unlock/lock salt-cloud if installed

salt/elasticfleet/enabled.sls

@@ -32,16 +32,6 @@ so-elastic-fleet-auto-configure-logstash-outputs:
     - retry:
         attempts: 4
         interval: 30
-
-{# Separate from above in order to catch elasticfleet-logstash.crt changes and force update to fleet output policy #}
-so-elastic-fleet-auto-configure-logstash-outputs-force:
-  cmd.run:
-    - name: /usr/sbin/so-elastic-fleet-outputs-update --force --certs
-    - retry:
-        attempts: 4
-        interval: 30
-    - onchanges:
-        - x509: etc_elasticfleet_logstash_crt
 {% endif %}
 
 # If enabled, automatically update Fleet Server URLs & ES Connection

salt/elasticfleet/install_agent_grid.sls

@@ -8,28 +8,20 @@
 {% set AGENT_STATUS = salt['service.available']('elastic-agent') %}
 {% if not AGENT_STATUS  %}
 
-pull_agent_installer:
-  file.managed:
-    - name: /opt/so/so-elastic-agent_linux_amd64
-    - source: salt://elasticfleet/files/so_agent-installers/so-elastic-agent_linux_amd64
-    - mode: 755
-    - makedirs: True
-
 {% if grains.role not in ['so-heavynode'] %}
 run_installer:
-  cmd.run:
-    - name: ./so-elastic-agent_linux_amd64 -token={{ GRIDNODETOKENGENERAL }}
+  cmd.script:
+    - name: salt://elasticfleet/files/so_agent-installers/so-elastic-agent_linux_amd64
     - cwd: /opt/so
+    - args: -token={{ GRIDNODETOKENGENERAL }}
     - retry: True
 {% else %} 
 run_installer:
-  cmd.run:
-    - name: ./so-elastic-agent_linux_amd64 -token={{ GRIDNODETOKENHEAVY }}
+  cmd.script:
+    - name: salt://elasticfleet/files/so_agent-installers/so-elastic-agent_linux_amd64
     - cwd: /opt/so
+    - args: -token={{ GRIDNODETOKENHEAVY }}
     - retry: True
 {% endif %}  
 
-cleanup_agent_installer:
-  file.absent:
-    - name: /opt/so/so-elastic-agent_linux_amd64
 {% endif %}

salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-outputs-update

@@ -8,27 +8,6 @@
 
 . /usr/sbin/so-common
 
-FORCE_UPDATE=false
-UPDATE_CERTS=false
-
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    -f|--force)
-      FORCE_UPDATE=true
-      shift
-      ;;
-    -c| --certs)
-      UPDATE_CERTS=true
-      shift
-      ;;
-    *)
-      echo "Unknown option $1"
-      echo "Usage: $0 [-f|--force] [-c|--certs]"
-      exit 1
-      ;;
-  esac
-done
-
 # Only run on Managers
 if ! is_manager_node; then
     printf "Not a Manager Node... Exiting"
@@ -38,42 +17,17 @@ fi
 function update_logstash_outputs() {
     if logstash_policy=$(curl -K /opt/so/conf/elasticsearch/curl.config -L "http://localhost:5601/api/fleet/outputs/so-manager_logstash" --retry 3 --retry-delay 10 --fail 2>/dev/null); then
         SSL_CONFIG=$(echo "$logstash_policy" | jq -r '.item.ssl')
-        LOGSTASHKEY=$(openssl rsa -in  /etc/pki/elasticfleet-logstash.key)
-        LOGSTASHCRT=$(openssl x509 -in /etc/pki/elasticfleet-logstash.crt)
-        LOGSTASHCA=$(openssl x509 -in  /etc/pki/tls/certs/intca.crt)
         if SECRETS=$(echo "$logstash_policy" | jq -er '.item.secrets' 2>/dev/null); then
-            if [[ "$UPDATE_CERTS" != "true"  ]]; then
-                # Reuse existing secret
-                JSON_STRING=$(jq -n \
-                    --arg UPDATEDLIST "$NEW_LIST_JSON" \
-                    --argjson SECRETS "$SECRETS" \
-                    --argjson SSL_CONFIG "$SSL_CONFIG" \
-                    '{"name":"grid-logstash","type":"logstash","hosts": $UPDATEDLIST,"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl": $SSL_CONFIG,"secrets": $SECRETS}')
-            else
-                # Update certs, creating new secret
-                JSON_STRING=$(jq -n \
-                    --arg UPDATEDLIST "$NEW_LIST_JSON" \
-                    --arg LOGSTASHKEY "$LOGSTASHKEY" \
-                    --arg LOGSTASHCRT "$LOGSTASHCRT" \
-                    --arg LOGSTASHCA "$LOGSTASHCA" \
-                    '{"name":"grid-logstash","type":"logstash","hosts": $UPDATEDLIST,"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl": {"certificate": $LOGSTASHCRT,"certificate_authorities":[ $LOGSTASHCA ]},"secrets": {"ssl":{"key": $LOGSTASHKEY }}}')
-            fi
+            JSON_STRING=$(jq -n \
+                --arg UPDATEDLIST "$NEW_LIST_JSON" \
+                --argjson SECRETS "$SECRETS" \
+                --argjson SSL_CONFIG "$SSL_CONFIG" \
+                '{"name":"grid-logstash","type":"logstash","hosts": $UPDATEDLIST,"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl": $SSL_CONFIG,"secrets": $SECRETS}')
         else
-            if [[ "$UPDATE_CERTS" != "true" ]]; then
-                # Reuse existing ssl config
-                JSON_STRING=$(jq -n \
-                    --arg UPDATEDLIST "$NEW_LIST_JSON" \
-                    --argjson SSL_CONFIG "$SSL_CONFIG" \
-                    '{"name":"grid-logstash","type":"logstash","hosts": $UPDATEDLIST,"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl": $SSL_CONFIG}')
-            else
-                # Update ssl config
-                JSON_STRING=$(jq -n \
-                    --arg UPDATEDLIST "$NEW_LIST_JSON" \
-                    --arg LOGSTASHKEY "$LOGSTASHKEY" \
-                    --arg LOGSTASHCRT "$LOGSTASHCRT" \
-                    --arg LOGSTASHCA "$LOGSTASHCA" \
-                    '{"name":"grid-logstash","type":"logstash","hosts": $UPDATEDLIST,"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl": {"certificate": $LOGSTASHCRT,"key": $LOGSTASHKEY,"certificate_authorities":[ $LOGSTASHCA ]}}')
-            fi
+            JSON_STRING=$(jq -n \
+                --arg UPDATEDLIST "$NEW_LIST_JSON" \
+                --argjson SSL_CONFIG "$SSL_CONFIG" \
+                '{"name":"grid-logstash","type":"logstash","hosts": $UPDATEDLIST,"is_default":true,"is_default_monitoring":true,"config_yaml":"","ssl": $SSL_CONFIG}')
         fi
     fi
 
