From d5dc28e52689d08983530ef8da04ded2f8c7166f Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 21 Apr 2026 14:40:19 -0400 Subject: [PATCH 1/6] Fan postgres telegraf cred for manager on every auth run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The empty-pillar case produced a telegraf.conf with `user= password=` which libpq misparses ("password=" gets consumed as the user value), yielding `password authentication failed for user "password="` on every manager without a prior fan-out (fresh install, not the salt-key path the reactor handles). Two fixes: - salt/postgres/auth.sls: always fan for grains.id in addition to any postgres_fanout_minion from the reactor, so the manager's own pillar is populated on every postgres.auth run. The existing `unless` guard keeps re-runs idempotent. - salt/telegraf/etc/telegraf.conf: gate the [[outputs.postgresql]] block on PG_USER and PG_PASS being non-empty. If a minion hasn't received its pillar yet the output block simply isn't rendered — the next highstate picks up the creds once the fan-out completes, and in the meantime telegraf keeps running the other outputs instead of erroring with a malformed connection string. --- salt/postgres/auth.sls | 33 +++++++++++++++++++++++---------- salt/telegraf/etc/telegraf.conf | 2 +- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/salt/postgres/auth.sls b/salt/postgres/auth.sls index e0397beba..ec6f3ec7e 100644 --- a/salt/postgres/auth.sls +++ b/salt/postgres/auth.sls @@ -50,14 +50,27 @@ postgres_auth_pillar: {% endfor %} - show_changes: False - {# Fan a specific minion's telegraf cred out to its own pillar file. Only - runs when postgres_fanout_minion pillar is provided — otherwise this state - is a no-op. That keeps manager highstates from doing N so-yaml.py forks - when nothing changed. The reactor passes postgres_fanout_minion through - the orch on salt-key accept; soup handles bulk backfill separately. #} + {# Fan a specific minion's telegraf cred out to its own pillar file. + Two triggers populate the target list: + - grains.id (always) so the manager's own pillar is populated on every + postgres.auth run — otherwise the manager's telegraf has no cred on + a fresh install and can't write to its own postgres. + - pillar postgres_fanout_minion (when the reactor fires on a new + minion's salt-key accept). + The `unless` guard keeps re-runs idempotent, so this is one so-yaml.py + check per target, not per minion in the grid. Bulk backfill for + already-accepted minions lives in soup. #} + {% set fanout_targets = [] %} + {% if grains.id %} + {%- do fanout_targets.append(grains.id) %} + {% endif %} {% set fanout_mid = salt['pillar.get']('postgres_fanout_minion') %} - {% if fanout_mid %} - {%- set safe = fanout_mid | replace('.','_') | replace('-','_') | lower %} + {% if fanout_mid and fanout_mid not in fanout_targets %} + {%- do fanout_targets.append(fanout_mid) %} + {% endif %} + + {% for mid in fanout_targets %} + {%- set safe = mid | replace('.','_') | replace('-','_') | lower %} {%- set key = 'telegraf_' ~ safe %} {%- set entry = telegraf_users.get(key) %} {%- if entry %} @@ -66,7 +79,7 @@ postgres_telegraf_minion_pillar_{{ safe }}: cmd.run: - name: | set -e - PILLAR_FILE=/opt/so/saltstack/local/pillar/minions/{{ fanout_mid }}.sls + PILLAR_FILE=/opt/so/saltstack/local/pillar/minions/{{ mid }}.sls if [ ! -f "$PILLAR_FILE" ]; then echo '{}' > "$PILLAR_FILE" chown socore:socore "$PILLAR_FILE" 2>/dev/null || true @@ -75,12 +88,12 @@ postgres_telegraf_minion_pillar_{{ safe }}: /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.user '{{ entry.user }}' /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.pass '{{ entry.pass }}' - unless: | - [ "$(/usr/sbin/so-yaml.py get -r /opt/so/saltstack/local/pillar/minions/{{ fanout_mid }}.sls postgres.telegraf.user 2>/dev/null)" = '{{ entry.user }}' ] + [ "$(/usr/sbin/so-yaml.py get -r /opt/so/saltstack/local/pillar/minions/{{ mid }}.sls postgres.telegraf.user 2>/dev/null)" = '{{ entry.user }}' ] - require: - file: postgres_auth_pillar {%- endif %} - {% endif %} + {% endfor %} {% else %} {{sls}}_state_not_allowed: diff --git a/salt/telegraf/etc/telegraf.conf b/salt/telegraf/etc/telegraf.conf index 001a61d93..53b96e4ab 100644 --- a/salt/telegraf/etc/telegraf.conf +++ b/salt/telegraf/etc/telegraf.conf @@ -96,7 +96,7 @@ # insecure_skip_verify = false {%- endif %} -{%- if TG_OUT in ['POSTGRES', 'BOTH'] %} +{%- if TG_OUT in ['POSTGRES', 'BOTH'] and PG_USER and PG_PASS %} # Configuration for sending metrics to PostgreSQL. # options='-c role=so_telegraf' makes every connection SET ROLE to the shared # group role so tables created on first write are owned by so_telegraf, and From 81c0f2b464b83f22be2cc6a6a872f481cef16125 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 21 Apr 2026 14:43:10 -0400 Subject: [PATCH 2/6] so-yaml.py: tolerate missing ancestors in removeKey MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit replace calls removeKey before addKey, so running `so-yaml.py replace` on a new dotted key whose parent doesn't exist — e.g., postgres.auth fanning postgres.telegraf.user into a minion pillar file that has never carried any postgres.* keys — crashed with KeyError: 'postgres' from removeKey recursing into a missing parent dict. Make removeKey a no-op when an intermediate key is absent so that: - `remove` has the natural "remove if exists" semantics, and - `replace` works for brand-new nested keys. --- salt/manager/tools/sbin/so-yaml.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/salt/manager/tools/sbin/so-yaml.py b/salt/manager/tools/sbin/so-yaml.py index 79dcfcac0..98d2bb8f9 100755 --- a/salt/manager/tools/sbin/so-yaml.py +++ b/salt/manager/tools/sbin/so-yaml.py @@ -285,7 +285,8 @@ def add(args): def removeKey(content, key): pieces = key.split(".", 1) if len(pieces) > 1: - removeKey(content[pieces[0]], pieces[1]) + if pieces[0] in content: + removeKey(content[pieces[0]], pieces[1]) else: content.pop(key, None) From 1abfd77351411c4a9477daccafe8448699b3152d Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 21 Apr 2026 15:10:57 -0400 Subject: [PATCH 3/6] Hide telegraf password from console and close so-minion race Two fixes on the postgres telegraf fan-out path: 1. postgres.auth cmd.run leaked the password to the console because Salt always prints the Name: field and `show_changes: False` does not apply to cmd.run. Move the user and password into the `env:` attribute so the shell body still sees them via $PG_USER / $PG_PASS but Salt's state reporter never renders them. 2. so-minion's addMinion -> setupMinionFiles sequence removes the minion pillar file and rewrites it from scratch, which wipes the postgres.telegraf.* entries the reactor may have already written on salt-key accept. Add a postgres.auth fan-out step to orch.deploy_newnode (the orch so-minion kicks off after setupMinionFiles) and require it from the new minion's highstate. Idempotent via the existing unless: guard in postgres.auth. --- salt/orch/deploy_newnode.sls | 17 +++++++++++++++++ salt/postgres/auth.sls | 7 +++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/salt/orch/deploy_newnode.sls b/salt/orch/deploy_newnode.sls index c05a812a3..0a2c448ba 100644 --- a/salt/orch/deploy_newnode.sls +++ b/salt/orch/deploy_newnode.sls @@ -12,6 +12,21 @@ attempts: 36 interval: 5 +# so-minion's setupMinionFiles rebuilds the new minion's pillar file from +# scratch, wiping any postgres.telegraf.