Merge pull request #16366 from Security-Onion-Solutions/3/dev

3.4.0

.github/DISCUSSION_TEMPLATE/3-0.yml

@@ -14,7 +14,6 @@ body:
         - 3.2.0
         - 3.3.0
         - 3.4.0
-        - 3.5.0
         - Other (please provide detail below)
     validations:
       required: true

VERSION

@@ -1 +1 @@
-3.5.0
+3.4.0

salt/elasticsearch/cluster.sls

@@ -107,12 +107,6 @@ so-elasticsearch-system-indices-patch:
       - file: so-elasticsearch-system-indices-patch-script
 {%  endif %}
 
-so-elasticsearch-ilm-policy-reload:
-  file.absent:
-    - name: /opt/so/state/esilm.txt
-    - onchanges:
-      - file: so-elasticsearch-ilm-policy-load-script
-
 # heavynodes will only load ILM policies for SO managed indices. (Indicies defined in elasticsearch/defaults.yaml)
 so-elasticsearch-ilm-policy-load:
   cmd.run:
@@ -121,9 +115,8 @@ so-elasticsearch-ilm-policy-load:
     - require:
       - docker_container: so-elasticsearch
       - file: so-elasticsearch-ilm-policy-load-script
-      - http: wait_for_so-elasticsearch
-      - file: so-elasticsearch-ilm-policy-reload
-    - unless: test -f /opt/so/state/esilm.txt
+    - onchanges:
+      - file: so-elasticsearch-ilm-policy-load-script
 
 so-elasticsearch-templates-reload:
   file.absent:

salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load

@@ -7,17 +7,11 @@
 . /usr/sbin/so-common
 
 MAX_JOBS=${MAX_ILM_JOBS:-10}
-ILM_STATEFILE=/opt/so/state/esilm.txt
-rm -f "$ILM_STATEFILE"
 
-check_elasticsearch_responsive
-
-ILM_TMP_DIR=$(mktemp -d)
-trap 'rm -rf "$ILM_TMP_DIR"' EXIT
 # Lock used to serialize block writes so concurrent jobs never interleave their output.
-ILM_OUTPUT_LOCK="$ILM_TMP_DIR/output.lock"
-ILM_FAIL_FILE="$ILM_TMP_DIR/failed"
-touch "$ILM_FAIL_FILE"
+ILM_OUTPUT_LOCK=$(mktemp)
+ILM_FAIL_FILE=$(mktemp)
+trap 'rm -f "$ILM_OUTPUT_LOCK" "$ILM_FAIL_FILE"' EXIT
 
 # Policies are loaded concurrently (up to MAX_JOBS at a time) for speed. Each policy's block is
 # printed the moment its curl returns, so output appears in COMPLETION ORDER, not the order
@@ -26,30 +20,13 @@ echo "Loading ILM policies concurrently; output below appears in completion orde
 echo
 
 put_policy() {
-  local desc="$1" policyname="$2" data="$3" rc=1 attempt out http_code body result reason tmpdata
-  tmpdata=$(mktemp "$ILM_TMP_DIR/${policyname}.XXXXXX.json")
-  printf '%s' "$data" >"$tmpdata"
-
-  for attempt in 1 2 3; do
-    out=$(so-elasticsearch-query "_ilm/policy/${policyname}" -d@"${tmpdata}" -XPUT -w '\n%{http_code}' 2>/dev/null)
-    http_code=${out##*$'\n'} body=${out%$'\n'*}
-
-    if [[ "$http_code" == 200 ]] && jq -e '.acknowledged == true' <<<"$body" >/dev/null 2>&1; then
-      rc=0
-      break
-    fi
-    # 429 = ES rejected/throttled (may succeed later); other 4xx will not
-    [[ "$http_code" == 4?? && "$http_code" != 429 ]] && break
-    (( attempt < 3 )) && sleep 3
-  done
-
-  if (( rc == 0 )); then
-    result='{"acknowledged":true}'
-  else
-    result=${body:-"HTTP ${http_code:-000}"}
-    # flatten tabs/newlines so the TAB fail-file stays one record
-    reason=$(jq -r '(if (.error|type) == "object" then (.error.reason // .error.type) elif (.error|type) == "string" then .error else empty end) // empty | tostring | gsub("[\t\r\n]+"; " ")' <<<"$body" 2>/dev/null)
-    reason="HTTP ${http_code:-000}${reason:+: ${reason}}"
+  local desc="$1" policyname="$2" data="$3" result rc=0
+  if ! result=$(curl -K /opt/so/conf/elasticsearch/curl.config -s -k -L --fail \
+    -X PUT "https://localhost:9200/_ilm/policy/${policyname}" \
+    -H 'Content-Type: application/json' -d"${data}" 2>&1); then
+    rc=1
+  elif ! jq -e '.acknowledged == true' <<<"$result" >/dev/null 2>&1; then
+    rc=1
   fi
 
   # curl above ran in parallel; serialize just this block write so concurrent jobs never interleave.
@@ -57,7 +34,7 @@ put_policy() {
     flock 200
     printf 'Setting up %s policy...\n%s\n\n' "${desc}" "${result}"
     if (( rc != 0 )); then
-      printf '%s\t%s\n' "${policyname}" "${reason}" >>"$ILM_FAIL_FILE"
+      printf '%s\n' "${policyname}" >>"$ILM_FAIL_FILE"
     fi
   } 200>>"${ILM_OUTPUT_LOCK}"
 
@@ -105,15 +82,10 @@ wait || true
 
 if [[ -s "$ILM_FAIL_FILE" ]]; then
   echo "ERROR: Failed to load ILM policy(s):"
-  while IFS=$'\t' read -r POLICY REASON; do
-    if [[ -n "$REASON" ]]; then
-      echo " - ${POLICY}: ${REASON}"
-    else
-      echo " - ${POLICY}"
-    fi
+  while read -r POLICY; do
+    echo " - $POLICY"
   done < "$ILM_FAIL_FILE"
   exit 1
 else
   echo "Successfully loaded all ILM policies."
-  touch "$ILM_STATEFILE"
 fi