generate elasticsearch.auth pillar if it doesnt exist

pillar/top.sls

@@ -46,6 +46,9 @@ base:
     - logstash.manager
     - logstash.search
     - elasticsearch.search
+{% if salt['file.exists']('/opt/so/saltstack/local/pillar/elasticsearch/auth.sls') %}
+    - elasticsearch.auth
+{% endif %}
     - data.*
     - zeeklogs
     - secrets

salt/elasticsearch/auth.sls

@@ -0,0 +1,9 @@
+elastic_auth_pillar:
+  file.managed:
+    - name: /opt/so/saltstack/local/pillar/elasticsearch/auth.sls
+    - contents: |
+        elasticsearch:
+          auth:
+            enabled: False
+            user: so_elastic
+            pass: {{ salt['random.get_str'](20) }}

salt/elasticsearch/files/curl.config

@@ -0,0 +1 @@
+user = "salt['pillar.get']('elasticsearch:auth:user'):salt['pillar.get']('elasticsearch:auth:pass')"

salt/elasticsearch/init.sls

@@ -256,6 +256,14 @@ so-elasticsearch-templates:
     - template: jinja
 {% endif %}
 
+elastic_curl_config:
+  file.managed:
+    - name: /opt/so/conf/elasticsearch/curl.config
+    - mode: 600
+    # since we are generating a random password, and we don't want that to happen everytime
+    # a highstate runs, we only manage the file if it doesn't exist
+    - unless: ls /opt/so/conf/elasticsearch/curl.config
+
 {% endif %} {# if grains['role'] != 'so-helix' #}
 
 {% else %}