* entries the reactor may have written +# on salt-key accept. Re-fan the cred here so the highstate below sees it. +# Idempotent via the unless: guard in postgres.auth. +manager_fanout_postgres_telegraf_{{NEWNODE}}: + salt.state: + - tgt: {{ MANAGER }} + - sls: + - postgres.auth + - queue: True + - pillar: + postgres_fanout_minion: {{ NEWNODE }} + - require: + - salt: {{NEWNODE}}_update_mine + # we need to prepare the manager for a new searchnode or heavynode {% if NEWNODE.split('_')|last in ['searchnode', 'heavynode'] %} manager_run_es_soc: @@ -30,3 +45,5 @@ manager_run_es_soc: - tgt: {{ NEWNODE }} - highstate: True - queue: True + - require: + - salt: manager_fanout_postgres_telegraf_{{NEWNODE}} diff --git a/salt/postgres/auth.sls b/salt/postgres/auth.sls index ec6f3ec7e..beed1f8bd 100644 --- a/salt/postgres/auth.sls +++ b/salt/postgres/auth.sls @@ -85,8 +85,11 @@ postgres_telegraf_minion_pillar_{{ safe }}: chown socore:socore "$PILLAR_FILE" 2>/dev/null || true chmod 640 "$PILLAR_FILE" fi - /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.user '{{ entry.user }}' - /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.pass '{{ entry.pass }}' + /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.user "$PG_USER" + /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.pass "$PG_PASS" + - env: + - PG_USER: '{{ entry.user }}' + - PG_PASS: '{{ entry.pass }}' - unless: | [ "$(/usr/sbin/so-yaml.py get -r /opt/so/saltstack/local/pillar/minions/{{ mid }}.sls postgres.telegraf.user 2>/dev/null)" = '{{ entry.user }}' ] - require: From 5f28e9b1916b964b9f67c8209a4dd9e6085fdfab Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 21 Apr 2026 15:34:15 -0400 Subject: [PATCH 4/6] Move per-minion telegraf cred provisioning into so-minion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Simpler, race-free replacement for the reactor + orch + fan-out chain. - salt/manager/tools/sbin/so-minion: expand add_telegraf_to_minion to generate a random 72-char password, reuse any existing password from the aggregate pillar, write postgres.telegraf.{user,pass} into the minion's own pillar file, and update the aggregate pillar so postgres.telegraf_users can CREATE ROLE on the next manager apply. Every create function already calls this hook, so add / addVM / setup dispatches are all covered identically and synchronously. - salt/postgres/auth.sls: strip the fanout_targets loop and the postgres_telegraf_minion_pillar_ cmd.run block — it's now redundant. The state still manages the so_postgres admin user and writes the aggregate pillar for postgres.telegraf_users to consume. - salt/reactor/telegraf_user_sync.sls: deleted. - salt/orch/telegraf_postgres_sync.sls: deleted. - salt/salt/master.sls: drop the reactor_config_telegraf block that registered the reactor on /etc/salt/master.d/reactor_telegraf.conf. - salt/orch/deploy_newnode.sls: drop the manager_fanout_postgres_telegraf step and the require: it added to the newnode highstate. Back to its original 3/dev shape. No more ephemeral postgres_fanout_minion pillar, no more async salt/key reactor, no more so-minion setupMinionFiles race: the pillar write happens inline inside setupMinionFiles itself. --- salt/manager/tools/sbin/so-minion | 31 ++++++++++++++++++ salt/orch/deploy_newnode.sls | 17 ---------- salt/orch/telegraf_postgres_sync.sls | 28 ---------------- salt/postgres/auth.sls | 48 ---------------------------- salt/reactor/telegraf_user_sync.sls | 18 ----------- salt/salt/master.sls | 13 -------- 6 files changed, 31 insertions(+), 124 deletions(-) delete mode 100644 salt/orch/telegraf_postgres_sync.sls delete mode 100644 salt/reactor/telegraf_user_sync.sls diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion index 76b067817..a770cf21b 100755 --- a/salt/manager/tools/sbin/so-minion +++ b/salt/manager/tools/sbin/so-minion @@ -542,6 +542,37 @@ function add_telegraf_to_minion() { log "ERROR" "Failed to add telegraf configuration to $PILLARFILE" return 1 fi + + # Provision the per-minion postgres Telegraf credential so telegraf.conf + # renders correctly on the minion's first highstate and postgres.telegraf_users + # picks up the matching aggregate entry on the next manager apply. + # + # Writes: + # - postgres.telegraf.