use global vars in states

salt/elasticsearch/config.map.jinja

@@ -1,3 +1,4 @@
+{% from 'vars/globals.map.jinja' import GLOBALS %}
 {% import_yaml 'elasticsearch/defaults.yaml' as ESCONFIG with context %}
 {% from 'logstash/map.jinja' import REDIS_NODES with context %}
 
@@ -9,7 +10,7 @@
     {% if HIGHLANDER %}
         {% do ESCONFIG.elasticsearch.config.node.roles.extend(['ml', 'transform']) %}
     {% endif %}
-    {% do ESCONFIG.elasticsearch.config.update({'discovery': {'seed_hosts': [grains.master]}}) %}
+    {% do ESCONFIG.elasticsearch.config.update({'discovery': {'seed_hosts': [GLOBALS.manager]}}) %}
     {% for SN in REDIS_NODES.keys() %}
       {% do ESCONFIG.elasticsearch.config.discovery.seed_hosts.append(SN) %}
     {% endfor %}
@@ -23,15 +24,15 @@
         {% do ESCONFIG.elasticsearch.config.node.roles.extend(['ml', 'master', 'transform']) %}
   {% endif %}
   {% do ESCONFIG.elasticsearch.config.node.attr.update({'box_type': 'hot'}) %}
-  {% do ESCONFIG.elasticsearch.config.update({'discovery': {'seed_hosts': [grains.master]}}) %}
+  {% do ESCONFIG.elasticsearch.config.update({'discovery': {'seed_hosts': [GLOBALS.manager]}}) %}
 {% endif %}
 {% if HIGHLANDER %}
       {% do ESCONFIG.elasticsearch.config.xpack.ml.update({'enabled': true}) %}
 {% endif %}
 
-{% do ESCONFIG.elasticsearch.config.node.update({'name': grains.host}) %}
-{% do ESCONFIG.elasticsearch.config.cluster.update({'name': grains.host}) %}
-{% do ESCONFIG.elasticsearch.config.transport.update({'publish_host': grains.host}) %}
+{% do ESCONFIG.elasticsearch.config.node.update({'name': GLOBALS.hostname}) %}
+{% do ESCONFIG.elasticsearch.config.cluster.update({'name': GLOBALS.hostname}) %}
+{% do ESCONFIG.elasticsearch.config.transport.update({'publish_host': GLOBALS.hostname}) %}
 
 {# merge with the elasticsearch pillar #}
 {% set ESCONFIG = salt['pillar.get']('elasticsearch:config', default=ESCONFIG.elasticsearch.config, merge=True) %}

salt/elasticsearch/init.sls

@@ -9,14 +9,13 @@
 include:
   - ssl
 
+{% from 'vars/globals.map.jinja' import GLOBALS %}
 {% set TEMPLATES = salt['pillar.get']('elasticsearch:templates', {}) %}
 {% set ROLES = salt['pillar.get']('elasticsearch:roles', {}) %}
 {% from 'elasticsearch/config.map.jinja' import ESCONFIG with context %}
 {% from 'elasticsearch/template.map.jinja' import ES_INDEX_SETTINGS without context %}
 {% from 'logstash/map.jinja' import REDIS_NODES with context %}
 
-{% from 'vars/globals.map.jinja' import GLOBALS %}
-
 vm.max_map_count:
   sysctl.present:
     - value: 262144
@@ -51,6 +50,8 @@ es_sync_scripts:
     - source: salt://elasticsearch/tools/sbin
     - exclude_pat:
         - so-elasticsearch-pipelines # exclude this because we need to watch it for changes, we sync it in another state
+    - defaults:
+        GLOBALS: {{ GLOBALS }}
 
 so-elasticsearch-pipelines-script:
   file.managed:
@@ -59,7 +60,6 @@ so-elasticsearch-pipelines-script:
     - user: 930
     - group: 939
     - mode: 754
-    - template: jinja
 
