- salt.minion.service_file
|
||||
|
||||
down_original_mgmt_interface:
|
||||
cmd.run:
|
||||
@@ -28,29 +31,17 @@ wait_for_br0_ip:
|
||||
- timeout: 95
|
||||
- onchanges:
|
||||
- cmd: down_original_mgmt_interface
|
||||
- onchanges_in:
|
||||
- file: salt_minion_service_unit_file
|
||||
- file: mine_functions
|
||||
|
||||
{% if grains.role == 'so-hypervisor' %}
|
||||
|
||||
update_mine_functions:
|
||||
file.managed:
|
||||
- name: /etc/salt/minion.d/mine_functions.conf
|
||||
- contents: |
|
||||
mine_interval: 25
|
||||
mine_functions:
|
||||
network.ip_addrs:
|
||||
- interface: br0
|
||||
{%- if role in ['so-eval','so-import','so-manager','so-managerhype','so-managersearch','so-standalone'] %}
|
||||
x509.get_pem_entries:
|
||||
- glob_path: '/etc/pki/ca.crt'
|
||||
{% endif %}
|
||||
- onchanges:
|
||||
- cmd: wait_for_br0_ip
|
||||
{% if grains.role in ['so-hypervisor', 'so-managerhype'] %}
|
||||
|
||||
restart_salt_minion_service:
|
||||
service.running:
|
||||
- name: salt-minion
|
||||
- enable: True
|
||||
- listen:
|
||||
- file: update_mine_functions
|
||||
- file: mine_functions
|
||||
|
||||
{% endif %}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
# this state was seperated from salt.minion state since it is called during setup
|
||||
# this state was separated from salt.minion state since it is called during setup
|
||||
# GLOBALS are imported in the salt.minion state and that is not available at that point in setup
|
||||
# this state is included in the salt.minion state
|
||||
|
||||
|
||||
@@ -1,124 +0,0 @@
|
||||
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
||||
{% from 'salt/map.jinja' import UPGRADECOMMAND with context %}
|
||||
{% from 'salt/map.jinja' import SALTVERSION %}
|
||||
{% from 'salt/map.jinja' import INSTALLEDSALTVERSION %}
|
||||
{% from 'salt/map.jinja' import SALTPACKAGES %}
|
||||
{% from 'salt/map.jinja' import SYSTEMD_UNIT_FILE %}
|
||||
{% import_yaml 'salt/minion.defaults.yaml' as SALTMINION %}
|
||||
|
||||
include:
|
||||
- salt.python_modules
|
||||
- salt.patch.x509_v2
|
||||
- salt
|
||||
- systemd.reload
|
||||
- repo.client
|
||||
- salt.mine_functions
|
||||
{% if GLOBALS.role in GLOBALS.manager_roles %}
|
||||
- ca
|
||||
{% endif %}
|
||||
|
||||
{% if INSTALLEDSALTVERSION|string != SALTVERSION|string %}
|
||||
|
||||
{# this is added in 2.4.120 to remove salt repo files pointing to saltproject.io to accomodate the move to broadcom and new bootstrap-salt script #}
|
||||
{% if salt['pkg.version_cmp'](GLOBALS.so_version, '2.4.120') == -1 %}
|
||||
{% set saltrepofile = '/etc/yum.repos.d/salt.repo' %}
|
||||
{% if grains.os_family == 'Debian' %}
|
||||
{% set saltrepofile = '/etc/apt/sources.list.d/salt.list' %}
|
||||
{% endif %}
|
||||
remove_saltproject_io_repo_minion:
|
||||
file.absent:
|
||||
- name: {{ saltrepofile }}
|
||||
{% endif %}
|
||||
|
||||
unhold_salt_packages:
|
||||
pkg.unheld:
|
||||
- pkgs:
|
||||
{% for package in SALTPACKAGES %}
|
||||
- {{ package }}
|
||||
{% endfor %}
|
||||
|
||||
install_salt_minion:
|
||||
cmd.run:
|
||||
- name: /bin/sh -c '{{ UPGRADECOMMAND }}'
|
||||
|
||||
# minion service is in failed state after upgrade. this command will start it after the state run for the upgrade completes
|
||||
start_minion_post_upgrade:
|
||||
cmd.run:
|
||||
- name: |
|
||||
exec 0>&- # close stdin
|
||||
