include so-yaml.py in get_soup_script_hashes() so we ensure its at latest version before using it later on in soup

files/salt/master/master

@@ -64,6 +64,5 @@ pillar_roots:
 peer:
   .*:
     - x509.sign_remote_certificate
-    - test.ping
 
 

salt/ca/map.jinja

@@ -1,7 +1,3 @@
 {% set CA = {
     'server': pillar.ca.server
 }%}
-{# reachable_cmd: shell test used by the *.ssl cert states' onlyif to skip cert
-   management gracefully when the CA minion is unreachable. Returns exit 0 when
-   the CA answers a peer test.ping within 3s, non-zero otherwise. #}
-{% do CA.update({'reachable_cmd': "salt-call --out=json publish.publish '" ~ CA.server ~ "' test.ping timeout=3 2>/dev/null | grep -q true"}) %}

salt/elasticfleet/ssl.sls

@@ -38,8 +38,7 @@ etc_elasticfleet_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/elasticfleet-server.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30
@@ -95,8 +94,7 @@ etc_elasticfleet_agent_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/elasticfleet-agent.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30
@@ -157,8 +155,7 @@ elasticfleet_kafka_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/elasticfleet-kafka.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/elasticsearch/ssl.sls

@@ -34,8 +34,7 @@ elasticsearch_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/elasticsearch.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/influxdb/ssl.sls

@@ -34,8 +34,7 @@ influxdb_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/influxdb.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/kafka/ssl.sls

@@ -38,8 +38,7 @@ kafka_client_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/kafka-client.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30
@@ -87,8 +86,7 @@ kafka_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/kafka.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30
@@ -150,8 +148,7 @@ kafka_logstash_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/kafka-logstash.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/logstash/ssl.sls

@@ -38,8 +38,7 @@ etc_elasticfleet_logstash_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/elasticfleet-logstash.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30
@@ -100,8 +99,7 @@ etc_elasticfleetlumberjack_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/elasticfleet-lumberjack.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30
@@ -170,8 +168,7 @@ etc_filebeat_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/filebeat.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30
@@ -252,8 +249,7 @@ conf_filebeat_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /opt/so/conf/filebeat/etc/pki/filebeat.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/manager/tools/sbin/soup

@@ -437,6 +437,8 @@ get_soup_script_hashes() {
   GITIMGCMN=$(md5sum $UPDATE_DIR/salt/common/tools/sbin/so-image-common | awk '{print $1}')
   CURRENTSOFIREWALL=$(md5sum /usr/sbin/so-firewall | awk '{print $1}')
   GITSOFIREWALL=$(md5sum $UPDATE_DIR/salt/manager/tools/sbin/so-firewall | awk '{print $1}')
+  CURRENTSOYAML=$(md5sum /usr/sbin/so-yaml.py | awk '{print $1}')
+  GITSOYAML=$(md5sum $UPDATE_DIR/salt/manager/tools/sbin/so-yaml.py | awk '{print $1}')
 }
 
 highstate() {
@@ -1224,7 +1226,7 @@ upgrade_salt() {
 
 verify_latest_update_script() {
   get_soup_script_hashes
-  if [[ "$CURRENTSOUP" == "$GITSOUP" && "$CURRENTCMN" == "$GITCMN" && "$CURRENTIMGCMN" == "$GITIMGCMN" && "$CURRENTSOFIREWALL" == "$GITSOFIREWALL" ]]; then
+  if [[ "$CURRENTSOUP" == "$GITSOUP" && "$CURRENTCMN" == "$GITCMN" && "$CURRENTIMGCMN" == "$GITIMGCMN" && "$CURRENTSOFIREWALL" == "$GITSOFIREWALL" && "$CURRENTSOYAML" == "$GITSOYAML" ]]; then
     echo "This version of the soup script is up to date. Proceeding."
   else
     echo "You are not running the latest soup version. Updating soup and its components. This might take multiple runs to complete."
@@ -1233,7 +1235,7 @@ verify_latest_update_script() {
 
     # Verify that soup scripts updated as expected
     get_soup_script_hashes
-    if [[ "$CURRENTSOUP" == "$GITSOUP" && "$CURRENTCMN" == "$GITCMN" && "$CURRENTIMGCMN" == "$GITIMGCMN" && "$CURRENTSOFIREWALL" == "$GITSOFIREWALL" ]]; then
+    if [[ "$CURRENTSOUP" == "$GITSOUP" && "$CURRENTCMN" == "$GITCMN" && "$CURRENTIMGCMN" == "$GITIMGCMN" && "$CURRENTSOFIREWALL" == "$GITSOFIREWALL" && "$CURRENTSOYAML" == "$GITSOYAML" ]]; then
       echo "Succesfully updated soup scripts."
     else
       echo "There was a problem updating soup scripts. Trying to rerun script update."

salt/nginx/ssl.sls

@@ -71,8 +71,7 @@ managerssl_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/managerssl.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/postgres/ssl.sls

@@ -33,8 +33,7 @@ postgres_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/postgres.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/redis/ssl.sls

@@ -33,8 +33,7 @@ redis_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/redis.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30

salt/registry/ssl.sls

@@ -55,8 +55,7 @@ registry_crt:
     - backup: True
     - require:
       - file: registry_crt_cleanup
-    - onlyif:
-      - test ! -f /etc/pki/registry.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 15
         interval: 10

salt/telegraf/ssl.sls

@@ -34,8 +34,7 @@ telegraf_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - onlyif:
-      - test ! -f /etc/pki/telegraf.crt || {{ CA.reachable_cmd }}
+    - timeout: 30
     - retry:
         attempts: 5
         interval: 30