mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-10-06 14:34:46 +02:00
Josh Patterson
4ce7a06abe
Latest upstream stable for el9. All four NVRs are already carried by the SO prod repo, so no repo change is needed -- a so-repo-sync refresh is enough. Tested on a managersearch and a heavynode (OL 9.8, 3.4.0), upgrading from 29.2.1/2.2.1 both by hand and through the state itself: - The 29.8.1 RPM ships a byte-identical docker.service, so the full ExecStart override in files/iptables-disabled.conf still resolves correctly and the hand-written DOCKER/DOCKER-ISOLATION/DOCKER-USER chains came back byte-identical on both nodes across upgrade, restart and reboot. - update_holds re-pinned the versionlock from the old NVRs to the new ones without intervention, so soup's path needs no change. - docker-py 7.1.0 still creates sobridge and soauth (forced by removing both); bridges keep their configured kernel names rather than br-<hash>. - 29.6 changed how dynamic port allocation treats net.ipv4.ip_local_reserved_ports; Strelka's 57314 is both published and reserved, and docker-proxy still owns it with no bind errors. - docker ps --format json gained a HealthStatus key. Additive, so so-status, so-log-check and so-docker-prune all still parse it. - containerd 2.3.6 ships the same config.toml, and it is %config(noreplace) and unmodified on disk, so no .rpmnew and disabled_plugins=["cri"] survives. - Zeek/Suricata/Strelka pipeline verified end-to-end with so-test: 111k packets replayed, 0 capture loss, file extraction and ES ingest all landed. The manifest unknown exclusion in so-log-check still fires on 29.8.1 -- it comes from a tag lookup during the registry-to-registry image copy, not from the 29.2.1 upgrade the old comment blamed -- so only the comment changes.
90 lines
2.6 KiB
YAML+Jinja
90 lines
2.6 KiB
YAML+Jinja
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
{% from 'docker/docker.map.jinja' import DOCKERMERGED %}
|
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
|
|
|
# docker service requires the ca.crt
|
|
include:
|
|
- ca
|
|
|
|
dockergroup:
|
|
group.present:
|
|
- name: docker
|
|
- gid: 920
|
|
|
|
dockerheldpackages:
|
|
pkg.installed:
|
|
- pkgs:
|
|
- containerd.io: 2.3.6-1.el9
|
|
- docker-ce: 3:29.8.1-1.el9
|
|
- docker-ce-cli: 1:29.8.1-1.el9
|
|
- docker-ce-rootless-extras: 29.8.1-1.el9
|
|
- hold: True
|
|
- update_holds: True
|
|
|
|
#disable docker from managing iptables
|
|
iptables_disabled:
|
|
file.managed:
|
|
- name: /etc/systemd/system/docker.service.d/iptables-disabled.conf
|
|
- source: salt://docker/files/iptables-disabled.conf
|
|
- makedirs: True
|
|
cmd.run:
|
|
- name: systemctl daemon-reload
|
|
- onchanges:
|
|
- file: iptables_disabled
|
|
|
|
# Make sure etc/docker exists
|
|
dockeretc:
|
|
file.directory:
|
|
- name: /etc/docker
|
|
|
|
docker_daemon:
|
|
file.managed:
|
|
- source: salt://docker/files/daemon.json.jinja
|
|
- name: /etc/docker/daemon.json
|
|
- template: jinja
|
|
|
|
# Make sure Docker is always running
|
|
docker_running:
|
|
service.running:
|
|
- name: docker
|
|
- enable: True
|
|
- watch:
|
|
- file: docker_daemon
|
|
- require:
|
|
- file: docker_daemon
|
|
- file: trusttheca
|
|
|
|
|
|
# Reserve OS ports for Docker proxy in case boot settings are not already applied/present
|
|
# 57314 = Strelka, 47760-47860 = Zeek
|
|
dockerapplyports:
|
|
cmd.run:
|
|
- name: if [ ! -s /etc/sysctl.d/99-reserved-ports.conf ]; then sysctl -w net.ipv4.ip_local_reserved_ports="57314,47760-47860"; fi
|
|
|
|
# Reserve OS ports for Docker proxy
|
|
dockerreserveports:
|
|
file.managed:
|
|
- source: salt://common/files/99-reserved-ports.conf
|
|
- name: /etc/sysctl.d/99-reserved-ports.conf
|
|
|
|
{% for NETNAME, NETWORK in DOCKERMERGED.networks.items() %}
|
|
{% if not NETWORK.get('manager_only') or GLOBALS.get('is_manager', False) %}
|
|
sos_docker_net_{{ NETNAME }}:
|
|
docker_network.present:
|
|
- name: {{ NETNAME }}
|
|
- subnet: {{ NETWORK.range }}
|
|
- gateway: {{ NETWORK.gateway }}
|
|
- options:
|
|
com.docker.network.bridge.name: '{{ NETNAME }}'
|
|
com.docker.network.driver.mtu: '1500'
|
|
com.docker.network.bridge.enable_ip_masquerade: 'true'
|
|
com.docker.network.bridge.enable_icc: 'true'
|
|
com.docker.network.bridge.host_binding_ipv4: '0.0.0.0'
|
|
- unless: ip l | grep {{ NETNAME }}
|
|
{% endif %}
|
|
{% endfor %}
|