Fail 4xx ILM PUTs immediately (retry 429/5xx/connect), print the
Elasticsearch reason in the salt summary, and retry the load on the
next highstate via /opt/so/state/esilm.txt when the last run failed.
Fixes https://github.com/Security-Onion-Solutions/sos/issues/277
Mount the host trust store into zeek, suricata, tcpreplay, the strelka
containers and idh, and restart them when it changes. Point the Python
requests clients in strelka-backend and idh at it instead of certifi.
Remove the frozen /opt/so/conf/ca bundles from every node in ca.trust
rather than only on the manager in soup.
Anchor the grid CA and blocklist the eMudhra roots in the host trust
store (new ca.trust state, also used by the desktop role), then mount the
extracted store into each container instead of the frozen copies made by
so-catrust. Containers restart when the host trust changes.
Every container in docker/defaults.yaml exposes custom_bind_mounts via
soc_docker.yaml, but kafka and soc enabled.sls never appended them to
binds, so the setting was silently ignored for those two containers.
Jason Ertel
reyesj2
Doug Burks
Mike Reeves
Mike Reeves
Corey Ogburn
Josh Patterson