mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-03-27 06:52:40 +01:00
2d97dfc8a1
Add ulimits as a configurable advanced setting for every container, allowing customization through the web UI. Move hardcoded ulimits from elasticsearch and zeek into defaults.yaml and fix elasticsearch ulimits that were incorrectly nested under the environment key. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
107 lines
4.0 KiB
Plaintext
107 lines
4.0 KiB
Plaintext
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
#
|
|
# Note: Per the Elastic License 2.0, the second limitation states:
|
|
#
|
|
# "You may not move, change, disable, or circumvent the license key functionality
|
|
# in the software, and you may not remove or obscure any functionality in the
|
|
# software that is protected by the license key."
|
|
|
|
{% from 'allowed_states.map.jinja' import allowed_states %}
|
|
{% if sls.split('.')[0] in allowed_states %}
|
|
{% from 'vars/globals.map.jinja' import GLOBALS %}
|
|
{% from 'docker/docker.map.jinja' import DOCKER %}
|
|
{% set KAFKANODES = salt['pillar.get']('kafka:nodes') %}
|
|
{% set KAFKA_EXTERNAL_ACCESS = salt['pillar.get']('kafka:config:external_access:enabled', default=False) %}
|
|
{% if 'gmd' in salt['pillar.get']('features', []) %}
|
|
|
|
include:
|
|
- kafka.ca
|
|
- kafka.config
|
|
- kafka.ssl
|
|
- kafka.storage
|
|
- kafka.sostatus
|
|
|
|
so-kafka:
|
|
docker_container.running:
|
|
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-kafka:{{ GLOBALS.so_version }}
|
|
- hostname: so-kafka
|
|
- name: so-kafka
|
|
- networks:
|
|
- sobridge:
|
|
- ipv4_address: {{ DOCKER.containers['so-kafka'].ip }}
|
|
- user: kafka
|
|
- environment:
|
|
KAFKA_HEAP_OPTS: -Xmx2G -Xms1G
|
|
KAFKA_OPTS: "-javaagent:/opt/jolokia/agents/jolokia-agent-jvm-javaagent.jar=port=8778,host={{ DOCKER.containers['so-kafka'].ip }},policyLocation=file:/opt/jolokia/jolokia.xml {%- if KAFKA_EXTERNAL_ACCESS %} -Djava.security.auth.login.config=/opt/kafka/config/kafka_server_jaas.conf {% endif -%}"
|
|
- extra_hosts:
|
|
{% for node in KAFKANODES %}
|
|
- {{ node }}:{{ KAFKANODES[node].ip }}
|
|
{% endfor %}
|
|
{% if DOCKER.containers['so-kafka'].extra_hosts %}
|
|
{% for XTRAHOST in DOCKER.containers['so-kafka'].extra_hosts %}
|
|
- {{ XTRAHOST }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
- port_bindings:
|
|
{% for BINDING in DOCKER.containers['so-kafka'].port_bindings %}
|
|
- {{ BINDING }}
|
|
{% endfor %}
|
|
- binds:
|
|
- /etc/pki/kafka.p12:/etc/pki/kafka.p12:ro
|
|
- /opt/so/conf/kafka/kafka-truststore.jks:/etc/pki/kafka-truststore.jks:ro
|
|
- /nsm/kafka/data/:/nsm/kafka/data/:rw
|
|
- /opt/so/log/kafka:/opt/kafka/logs/:rw
|
|
- /opt/so/conf/kafka/server.properties:/opt/kafka/config/kraft/server.properties:ro
|
|
- /opt/so/conf/kafka/client.properties:/opt/kafka/config/kraft/client.properties:ro
|
|
- /opt/so/conf/kafka/log4j.properties:/opt/kafka/config/log4j.properties:ro
|
|
{% if KAFKA_EXTERNAL_ACCESS %}
|
|
- /opt/so/conf/kafka/kafka_server_jaas.conf:/opt/kafka/config/kafka_server_jaas.conf:ro
|
|
{% endif %}
|
|
{% if DOCKER.containers['so-kafka'].ulimits %}
|
|
- ulimits:
|
|
{% for ULIMIT in DOCKER.containers['so-kafka'].ulimits %}
|
|
- {{ ULIMIT }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
- watch:
|
|
{% for sc in ['server', 'client'] %}
|
|
- file: kafka_kraft_{{sc}}_properties
|
|
{% endfor %}
|
|
{% if KAFKA_EXTERNAL_ACCESS %}
|
|
- file: kafka_server_jaas_properties
|
|
{% endif %}
|
|
- file: kafkacertz
|
|
- x509: kafka_crt
|
|
- file: kafka_pkcs12_perms
|
|
- require:
|
|
- file: kafkacertz
|
|
|
|
delete_so-kafka_so-status.disabled:
|
|
file.uncomment:
|
|
- name: /opt/so/conf/so-status/so-status.conf
|
|
- regex: ^so-kafka$
|
|
|
|
{% else %}
|
|
|
|
{{sls}}_no_license_detected:
|
|
test.fail_without_changes:
|
|
- name: {{sls}}_no_license_detected
|
|
- comment:
|
|
- "Kafka for Guaranteed Message Delivery is a feature supported only for customers with a valid license.
|
|
Contact Security Onion Solutions, LLC via our website at https://securityonionsolutions.com
|
|
for more information about purchasing a license to enable this feature."
|
|
include:
|
|
- kafka.disabled
|
|
{% endif %}
|
|
|
|
{% else %}
|
|
|
|
{{sls}}_state_not_allowed:
|
|
test.fail_without_changes:
|
|
- name: {{sls}}_state_not_allowed
|
|
|
|
{% endif %}
|