securityonion

mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-06-12 13:19:22 +02:00

Files

T

Josh Patterson f088a27159 so-boot-mine-update: warm master pillar cache before highstate

A complete mine is not enough: elasticsearch:nodes, redis:nodes,
logstash:nodes (tgt_type=pillar) and hypervisor:nodes (tgt_type=compound)
resolve their target against the master's per-minion data cache
(grains+pillar in data.p), which is populated only when a minion's pillar
is recompiled -- separately from the mine. After a reboot a node can be in
the mine (so node_data/glob sees it) yet absent from that cache, so it
fails the elasticsearch:enabled:true pillar match and is dropped from
elasticsearch:nodes -> so-elasticsearch ExtraHosts -> container recreate.

After the mine-completeness wait, run salt '*' saltutil.refresh_pillar
wait=True to synchronously cache every up node's pillar (the same lever
deploy_newnode.sls uses), then verify with salt-run cache.pillar and retry
stragglers, bounded by MINE_UPDATE_MAX_WAIT. Also log elasticsearch:nodes
alongside node_data for inspection.

2026-06-09 13:52:19 -04:00

so-allow

…

so-boot-mine-update

so-boot-mine-update: warm master pillar cache before highstate

2026-06-09 13:52:19 -04:00

so-client

fix health check for new hydra version

2026-03-16 18:43:36 -04:00

so-deny

…

so-detections-overrides-import