From ee70d94e1537be0eb5e8dad06ef3143a97d91662 Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Thu, 8 Jan 2026 17:15:35 -0500
Subject: [PATCH] remove old key/crt used for telegraf on non managers

---
 salt/telegraf/ssl.sls | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/salt/telegraf/ssl.sls b/salt/telegraf/ssl.sls
index 9fab48958..fc9c00927 100644
--- a/salt/telegraf/ssl.sls
+++ b/salt/telegraf/ssl.sls
@@ -46,6 +46,17 @@ telegraf_key_perms:
     - mode: 640
     - group: 939
 
+{%   if not GLOBALS.is_manager %}
+{# Prior to 2.4.220, minions used influxdb.crt and key for telegraf #}
+remove_influxdb.crt:
+  file.absent:
+    - name: /etc/pki/influxdb.crt
+
+remove_influxdb.key:
+  file.absent:
+    - name: /etc/pki/influxdb.key
+{%   endif %}
+
 {% else %}
 
 {{sls}}_state_not_allowed: