Fail 4xx ILM PUTs immediately (retry 429/5xx/connect), print the
Elasticsearch reason in the salt summary, and retry the load on the
next highstate via /opt/so/state/esilm.txt when the last run failed.
Fixes https://github.com/Security-Onion-Solutions/sos/issues/277
Mount the host trust store into zeek, suricata, tcpreplay, the strelka
containers and idh, and restart them when it changes. Point the Python
requests clients in strelka-backend and idh at it instead of certifi.
Remove the frozen /opt/so/conf/ca bundles from every node in ca.trust
rather than only on the manager in soup.
Anchor the grid CA and blocklist the eMudhra roots in the host trust
store (new ca.trust state, also used by the desktop role), then mount the
extracted store into each container instead of the frozen copies made by
so-catrust. Containers restart when the host trust changes.
Every container in docker/defaults.yaml exposes custom_bind_mounts via
soc_docker.yaml, but kafka and soc enabled.sls never appended them to
binds, so the setting was silently ignored for those two containers.
Fail 4xx ILM PUTs immediately (retry 429/5xx/connect), print the
Elasticsearch reason in the salt summary, and retry the load on the
next highstate via /opt/so/state/esilm.txt when the last run failed.
Fixes https://github.com/Security-Onion-Solutions/sos/issues/277
Mount the host trust store into zeek, suricata, tcpreplay, the strelka
containers and idh, and restart them when it changes. Point the Python
requests clients in strelka-backend and idh at it instead of certifi.
Remove the frozen /opt/so/conf/ca bundles from every node in ca.trust
rather than only on the manager in soup.
Anchor the grid CA and blocklist the eMudhra roots in the host trust
store (new ca.trust state, also used by the desktop role), then mount the
extracted store into each container instead of the frozen copies made by
so-catrust. Containers restart when the host trust changes.
Every container in docker/defaults.yaml exposes custom_bind_mounts via
soc_docker.yaml, but kafka and soc enabled.sls never appended them to
binds, so the setting was silently ignored for those two containers.
Salt 3006.29 (saltstack/salt#70466) answered the eMudhra/emSign incident by
bumping certifi to 2026.10.19, which drops the "emSign ECC Root CA - G3" root
whose intermediates had recoverable private keys, and by shipping pip 26.2.2,
whose vendored certifi gets the same fix. We stay on 3006.19, so apply the
same two upgrades inside /opt/saltstack/salt from vendored wheels.
relenv is upgraded to 0.22.27 in the same pip invocation. relenv 0.22.2's
runtime wrapper hardcodes pre-26.2 pip install() signatures, so a lone pip
26.2.2 upgrade breaks every later pip run with an unexpected
'script_executable' argument. 0.22.27 is what 3006.29 builds against and its
runtime diff is otherwise cosmetic. Installing all three at once under the
stock pip means no host ever sits in the broken intermediate state.
The state lives in salt.python_modules so new installs get it from
salt_install_module_deps before salt-master starts, and existing grids get it
from the soup highstate plus grid push. It is gated on saltversion 3006.19 so
a future Salt bump disables it, and ordered before the docker module install
so docker is always installed with the fixed pip. The docker wheel set now
carries certifi 2026.10.19 instead of 2024.7.4.
Verified on a fresh 3.4.0 manager + sensor grid: state applies on both,
reruns are no-ops, full highstate passes on both nodes.
Jason Ertel
reyesj2
Doug Burks
Mike Reeves
Mike Reeves
Corey Ogburn
Josh Patterson
Jason Ertel
coreyogburn