append role to minion id and use it to target in top - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/136

pillar/top.sls

@@ -3,19 +3,19 @@ base:
     - patch.needs_restarting
     - docker.config
 
-  'G@role:so-mastersearch or G@role:so-heavynode':
+  '*_mastersearch or *_heavynode':
     - match: compound
     - logstash
     - logstash.master
     - logstash.search
 
-  'G@role:so-sensor':
+  '*_sensor':
     - static
     - firewall.*
     - brologs
     - minions.{{ grains.id }}
 
-  'G@role:so-master or G@role:so-mastersearch':
+  '*_master or *_mastersearch':
     - match: compound
     - static
     - firewall.*
@@ -23,11 +23,11 @@ base:
     - auth
     - minions.{{ grains.id }}
 
-  'G@role:so-master':
+  '*_master':
     - logstash
     - logstash.master
 
-  'G@role:so-eval':
+  '*_eval':
     - static
     - firewall.*
     - data.*
@@ -37,18 +37,18 @@ base:
     - logstash.eval
     - minions.{{ grains.id }}
 
-  'G@role:so-node':
+  '*_node':
     - static
     - firewall.*
     - minions.{{ grains.id }}
 
-  'G@role:so-heavynode':
+  '*_heavynode':
     - static
     - firewall.*
     - brologs
     - minions.{{ grains.id }}
 
-  'G@role:so-helix':
+  '*_helix':
     - static
     - firewall.*
     - fireeye

salt/ssl/init.sls

@@ -1,17 +1,24 @@
 {% set master = salt['grains.get']('master') %}
-{% set master_minion_id = master.split(".")[0] %}
-{%- set masterip = salt['pillar.get']('static:masterip', '') -%}
+{% set masterip = salt['pillar.get']('static:masterip', '') %}
+{% set global_ca_text = [] %}
+{% set global_ca_server = [] %}
 
-{% if grains['role'] == 'so-master' or grains['role'] == 'so-eval' %}
+{% if 'master' in grains.id.split('_')|last or 'eval' in grains.id.split('_')|last %}
     {% set trusttheca_text =  salt['mine.get'](grains.id, 'x509.get_pem_entries')[grains.id]['/etc/pki/ca.crt']|replace('\n', '') %}
     {% set ca_server = grains.id %}
 {% else %}
-    {% set trusttheca_text =  salt['mine.get'](master_minion_id, 'x509.get_pem_entries')[master_minion_id]['/etc/pki/ca.crt']|replace('\n', '') %}
-    {% set ca_server = master_minion_id %}
+    {% set x509dict =  salt['mine.get']('*', 'x509.get_pem_entries') %}
+    {% for host in x509dict %}
+      {% if 'master' in host.split('_')|last %}
+        {% do global_ca_text.append(x509dict[host].get('/etc/pki/ca.crt')|replace('\n', '')) %}
+        {% do global_ca_server.append(host) %}
+      {% endif %}
+    {% endfor %}
+    {% set trusttheca_text = global_ca_text[0] %}
+    {% set ca_server = global_ca_server[0] %}
 {% endif %}
 
 # Trust the CA
-
 trusttheca:
   x509.pem_managed:
     - name: /etc/ssl/certs/intca.crt

salt/top.sls

@@ -11,7 +11,7 @@ base:
     - patch.os.schedule
     - motd
 
-  'G@role:so-helix':
+  '*_helix':
     - ca
     - ssl
     - registry
@@ -26,7 +26,7 @@ base:
     - filebeat
     - schedule
 
-  'G@role:so-sensor':
+  '*_sensor':
     - ca
     - ssl
     - common
@@ -43,7 +43,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-eval':
+  '*_eval':
     - ca
     - ssl
     - registry
@@ -89,7 +89,7 @@ base:
     {%- endif %}
 
 
-  'G@role:so-master':
+  '*_master':
     - ca
     - ssl
     - registry
@@ -133,8 +133,8 @@ base:
 
   # Search node logic
 
-  'G@role:so-node and I@node:node_type:parser':
-    - match: pillar
+  '*_node and I@node:node_type:parser':
+    - match: compound
     - common
     - firewall
     - logstash
@@ -143,8 +143,8 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-node and I@node:node_type:hot':
-    - match: pillar
+  '*_node and I@node:node_type:hot':
+    - match: compound
     - common
     - firewall
     - logstash
@@ -155,8 +155,8 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-node and I@node:node_type:warm':
-    - match: pillar
+  '*_node and I@node:node_type:warm':
+    - match: compound
     - common
     - firewall
     - elasticsearch
@@ -165,7 +165,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-node and I@node:node_type:search':
+  '*_node and I@node:node_type:search':
     - match: compound
     - ca
     - ssl
@@ -183,7 +183,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:mastersensor':
+  '*_mastersensor':
     - common
     - firewall
     - sensor
@@ -194,7 +194,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-mastersearch':
+  '*_mastersearch':
     - ca
     - ssl
     - registry
@@ -238,7 +238,7 @@ base:
     - domainstats
     {%- endif %}
 
-  'G@role:so-heavynode':
+  '*_heavynode':
     - ca
     - ssl
     - common

setup/so-functions

@@ -1236,7 +1236,6 @@ set_hostname() {
   echo "::1   localhost localhost.localdomain localhost6 localhost6.localdomain6" >> /etc/hosts
   echo $HOSTNAME > /etc/hostname
   HOSTNAME=$(cat /etc/hostname)
-  MINION_ID=$(echo $HOSTNAME | awk -F. {'print $1'})
   if [ $INSTALLTYPE != 'MASTER' ] || [ $INSTALLTYPE != 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
     if [[ $TESTHOST = *"not found"* ]] || [[ $TESTHOST = *"connection timed out"* ]]; then
       if ! grep -q $MSRVIP /etc/hosts; then
@@ -1273,7 +1272,7 @@ set_initial_firewall_policy() {
       if [ $INSTALLTYPE == 'EVAL' ]; then
         /opt/so/saltstack/pillar/data/addtotab.sh evaltab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM bond0
       elif [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
-        /opt/so/saltstack/pillar/data/addtotab.sh mastersearchtab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM
+        /opt/so/saltstack/pillar/data/addtotab.sh nodestab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM
       fi
   fi
 

setup/so-setup

@@ -121,6 +121,7 @@ if (whiptail_you_sure) ; then
   whiptail_install_type
   SHORTNAME=$(echo $HOSTNAME | awk -F. {'print $1'})
   MINION_ID=$(echo $SHORTNAME'_'$INSTALLTYPE | tr '[:upper:]' '[:lower:]')
+  echo "MINION_ID = $MINION_ID" >> $SETUPLOG 2>&1
 
   # How do we want to handle OS patching? manual, auto or scheduled days and hours
   whiptail_patch_schedule