{user,pass} into the minion's own pillar file + # (distributed to only this minion via pillar/top.sls). + # - postgres.auth.users.telegraf_.{user,pass} into the aggregate + # pillar so postgres.telegraf_users CREATE ROLE finds it. + # + # An existing password is reused if the aggregate already has one (re-add), + # so rerunning so-minion for the same minion keeps the cred stable. + local MINION_SAFE + MINION_SAFE=$(echo "$MINION_ID" | tr '.-' '__' | tr '[:upper:]' '[:lower:]') + local PG_USER="so_telegraf_${MINION_SAFE}" + local AGGREGATE=/opt/so/saltstack/local/pillar/postgres/auth.sls + local PG_PASS="" + if [[ -f "$AGGREGATE" ]]; then + PG_PASS=$(so-yaml.py get -r "$AGGREGATE" "postgres.auth.users.telegraf_${MINION_SAFE}.pass" 2>/dev/null || true) + fi + if [[ -z "$PG_PASS" ]]; then + PG_PASS=$(tr -dc 'A-Za-z0-9~!@#^&*()_=+[]|;:,.<>?-' < /dev/urandom | head -c 72) + fi + + so-yaml.py replace "$PILLARFILE" postgres.telegraf.user "$PG_USER" >/dev/null + so-yaml.py replace "$PILLARFILE" postgres.telegraf.pass "$PG_PASS" >/dev/null + if [[ -f "$AGGREGATE" ]]; then + so-yaml.py replace "$AGGREGATE" "postgres.auth.users.telegraf_${MINION_SAFE}.user" "$PG_USER" >/dev/null + so-yaml.py replace "$AGGREGATE" "postgres.auth.users.telegraf_${MINION_SAFE}.pass" "$PG_PASS" >/dev/null + fi } function add_influxdb_to_minion() { diff --git a/salt/orch/deploy_newnode.sls b/salt/orch/deploy_newnode.sls index 0a2c448ba..c05a812a3 100644 --- a/salt/orch/deploy_newnode.sls +++ b/salt/orch/deploy_newnode.sls @@ -12,21 +12,6 @@ attempts: 36 interval: 5 -# so-minion's setupMinionFiles rebuilds the new minion's pillar file from -# scratch, wiping any postgres.telegraf.* entries the reactor may have written -# on salt-key accept. Re-fan the cred here so the highstate below sees it. -# Idempotent via the unless: guard in postgres.auth. -manager_fanout_postgres_telegraf_{{NEWNODE}}: - salt.state: - - tgt: {{ MANAGER }} - - sls: - - postgres.auth - - queue: True - - pillar: - postgres_fanout_minion: {{ NEWNODE }} - - require: - - salt: {{NEWNODE}}_update_mine - # we need to prepare the manager for a new searchnode or heavynode {% if NEWNODE.split('_')|last in ['searchnode', 'heavynode'] %} manager_run_es_soc: @@ -45,5 +30,3 @@ manager_run_es_soc: - tgt: {{ NEWNODE }} - highstate: True - queue: True - - require: - - salt: manager_fanout_postgres_telegraf_{{NEWNODE}} diff --git a/salt/orch/telegraf_postgres_sync.sls b/salt/orch/telegraf_postgres_sync.sls deleted file mode 100644 index 5b11d1619..000000000 --- a/salt/orch/telegraf_postgres_sync.sls +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one -# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at -# https://securityonion.net/license; you may not use this file except in compliance with the -# Elastic License 2.0. - -# Fired by salt/reactor/telegraf_user_sync.sls when salt-key accepts a new -# minion. Only provisions the per-minion pillar entry and DB role on the -# manager; the minion itself will pick up its telegraf config on its first -# highstate during onboarding, so there's no need to push the telegraf state -# from here. -# -# Target the manager via role grains — same pattern as orch/delete_hypervisor.sls. -# The reactor doesn't know the manager's minion id, and grains.master on the -# runner is a hostname, not a targetable id. -{% set FANOUT_MINION = salt['pillar.get']('postgres_fanout_minion', '') %} - -manager_sync_telegraf_pg_users: - salt.state: - - tgt: 'G@role:so-manager or G@role:so-managerhype or G@role:so-managersearch or G@role:so-standalone or G@role:so-eval' - - tgt_type: compound - - sls: - - postgres.auth - - postgres.telegraf_users - - queue: True - {% if FANOUT_MINION %} - - pillar: - postgres_fanout_minion: {{ FANOUT_MINION }} - {% endif %} diff --git a/salt/postgres/auth.sls b/salt/postgres/auth.sls index beed1f8bd..3da1bcde0 100644 --- a/salt/postgres/auth.sls +++ b/salt/postgres/auth.sls @@ -49,54 +49,6 @@ postgres_auth_pillar: pass: "{{ entry.pass }}" {% endfor %} - show_changes: False - - {# Fan a specific minion's telegraf cred out to its own pillar file. - Two triggers populate the target list: - - grains.id (always) so the manager's own pillar is populated on every - postgres.auth run — otherwise the manager's telegraf has no cred on - a fresh install and can't write to its own postgres. - - pillar postgres_fanout_minion (when the reactor fires on a new - minion's salt-key accept). - The `unless` guard keeps re-runs idempotent, so this is one so-yaml.py - check per target, not per minion in the grid. Bulk backfill for - already-accepted minions lives in soup. #} - {% set fanout_targets = [] %} - {% if grains.id %} - {%- do fanout_targets.append(grains.id) %} - {% endif %} - {% set fanout_mid = salt['pillar.get']('postgres_fanout_minion') %} - {% if fanout_mid and fanout_mid not in fanout_targets %} - {%- do fanout_targets.append(fanout_mid) %} - {% endif %} - - {% for mid in fanout_targets %} - {%- set safe = mid | replace('.','_') | replace('-','_') | lower %} - {%- set key = 'telegraf_' ~ safe %} - {%- set entry = telegraf_users.get(key) %} - {%- if entry %} - -postgres_telegraf_minion_pillar_{{ safe }}: - cmd.run: - - name: | - set -e - PILLAR_FILE=/opt/so/saltstack/local/pillar/minions/{{ mid }}.sls - if [ ! -f "$PILLAR_FILE" ]; then - echo '{}' > "$PILLAR_FILE" - chown socore:socore "$PILLAR_FILE" 2>/dev/null || true - chmod 640 "$PILLAR_FILE" - fi - /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.user "$PG_USER" - /usr/sbin/so-yaml.py replace "$PILLAR_FILE" postgres.telegraf.pass "$PG_PASS" - - env: - - PG_USER: '{{ entry.user }}' - - PG_PASS: '{{ entry.pass }}' - - unless: | - [ "$(/usr/sbin/so-yaml.py get -r /opt/so/saltstack/local/pillar/minions/{{ mid }}.sls postgres.telegraf.user 2>/dev/null)" = '{{ entry.user }}' ] - - require: - - file: postgres_auth_pillar - - {%- endif %} - {% endfor %} {% else %} {{sls}}_state_not_allowed: diff --git a/salt/reactor/telegraf_user_sync.sls b/salt/reactor/telegraf_user_sync.sls deleted file mode 100644 index 075dbf62e..000000000 --- a/salt/reactor/telegraf_user_sync.sls +++ /dev/null @@ -1,18 +0,0 @@ -# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one -# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at -# https://securityonion.net/license; you may not use this file except in compliance with the -# Elastic License 2.0. - -{# Fires on salt/key. Only act on successful key acceptance — not reauth. #} -{% if data.get('act') == 'accept' and data.get('result') == True and data.get('id') %} - -{{ data['id'] }}_telegraf_pg_sync: - runner.state.orchestrate: - - args: - - mods: orch.telegraf_postgres_sync - - pillar: - postgres_fanout_minion: {{ data['id'] }} - -{% do salt.log.info('telegraf_user_sync reactor: syncing telegraf PG user for minion %s' % data['id']) %} - -{% endif %} diff --git a/salt/salt/master.sls b/salt/salt/master.sls index e61b09d21..895150cd7 100644 --- a/salt/salt/master.sls +++ b/salt/salt/master.sls @@ -62,19 +62,6 @@ engines_config: - name: /etc/salt/master.d/engines.conf - source: salt://salt/files/engines.conf -reactor_config_telegraf: - file.managed: - - name: /etc/salt/master.d/reactor_telegraf.conf - - contents: | - reactor: - - 'salt/key': - - /opt/so/saltstack/default/salt/reactor/telegraf_user_sync.sls - - user: root - - group: root - - mode: 644 - - watch_in: - - service: salt_master_service - # update the bootstrap script when used for salt-cloud salt_bootstrap_cloud: file.managed: From dbf4fb66a4a3c88490e0f033f770322ab7e840e4 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 21 Apr 2026 15:43:01 -0400 Subject: [PATCH 5/6] Clean up postgres telegraf cred on so-minion delete MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Paired with the add path in