CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6275 from Security-Onion-Solutions/syncesusers_so-kratos

Browse Source 
break kratos state out from soc state
This commit is contained in:
Jason Ertel
2021-11-18 09:13:10 -05:00
committed by GitHub
parent 12546a8efa cd1f0c0440
commit 96f1f0174b
8 changed files with 97 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/allowed_states.map.jinja
View File

@@ -35,6 +35,7 @@
'influxdb',
'grafana',
'soc',
'kratos',
'firewall',
'idstools',
'suricata.manager',
@@ -100,6 +101,7 @@
'manager',
'nginx',
'soc',
'kratos',
'firewall',
'idstools',
'suricata.manager',
@@ -123,6 +125,7 @@
'influxdb',
'grafana',
'soc',
'kratos',
'firewall',
'idstools',
'suricata.manager',
@@ -142,6 +145,7 @@
'influxdb',
'grafana',
'soc',
'kratos',
'firewall',
'manager',
'idstools',
@@ -172,6 +176,7 @@
'influxdb',
'grafana',
'soc',
'kratos',
'firewall',
'idstools',
'suricata.manager',

0
salt/soc/files/kratos/kratos.yaml → salt/kratos/files/kratos.yaml
View File

0
salt/soc/files/kratos/schema.json → salt/kratos/files/schema.json
View File

84
salt/kratos/init.sls Normal file
View File

@@ -0,0 +1,84 @@
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %}
{% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
{% set MANAGER = salt['grains.get']('master') %}
# Add Kratos Group
kratosgroup:
group.present:
- name: kratos
- gid: 928
# Add Kratos user
kratos:
user.present:
- uid: 928
- gid: 928
- home: /opt/so/conf/kratos
kratosdir:
file.directory:
- name: /opt/so/conf/kratos/db
- user: 928
- group: 928
- makedirs: True
kratoslogdir:
file.directory:
- name: /opt/so/log/kratos
- user: 928
- group: 928
- makedirs: True
kratossync:
file.recurse:
- name: /opt/so/conf/kratos
- source: salt://kratos/files
- user: 928
- group: 928
- file_mode: 600
- template: jinja
kratos_schema:
file.exists:
- name: /opt/so/conf/kratos/schema.json
kratos_yaml:
file.exists:
- name: /opt/so/conf/kratos/kratos.yaml
so-kratos:
docker_container.running:
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-kratos:{{ VERSION }}
- hostname: kratos
- name: so-kratos
- binds:
- /opt/so/conf/kratos/schema.json:/kratos-conf/schema.json:ro
- /opt/so/conf/kratos/kratos.yaml:/kratos-conf/kratos.yaml:ro
- /opt/so/log/kratos/:/kratos-log:rw
- /opt/so/conf/kratos/db:/kratos-data:rw
- port_bindings:
- 0.0.0.0:4433:4433
- 0.0.0.0:4434:4434
- watch:
- file: /opt/so/conf/kratos
- require:
- file: kratos_schema
- file: kratos_yaml
- file: kratoslogdir
- file: kratosdir
append_so-kratos_so-status.conf:
file.append:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-kratos
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

2
salt/manager/init.sls
View File

@@ -24,7 +24,7 @@ include:
- elasticsearch.auth
- kibana.secrets
- salt.minion
- soc
- kratos
socore_own_saltstack:
file.directory:

70
salt/soc/init.sls
View File

@@ -132,76 +132,6 @@ append_so-soc_so-status.conf:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-soc
# Add Kratos Group
kratosgroup:
group.present:
- name: kratos
- gid: 928
# Add Kratos user
kratos:
user.present:
- uid: 928
- gid: 928
- home: /opt/so/conf/kratos
kratosdir:
file.directory:
- name: /opt/so/conf/kratos/db
- user: 928
- group: 928
- makedirs: True
kratoslogdir:
file.directory:
- name: /opt/so/log/kratos
- user: 928
- group: 928
- makedirs: True
kratossync:
file.recurse:
- name: /opt/so/conf/kratos
- source: salt://soc/files/kratos
- user: 928
- group: 928
- file_mode: 600
- template: jinja
kratos_schema:
file.exists:
- name: /opt/so/conf/kratos/schema.json
kratos_yaml:
file.exists:
- name: /opt/so/conf/kratos/kratos.yaml
so-kratos:
docker_container.running:
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-kratos:{{ VERSION }}
- hostname: kratos
- name: so-kratos
- binds:
- /opt/so/conf/kratos/schema.json:/kratos-conf/schema.json:ro
- /opt/so/conf/kratos/kratos.yaml:/kratos-conf/kratos.yaml:ro
- /opt/so/log/kratos/:/kratos-log:rw
- /opt/so/conf/kratos/db:/kratos-data:rw
- port_bindings:
- 0.0.0.0:4433:4433
- 0.0.0.0:4434:4434
- watch:
- file: /opt/so/conf/kratos
- require:
- file: kratos_schema
- file: kratos_yaml
- file: kratoslogdir
- file: kratosdir
append_so-kratos_so-status.conf:
file.append:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-kratos
{% else %}
{{sls}}_state_not_allowed:

5
salt/top.sls
View File

@@ -99,6 +99,7 @@ base:
- influxdb
- grafana
- soc
- kratos
- firewall
- idstools
- suricata.manager
@@ -167,6 +168,7 @@ base:
- influxdb
- grafana
- soc
- kratos
- firewall
- manager
- idstools
@@ -233,6 +235,7 @@ base:
- influxdb
- grafana
- soc
- kratos
- firewall
- idstools
- suricata.manager
@@ -333,6 +336,7 @@ base:
- influxdb
- grafana
- soc
- kratos
- firewall
- manager
- idstools
@@ -453,6 +457,7 @@ base:
- manager
- nginx
- soc
- kratos
- firewall
- idstools
- suricata.manager

7
setup/so-setup
View File

@@ -762,15 +762,12 @@ echo "1" > /root/accept_changes
salt-call state.apply -l info registry >> $setup_log 2>&1
docker_seed_registry # ~ 60% when finished
set_progress_str 59 "$(print_salt_state_apply 'elasticsearch.auth')"
salt-call state.apply -l info elasticsearch.auth >> $setup_log 2>&1
set_progress_str 60 "$(print_salt_state_apply 'manager')"
salt-call state.apply -l info manager >> $setup_log 2>&1
echo "Executing so-elastic-auth..." >> $setup_log 2>&1
ELASTIC_AUTH_SKIP_HIGHSTATE=true bash /opt/so/saltstack/default/salt/common/tools/sbin/so-elastic-auth true >> $setup_log 2>&1
echo "Finished so-elastic-auth..." >> $setup_log 2>&1
set_progress_str 60 "$(print_salt_state_apply 'manager')"
salt-call state.apply -l info manager >> $setup_log 2>&1
fi
set_progress_str 61 "$(print_salt_state_apply 'firewall')"