Merge pull request #16170 from Security-Onion-Solutions/fix/boot-highstate-marker

FIX: enable so-boot-highstate.service on non-manager nodes

salt/salt/minion/boot_highstate.sls

@@ -3,6 +3,8 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
+{% from 'vars/globals.map.jinja' import GLOBALS %}
+
 # Manages /etc/systemd/system/so-boot-highstate.service, a Type=oneshot
 # RemainAfterExit=yes unit that runs `salt-call state.highstate` exactly once
 # per system boot. Replaces the legacy `startup_states: highstate` minion
@@ -19,9 +21,25 @@ so_boot_highstate_unit_file:
     - onchanges_in:
       - module: systemd_reload
 
+# Non-managers never apply salt.minion during setup, so reaching this state means
+# setup is finished and the marker is safe to write unconditionally. This also
+# heals nodes installed before this fix, which have no marker and no legacy
+# startup_states line to grep for. Managers do highstate mid-setup, so they only
+# get the marker from the legacy upgrade signal; fresh installs get it from
+# mark_setup_complete in setup/so-functions.
+mark_setup_complete:
+  file.managed:
+    - name: /opt/so/state/setup-complete
+    - replace: false
+    - makedirs: True
+{% if GLOBALS.is_manager %}
+    - onlyif: "grep -qx 'startup_states: highstate' /etc/salt/minion"
+{% endif %}
+    - require_in:
+      - service: so_boot_highstate_service
+
 # Only enable once setup is complete. Until then the gate file is missing and
-# the unit's own ConditionPathExists would no-op it anyway -- this just keeps
+# the unit's own ConditionPathExists would no-op it anyway.
-# `systemctl is-enabled` honest for the sync_es_users gate.
 so_boot_highstate_service:
   service.enabled:
     - name: so-boot-highstate.service

salt/salt/minion/init.sls

@@ -87,27 +87,15 @@ set_log_levels:
 # so-boot-highstate.service (managed in salt.minion.boot_highstate), which
 # runs once per system boot only. Strip the line from /etc/salt/minion on
 # upgrade; both the commented and uncommented forms historically existed.
+# Ordered after mark_setup_complete (salt.minion.boot_highstate); the manager
+# gate there greps for this line, so it must run before we delete it.
 remove_startup_states:
   file.line:
     - name: /etc/salt/minion
     - match: 'startup_states: highstate'
     - mode: delete
-
+    - require:
-# Upgrade-path bridge: systems that already passed setup under the old gate
+      - file: mark_setup_complete
-# (`grep -x 'startup_states: highstate' /etc/salt/minion`) get a /opt/so/state/setup-complete
-# marker so so-boot-highstate.service can be enabled and the so-user_sync cron
-# in sync_es_users.sls keeps installing. Setup-in-progress systems instead get
-# the marker from `mark_setup_complete` in setup/so-functions at the right
-# moment. `replace: false` means we never overwrite a marker once written.
-mark_setup_complete_for_upgrades:
-  file.managed:
-    - name: /opt/so/state/setup-complete
-    - replace: false
-    - makedirs: True
-    - onlyif: "grep -qx 'startup_states: highstate' /etc/salt/minion"
-    - require_in:
-      - file: remove_startup_states
-      - service: so_boot_highstate_service
 
 {% endif %}
 

salt/setup/virt/setSalt.sls

@@ -8,6 +8,15 @@ set_role_grain:
     - name: role
     - value: so-{{ grains.id.split("_") | last }}
 
+# salt-cloud guests never run so-setup, so nothing else marks them setup-complete.
+# Replaces the 'startup_states: highstate' line this state used to append. No
+# GLOBALS import -- this runs before the guest's pillars exist.
+mark_setup_complete_vm_guest:
+  file.managed:
+    - name: /opt/so/state/setup-complete
+    - replace: false
+    - makedirs: True
+
 enable_salt_minion:
   service.enabled:
     - name: salt-minion

salt/soc/defaults.yaml

@@ -1537,18 +1537,6 @@ soc:
             Orchestrator: sonnet@SOAI
             Investigator: gemma@SOAI
             DetectionEngineer: gemma@SOAI
-          useMemory: true
-          useMemoryScanner: false
-          memoryScanIntervalSeconds: 300
-          memoryProximityThreshold: 0.8
-          messageProximityThreshold: 0.5
-          maxUserMemoriesToInclude: 5
-          maxGlobalMemoriesToInclude: 5
-          maxUserMemoriesToReconcile: 20
-          maxGlobalMemoriesToReconcile: 20
-          memoryModel: gemma@SOAI
-          embedModel: amazon.titan-embed-text-v2@SOAI
-          reconcileModel: gemma@SOAI
         onionconfig:
           saltstackDir: /opt/so/saltstack
           bypassEnabled: false
@@ -2739,14 +2727,5 @@ soc:
               enabled: true
               adapter: SOAI
               charsPerTokenEstimate: 4
-            - id: amazon.titan-embed-text-v2
-              displayName: amazon.titan-embed-text-v2
-              origin: USA
-              contextLimitSmall: 8192
-              contextLimitLarge: 8192
-              lowBalanceColorAlert: 500000
-              enabled: true
-              adapter: SOAI
-              charsPerTokenEstimate: 4
               
             

salt/soc/soc_soc.yaml

@@ -845,42 +845,6 @@ soc:
             DetectionEngineer:
               description: This agent manages detections and their overrides, including tuning noisy rules and authoring rule content.
               global: True
-          useMemory:
-            description: Enables the Memory system for OnionAI
-            global: True
-          useMemoryScanner:
-            description: Enables the memory scanner for automatic memory extraction from historical sessions.
-            global: True
-          memoryScanIntervalSeconds:
-            description: How long to wait in seconds between attempts to scan sessions for new memories.
-            global: True
-          memoryProximityThreshold:
-            description: Describes how close memories need to be on a floating point scale from 0.0 to 1.0 to be considered when reconciling new memories with old ones. This value is usually higher than messageProximityThreshold.
-            global: True
-          messageProximityThreshold:
-            description: Describes how close a memory needs to be to a user's message on a floating point scale from 0.0 to 1.0 to be included in the context. This value is usually lower than memoryProximityThreshold.
-            global: True
-          maxUserMemoriesToInclude:
-            description: Specify the max number of user-specific memories to include in the prompt when a user sends a message.
-            global: True
-          maxGlobalMemoriesToInclude:
-            description: Specify the max number of global memories to include in the prompt when a user sends a message.
-            global: True
-          maxUserMemoriesToReconcile:
-            description: When reconciling new user-specific memories with existing user-specific memories, this determines how many old memories may be considered.
-            global: True
-          maxGlobalMemoriesToReconcile:
-            description: When reconciling new global memories with existing global memories, this determines how many old memories may be considered.
-            global: True
-          memoryModel:
-            description: The model to use when extracting memories from sessions.
-            global: True
-          embedModel: 
-            description: The model to use when embedding a memory as a vector. Note that only memories embedded using the same model may be compared and only memories created with the model specified here will be considered when informing an agent of existing memories.
-            global: True
-          reconcileModel:
-            description: The model to use when reconciling memories that contain nearly the same content.
-            global: True
       client:
         assistant:
           enabled:

setup/so-setup

@@ -833,6 +833,7 @@ if ! [[ -f $install_opt_file ]]; then
 		check_sos_appliance
 		drop_install_options
 		hypervisor_local_states
+		mark_setup_complete
 		verify_setup
 	fi