 # Move our new CA over so Elastic and Logstash can use SSL with the internal CA
 catrustdir:
@@ -283,7 +283,7 @@ auth_users_roles_inode:
 
 so-elasticsearch:
   docker_container.running:
-    - image: {{ GLOBALS.manager }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ GLOBALS.so_version }}
+    - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ GLOBALS.so_version }}
     - hostname: elasticsearch
     - name: so-elasticsearch
     - user: elasticsearch

salt/elasticsearch/tools/sbin/so-catrust

@@ -5,10 +5,6 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-
-{%- set VERSION = salt['pillar.get']('global:soversion', '') %}
-{%- set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
-{%- set MANAGER = salt['grains.get']('master') %}
 . /usr/sbin/so-common
 
 # Exit on errors, since all lines must succeed
@@ -16,7 +12,7 @@ set -e
 
 # Check to see if we have extracted the ca cert.
 if [ ! -f /opt/so/saltstack/local/salt/common/cacerts ]; then
-    docker run -v /etc/pki/ca.crt:/etc/ssl/ca.crt --name so-elasticsearchca --user root --entrypoint jdk/bin/keytool {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-elasticsearch:{{ VERSION }} -keystore /usr/share/elasticsearch/jdk/lib/security/cacerts -alias SOSCA -import -file /etc/ssl/ca.crt -storepass changeit -noprompt
+    docker run -v /etc/pki/ca.crt:/etc/ssl/ca.crt --name so-elasticsearchca --user root --entrypoint jdk/bin/keytool {{ GLOBALS.manager }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ GLOBALS.so_version }} -keystore /usr/share/elasticsearch/jdk/lib/security/cacerts -alias SOSCA -import -file /etc/ssl/ca.crt -storepass changeit -noprompt
     docker cp so-elasticsearchca:/usr/share/elasticsearch/jdk/lib/security/cacerts /opt/so/saltstack/local/salt/common/cacerts
     docker cp so-elasticsearchca:/etc/ssl/certs/ca-certificates.crt /opt/so/saltstack/local/salt/common/tls-ca-bundle.pem
     docker rm so-elasticsearchca

salt/elasticsearch/tools/sbin/so-elasticsearch-cluster-settings

@@ -1,6 +1,4 @@
 #!/bin/bash
-{% set ES = salt['pillar.get']('manager:mainip', '') %}
-{% set MANAGER = salt['grains.get']('master') %}
 
 ELASTICSEARCH_PORT=9200
 
@@ -32,5 +30,5 @@ fi
 CLUSTER_SETTINGS=$(so-elasticsearch-query _cluster/settings | jq .persistent.cluster.remote)
 if [[ ! -z "$CLUSTER_SETTINGS" ]]; then
   echo "Applying cross cluster search config..."
-  so-elasticsearch-query _cluster/settings -d "{\"persistent\": {\"cluster\": {\"remote\": {\"{{ MANAGER }}\": {\"seeds\": [\"127.0.0.1:9300\"]}}}}}" -XPUT
+  so-elasticsearch-query _cluster/settings -d "{\"persistent\": {\"cluster\": {\"remote\": {\"{{ GLOBALS.manager }}\": {\"seeds\": [\"127.0.0.1:9300\"]}}}}}" -XPUT
 fi

salt/elasticsearch/tools/sbin/so-elasticsearch-roles-load

@@ -4,13 +4,8 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-
-
-{%- set mainint = salt['pillar.get']('host:mainint') %}
-{%- set MYIP = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %}
-
 default_conf_dir=/opt/so/conf
-ELASTICSEARCH_HOST="{{ MYIP }}"
+ELASTICSEARCH_HOST="{{ GLOBALS.node_ip }}"
 ELASTICSEARCH_PORT=9200
 
 # Define a default directory to load roles from

salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load

@@ -3,12 +3,8 @@
 # or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use
 # this file except in compliance with the Elastic License 2.0.
 
-
-{%- set mainint = salt['pillar.get']('host:mainint') %}
-{%- set MYIP = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %}
-
 default_conf_dir=/opt/so/conf
-ELASTICSEARCH_HOST="{{ MYIP }}"
+ELASTICSEARCH_HOST="{{ GLOBALS.node_ip }}"
 ELASTICSEARCH_PORT=9200
 #ELASTICSEARCH_AUTH=""