add_telegraf_to_minion: when a minion is removed, drop its entry from the aggregate postgres pillar and drop the matching so_telegraf_ role from the database. Without this, stale entries and DB roles accumulate over time. Makes rotate-password and compromise-recovery both a clean delete+add: so-minion -o=delete -m= so-minion -o=add -m= The first call drops the role and clears the aggregate pillar; the second generates a brand-new password. The cleanup is best-effort — if so-postgres isn't running or the DROP ROLE fails (e.g., the role owns unexpected objects), we log a warning and continue so the minion delete itself never gets blocked by postgres state. Admins can mop up stray roles manually if that happens. --- salt/manager/tools/sbin/so-minion | 40 ++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion index a770cf21b..4095637c8 100755 --- a/salt/manager/tools/sbin/so-minion +++ b/salt/manager/tools/sbin/so-minion @@ -273,7 +273,7 @@ function deleteMinionFiles () { log "ERROR" "Failed to delete $PILLARFILE" return 1 fi - + rm -f $ADVPILLARFILE if [ $? -ne 0 ]; then log "ERROR" "Failed to delete $ADVPILLARFILE" @@ -281,6 +281,43 @@ function deleteMinionFiles () { fi } +# Remove this minion's postgres Telegraf credential from both the aggregate +# pillar and the postgres database. Paired with add_telegraf_to_minion: +# add/delete cycle both here and in the DB. Always returns 0 so a dead or +# unreachable so-postgres doesn't block minion deletion — in that case we +# log a warning and leave the role behind for manual cleanup. +function remove_postgres_telegraf_from_minion() { + local MINION_SAFE + MINION_SAFE=$(echo "$MINION_ID" | tr '.-' '__' | tr '[:upper:]' '[:lower:]') + local PG_USER="so_telegraf_${MINION_SAFE}" + local AGGREGATE=/opt/so/saltstack/local/pillar/postgres/auth.sls + + log "INFO" "Removing postgres telegraf cred for $MINION_ID" + + if [[ -f "$AGGREGATE" ]]; then + so-yaml.py remove "$AGGREGATE" "postgres.auth.users.telegraf_${MINION_SAFE}" >/dev/null 2>&1 || true + fi + + if docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^so-postgres$'; then + if ! docker exec -i so-postgres psql -v ON_ERROR_STOP=1 -U postgres -d so_telegraf >/dev/null 2>&1 < Date: Tue, 21 Apr 2026 15:45:05 -0400 Subject: [PATCH 6/6] soup: update postgres backfill comment to reflect reactor removal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The reactor path is gone; so-minion now owns add/delete for new minions. The backfill itself is unchanged — postgres.auth's up_minions fallback fills the aggregate, postgres.telegraf_users creates the roles, and the bash loop fans to per-minion pillar files — so the pre-feature upgrade story still works end-to-end. Just refresh the comment so it isn't misleading. --- salt/manager/tools/sbin/soup | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index c19fe487e..1580e83dd 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -491,10 +491,11 @@ post_to_3.1.0() { /usr/sbin/so-kibana-space-defaults # One-time backfill for minions that existed before the postgres Telegraf - # feature shipped. Generate the aggregate pillar on the manager and create - # the per-minion DB roles, then fan each minion's cred into its own pillar - # file. Going forward the reactor handles each new salt-key accept with a - # targeted fan-out, so a manager highstate no longer needs to iterate. + # feature shipped. postgres.auth's up_minions fallback loop generates any + # missing aggregate pillar entries; postgres.telegraf_users CREATEs the + # matching DB roles; then the bash loop below copies each minion's cred + # into its own pillar file. Going forward, so-minion owns add/delete for + # every new minion, so this backfill is only needed on the upgrade boundary. echo "Provisioning Telegraf Postgres users for existing minions." salt-call --local state.apply postgres.auth,postgres.telegraf_users queue=True || true