Merge pull request #415 from Security-Onion-Solutions/issue/136

Issue/136

salt/ssl/init.sls

@@ -1,17 +1,24 @@
 {% set master = salt['grains.get']('master') %}
-{% set master_minion_id = master.split(".")[0] %}
-{%- set masterip = salt['pillar.get']('static:masterip', '') -%}
+{% set masterip = salt['pillar.get']('static:masterip', '') %}
+{% set global_ca_text = [] %}
+{% set global_ca_server = [] %}
 
-{% if grains['role'] == 'so-master' or grains['role'] == 'so-eval' %}
+{% if 'master' in grains.id.split('_')|last or 'eval' in grains.id.split('_')|last %}
     {% set trusttheca_text =  salt['mine.get'](grains.id, 'x509.get_pem_entries')[grains.id]['/etc/pki/ca.crt']|replace('\n', '') %}
     {% set ca_server = grains.id %}
 {% else %}
-    {% set trusttheca_text =  salt['mine.get'](master_minion_id, 'x509.get_pem_entries')[master_minion_id]['/etc/pki/ca.crt']|replace('\n', '') %}
-    {% set ca_server = master_minion_id %}
+    {% set x509dict =  salt['mine.get']('*', 'x509.get_pem_entries') %}
+    {% for host in x509dict %}
+      {% if 'master' in host.split('_')|last %}
+        {% do global_ca_text.append(x509dict[host].get('/etc/pki/ca.crt')|replace('\n', '')) %}
+        {% do global_ca_server.append(host) %}
+      {% endif %}
+    {% endfor %}
+    {% set trusttheca_text = global_ca_text[0] %}
+    {% set ca_server = global_ca_server[0] %}
 {% endif %}
 
 # Trust the CA
-
 trusttheca:
   x509.pem_managed:
     - name: /etc/ssl/certs/intca.crt

salt/top.sls

@@ -11,7 +11,7 @@ base:
     - patch.os.schedule
     - motd
 
-  'G@role:so-helix':
+  '*_helix':
     - ca
     - ssl
     - registry
@@ -26,7 +26,7 @@ base:
     - filebeat
     - schedule
 
-  'G@role:so-sensor':
+  '*_sensor':
     - ca
     - ssl
     - common
@@ -43,7 +43,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-eval':
+  '*_eval':
     - ca
     - ssl
     - registry
@@ -89,7 +89,7 @@ base:
     {%- endif %}
 
 
-  'G@role:so-master':
+  '*_master':
     - ca
     - ssl
     - registry
@@ -133,8 +133,8 @@ base:
 
   # Search node logic
 
-  'G@role:so-node and I@node:node_type:parser':
-    - match: pillar
+  '*_node and I@node:node_type:parser':
+    - match: compound
     - common
     - firewall
     - logstash
@@ -143,8 +143,8 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-node and I@node:node_type:hot':
-    - match: pillar
+  '*_node and I@node:node_type:hot':
+    - match: compound
     - common
     - firewall
     - logstash
@@ -155,8 +155,8 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-node and I@node:node_type:warm':
-    - match: pillar
+  '*_node and I@node:node_type:warm':
+    - match: compound
     - common
     - firewall
     - elasticsearch
@@ -165,7 +165,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-node and I@node:node_type:search':
+  '*_node and I@node:node_type:search':
     - match: compound
     - ca
     - ssl
@@ -183,7 +183,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:mastersensor':
+  '*_mastersensor':
     - common
     - firewall
     - sensor
@@ -194,7 +194,7 @@ base:
     {%- endif %}
     - schedule
 
-  'G@role:so-mastersearch':
+  '*_mastersearch':
     - ca
     - ssl
     - registry
@@ -238,7 +238,7 @@ base:
     - domainstats
     {%- endif %}
 
-  'G@role:so-heavynode':
+  '*_heavynode':
     - ca
     - ssl
     - common