Initial support for IDH

salt/firewall/assigned_hostgroups.map.yaml

@@ -2,6 +2,7 @@
 {% import_yaml 'firewall/ports/ports.yaml' as portgroups %}
 {% set portgroups = portgroups.firewall.ports %}
 {% set TRUE_CLUSTER = salt['pillar.get']('elasticsearch:true_cluster', True)  %}
+{% from 'idh/opencanary_config.map.jinja' import IDH_PORTGROUPS %}
 
 role:
   eval:
@@ -573,7 +574,7 @@ role:
             portgroups:
             {% set idh_services = salt['pillar.get']('idh:services', []) %}
             {% for service in idh_services %}
-              - {{ portgroups['idh_'~service] }}
+              - {{ IDH_PORTGROUPS['idh_'~service] }}
             {% endfor %}
           dockernet:
             portgroups:
@@ -583,4 +584,7 @@ role:
               - {{ portgroups.all }}
           manager:
             portgroups:
-              - {{ portgroups.ssh }}
+              - {{ IDH_PORTGROUPS.openssh }}
+          standalone:
+            portgroups:
+              - {{ IDH_PORTGROUPS.openssh }}

salt/firewall/containers.map.jinja

@@ -1,3 +1,31 @@
+{% from 'vars/globals.map.jinja' import GLOBALS %}
+
+{% if GLOBALS.role == 'so-eval' %}
+{% set NODE_CONTAINERS = [
+     'so-curator',
+     'so-dockerregistry',
+     'so-elasticsearch',
+     'so-elastic-fleet',
+     'so-elastic-fleet-package-registry',
+     'so-grafana',
+     'so-influxdb',
+     'so-kibana',
+     'so-kratos',
+     'so-mysql',
+     'so-nginx',
+     'so-redis',
+     'so-soc',
+     'so-soctopus',
+     'so-strelka-coordinator',
+     'so-strelka-gatekeeper',
+     'so-strelka-frontend',
+     'so-strelka-backend',
+     'so-strelka-manager',
+     'so-strelka-filestream'
+] %}
+{% endif %}
+
+{% if GLOBALS.role == 'so-manager' or GLOBALS.role == 'so-standalone' or GLOBALS.role == 'so-managersearch' %}
 {% set NODE_CONTAINERS = [
      'so-curator',
      'so-dockerregistry',
@@ -21,3 +49,59 @@
      'so-strelka-manager',
      'so-strelka-filestream'
 ] %}
+{% endif %}
+
+{% if GLOBALS.role == 'so-searchnode' %}
+{% set NODE_CONTAINERS = [
+     'so-elasticsearch',
+     'so-filebeat',
+     'so-logstash',
+     'so-nginx'
+] %}
+{% endif %}
+
+{% if GLOBALS.role == 'so-heavynode' %}
+{% set NODE_CONTAINERS = [
+     'so-curator',
+     'so-elasticsearch',
+     'so-filebeat',
+     'so-logstash',
+     'so-nginx',
+     'so-redis',
+     'so-strelka-coordinator',
+     'so-strelka-gatekeeper',
+     'so-strelka-frontend',
+     'so-strelka-backend',
+     'so-strelka-manager',
+     'so-strelka-filestream'
+] %}
+{% endif %}
+
+{% if GLOBALS.role == 'so-import' %}
+{% set NODE_CONTAINERS = [
+     'so-dockerregistry',
+     'so-elasticsearch',
+     'so-elastic-fleet',
+     'so-elastic-fleet-package-registry',
+     'so-filebeat',
+     'so-influxdb',
+     'so-kibana',
+     'so-kratos',
+     'so-nginx',
+     'so-soc'
+] %}
+{% endif %}
+
+{% if GLOBALS.role == 'so-receiver' %}
+{% set NODE_CONTAINERS = [
+     'so-filebeat',
+     'so-logstash',
+     'so-redis',
+] %}
+{% endif %}
+
+{% if GLOBALS.role == 'so-idh' %}
+{% set NODE_CONTAINERS = [
+     'so-idh',
+] %}
+{% endif %}

salt/firewall/map.jinja

@@ -1,3 +1,4 @@
+{% from 'vars/globals.map.jinja' import GLOBALS %}
 {% set role = grains.id.split('_') | last %}
 {% set translated_pillar_assigned_hostgroups = {} %}
 
@@ -9,9 +10,15 @@
 {% else %}
   {% set local_portgroups = {} %}
 {% endif %}
+
 {% set portgroups = salt['defaults.merge'](default_portgroups, local_portgroups, in_place=False) %}
 {% set defined_portgroups = portgroups %}
 
+{% if GLOBALS.role == 'so-idh' %}
+{% from 'idh/opencanary_config.map.jinja' import IDH_PORTGROUPS %}
+{% do salt['defaults.merge'](defined_portgroups, IDH_PORTGROUPS, in_place=True) %}
+{% endif %}
+
 {% set local_hostgroups = {'firewall': {'hostgroups': {}}} %}
 
 {% set hostgroup_list =  salt['cp.list_master'](prefix='firewall/hostgroups') %}