@@ -197,7 +151,7 @@ NEW_LIST_JSON=$(jq --compact-output --null-input '$ARGS.positional' --args -- "$
 NEW_HASH=$(sha1sum <<< "$NEW_LIST_JSON" | awk '{print $1}')
 
 # Compare the current & new list of outputs - if different, update the Logstash outputs
-if [[ "$NEW_HASH" = "$CURRENT_HASH" ]] && [[ "$FORCE_UPDATE" != "true" ]]; then
+if [ "$NEW_HASH" = "$CURRENT_HASH" ]; then
     printf "\nHashes match - no update needed.\n"
     printf "Current List: $CURRENT_LIST\nNew List: $NEW_LIST_JSON\n"
 

salt/manager/tools/sbin/soup

@@ -23,6 +23,7 @@ TOPFILE=/opt/so/saltstack/default/salt/top.sls
 BACKUPTOPFILE=/opt/so/saltstack/default/salt/top.sls.backup
 SALTUPGRADED=false
 SALT_CLOUD_INSTALLED=false
+SALT_CLOUD_CONFIGURED=false
 # used to display messages to the user at the end of soup
 declare -a FINAL_MESSAGE_QUEUE=()
 
@@ -1270,6 +1271,10 @@ upgrade_salt() {
     if rpm -q salt-cloud &>/dev/null; then
       SALT_CLOUD_INSTALLED=true
     fi
+    # Check if salt-cloud is configured
+    if [[ -f /etc/salt/cloud.profiles.d/socloud.conf ]]; then
+      SALT_CLOUD_CONFIGURED=true
+    fi
     
     echo "Removing yum versionlock for Salt."
     echo ""
@@ -1587,7 +1592,7 @@ main() {
     # ensure the mine is updated and populated before highstates run, following the salt-master restart
     update_salt_mine
 
-    if [[ $SALT_CLOUD_INSTALLED == true && $SALTUPGRADED == true ]]; then
+    if [[ $SALT_CLOUD_CONFIGURED == true && $SALTUPGRADED == true ]]; then
       echo "Updating salt-cloud config to use the new Salt version"
       salt-call state.apply salt.cloud.config concurrent=True
     fi

salt/salt/cloud/config.sls

@@ -36,6 +36,11 @@ cloud_profiles:
         SALTVERSION: {{ SALTVERSION }}
     - template: jinja
     - makedirs: True
+{%     else %}
+no_hypervisors_configured:
+  test.succeed_without_changes:
+    - name: no_hypervisors_configured
+    - comment: No hypervisors are configured
 {%     endif %}
 
 {%   else %}