exec 1>&- # close stdout
|
||||
exec 2>&- # close stderr
|
||||
nohup /bin/sh -c 'sleep 30; systemctl start salt-minion' &
|
||||
- require:
|
||||
- cmd: install_salt_minion
|
||||
- watch:
|
||||
- cmd: install_salt_minion
|
||||
- order: last
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% if INSTALLEDSALTVERSION|string == SALTVERSION|string %}
|
||||
|
||||
{% for package in SALTPACKAGES %}
|
||||
# only hold the package if it is already installed
|
||||
{% if salt['pkg.version'](package) %}
|
||||
hold_{{ package }}_package:
|
||||
pkg.held:
|
||||
- name: {{ package }}
|
||||
- version: {{SALTVERSION}}-0.*
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
remove_error_log_level_logfile:
|
||||
file.line:
|
||||
- name: /etc/salt/minion
|
||||
- match: "log_level_logfile: error"
|
||||
- mode: delete
|
||||
|
||||
remove_error_log_level:
|
||||
file.line:
|
||||
- name: /etc/salt/minion
|
||||
- match: "log_level: error"
|
||||
- mode: delete
|
||||
|
||||
set_log_levels:
|
||||
file.append:
|
||||
- name: /etc/salt/minion
|
||||
- text:
|
||||
- "log_level: info"
|
||||
- "log_level_logfile: info"
|
||||
|
||||
enable_startup_states:
|
||||
file.uncomment:
|
||||
- name: /etc/salt/minion
|
||||
- regex: '^startup_states: highstate$'
|
||||
- unless: pgrep so-setup
|
||||
|
||||
# prior to 2.4.30 this managed file would restart the salt-minion service when updated
|
||||
# since this file is currently only adding a delay service start
|
||||
# it is not required to restart the service
|
||||
salt_minion_service_unit_file:
|
||||
file.managed:
|
||||
- name: {{ SYSTEMD_UNIT_FILE }}
|
||||
- source: salt://salt/service/salt-minion.service.jinja
|
||||
- template: jinja
|
||||
- onchanges_in:
|
||||
- module: systemd_reload
|
||||
|
||||
{% endif %}
|
||||
|
||||
# this has to be outside the if statement above since there are <requisite>_in calls to this state
|
||||
salt_minion_service:
|
||||
service.running:
|
||||
- name: salt-minion
|
||||
- enable: True
|
||||
- onlyif: test "{{INSTALLEDSALTVERSION}}" == "{{SALTVERSION}}"
|
||||
- listen:
|
||||
- file: mine_functions
|
||||
{% if INSTALLEDSALTVERSION|string == SALTVERSION|string %}
|
||||
- file: set_log_levels
|
||||
{% endif %}
|
||||
{% if GLOBALS.role in GLOBALS.manager_roles %}
|
||||
- file: /etc/salt/minion.d/signing_policies.conf
|
||||
{% endif %}
|
||||
- order: last
|
||||
26
salt/salt/minion/service_file.sls
Normal file
26
salt/salt/minion/service_file.sls
Normal file
@@ -0,0 +1,26 @@
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
{% from 'salt/map.jinja' import SALTVERSION %}
|
||||
{% from 'salt/map.jinja' import INSTALLEDSALTVERSION %}
|
||||
{% from 'salt/map.jinja' import SYSTEMD_UNIT_FILE %}
|
||||
|
||||
include:
|
||||
- systemd.reload
|
||||
|
||||
{% if INSTALLEDSALTVERSION|string == SALTVERSION|string %}
|
||||
|
||||
# prior to 2.4.30 this managed file would restart the salt-minion service when updated
|
||||
# since this file is currently only adding a delay service start
|
||||
# it is not required to restart the service
|
||||
salt_minion_service_unit_file:
|
||||
file.managed:
|
||||
- name: {{ SYSTEMD_UNIT_FILE }}
|
||||
- source: salt://salt/service/salt-minion.service.jinja
|
||||
- template: jinja
|
||||
- onchanges_in:
|
||||
- module: systemd_reload
|
||||
|
||||
{% endif %}
|
||||
Reference in New Issue
Block a user