Ded Fleet Node - checkpoint

salt/common/tools/sbin/so-firewall

@@ -43,7 +43,7 @@ APPLY=${APPLY,,}
 
 function rolecall() {
 	THEROLE=$1
-	THEROLES="analyst analyst_workstations beats_endpoint beats_endpoint_ssl elastic_agent_endpoint elasticsearch_rest endgame eval heavynodes idh manager managersearch receivers searchnodes sensors standalone strelka_frontend syslog"
+	THEROLES="analyst analyst_workstations beats_endpoint beats_endpoint_ssl elastic_agent_endpoint elasticsearch_rest endgame eval fleet heavynodes idh manager managersearch receivers searchnodes sensors standalone strelka_frontend syslog"
 
 	for AROLE in $THEROLES; do
 		if [ "$AROLE" = "$THEROLE" ]; then

salt/common/tools/sbin/so-firewall-minion

@@ -56,8 +56,11 @@ fi
 			so-firewall --role=sensors --ip="$IP"
 			so-firewall --apply=true --role=searchnodes --ip="$IP"
 			;;
-		'SENSOR' | 'SEARCHNODE' | 'HEAVYNODE' | 'IDH' | 'RECEIVER')
+		'FLEET' | 'SENSOR' | 'SEARCHNODE' | 'HEAVYNODE' | 'IDH' | 'RECEIVER')
 			case "$ROLE" in
+				'FLEET')
+					so-firewall --apply=true --role=fleet --ip="$IP"
+					;;
 				'SENSOR')
 					so-firewall --apply=true --role=sensors --ip="$IP"
 					;;

salt/elasticfleet/init.sls

@@ -9,7 +9,7 @@
 # These values are generated during node install and stored in minion pillar
 {% set SERVICETOKEN = salt['pillar.get']('elasticfleet:server:es_token','') %}
 {% set FLEETSERVERPOLICY = salt['pillar.get']('elasticfleet:server:server_policy','so-manager') %}
-{% set FLEETURL = salt['pillar.get']('elasticfleet:server:url') %}
+#{% set FLEETURL = salt['pillar.get']('elasticfleet:server:url') %}
 
 # Add EA Group
 elasticsagentgroup:
@@ -39,13 +39,29 @@ eastatedir:
     - group: 939
     - makedirs: True
 
+# Pull down the Logstash Cert from the Manager
+/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:
+  file.managed:
+    - replace: True
+    - source: salt://elasticfleet/files/certs/elasticfleet.p8
+    - mode: 640
+    - user: 931
+    - group: 939
+
+/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:
+  file.managed:
+    - replace: True
+    - source: salt://elasticfleet/files/certs/elasticfleet.crt
+    - mode: 640
+    - group: 939
+
 
   {% if SERVICETOKEN != '' %}
 so-elastic-fleet:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent:{{ GLOBALS.so_version }}
     - name: so-elastic-fleet
-    - hostname: Fleet-{{ GLOBALS.hostname }}
+    - hostname: FleetServer-{{ GLOBALS.hostname }}
     - detach: True
     - user: 947
     - networks:
@@ -63,7 +79,7 @@ so-elastic-fleet:
       - /opt/so/conf/elastic-fleet/state:/usr/share/elastic-agent/state:rw
     - environment:
       - FLEET_SERVER_ENABLE=true
-      - FLEET_URL=https://{{ FLEETURL }}:8220
+      - FLEET_URL=https://{{ GLOBALS.node_ip }}:8220
       - FLEET_SERVER_ELASTICSEARCH_HOST=https://{{ GLOBALS.manager }}:9200
       - FLEET_SERVER_SERVICE_TOKEN={{ SERVICETOKEN }}
       - FLEET_SERVER_POLICY_ID={{ FLEETSERVERPOLICY }}

salt/firewall/assigned_hostgroups.map.yaml

@@ -317,7 +317,15 @@ role:
           fleet:
             portgroups:
               - {{ portgroups.elasticsearch_rest }}
+              - {{ portgroups.docker_registry }}
+              - {{ portgroups.influxdb }}
+              - {{ portgroups.sensoroni }}
+              - {{ portgroups.yum }}
+              - {{ portgroups.beats_5044 }}
+              - {{ portgroups.beats_5644 }}
               - {{ portgroups.beats_5056 }}
+              - {{ portgroups.elastic_agent_control }}
+              - {{ portgroups.elastic_agent_data }}
           sensors:
             portgroups:
               - {{ portgroups.docker_registry }}

salt/firewall/containers.map.jinja

@@ -93,6 +93,12 @@
      'so-idh',
 ] %}
 
+{% elif GLOBALS.role == 'so-fleet' %}
+{% set NODE_CONTAINERS = [
+     'so-elastic-fleet',
+     'so-logstash',
+] %}
+
 {% elif GLOBALS.role == 'so-sensor' %}
 {% set NODE_CONTAINERS = [] %}
 

salt/firewall/ports/ports.yaml

@@ -35,7 +35,6 @@ firewall:
     elastic_agent_data:
       tcp:
         - 5055
-        - 9200
     endgame:
       tcp:
         - 3765

salt/logstash/init.sls

@@ -165,8 +165,8 @@ so-logstash:
       - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro
   {% endif %}
   {% if GLOBALS.role in ['so-fleet'] %}
-      - /etc/pki/elasticfleet.crt:/usr/share/logstash/filebeat.crt:ro
-      - /etc/pki/elasticfleet02.p8:/usr/share/logstash/filebeat.key:ro
+      - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:/usr/share/logstash/filebeat.crt:ro
+      - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:/usr/share/logstash/filebeat.key:ro
   {% endif %}
   {% if GLOBALS.role in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %}
       - /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro