mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-09 21:02:36 +02:00
Mike Reeves
5f28e9b191
Simpler, race-free replacement for the reactor + orch + fan-out chain.
- salt/manager/tools/sbin/so-minion: expand add_telegraf_to_minion to
generate a random 72-char password, reuse any existing password from
the aggregate pillar, write postgres.telegraf.{user,pass} into the
minion's own pillar file, and update the aggregate pillar so
postgres.telegraf_users can CREATE ROLE on the next manager apply.
Every create<ROLE> function already calls this hook, so add / addVM /
setup dispatches are all covered identically and synchronously.
- salt/postgres/auth.sls: strip the fanout_targets loop and the
postgres_telegraf_minion_pillar_<safe> cmd.run block — it's now
redundant. The state still manages the so_postgres admin user and
writes the aggregate pillar for postgres.telegraf_users to consume.
- salt/reactor/telegraf_user_sync.sls: deleted.
- salt/orch/telegraf_postgres_sync.sls: deleted.
- salt/salt/master.sls: drop the reactor_config_telegraf block that
registered the reactor on /etc/salt/master.d/reactor_telegraf.conf.
- salt/orch/deploy_newnode.sls: drop the manager_fanout_postgres_telegraf
step and the require: it added to the newnode highstate. Back to its
original 3/dev shape.
No more ephemeral postgres_fanout_minion pillar, no more async salt/key
reactor, no more so-minion setupMinionFiles race: the pillar write
happens inline inside setupMinionFiles itself.
33 lines
926 B
Plaintext
33 lines
926 B
Plaintext
{% set MANAGER = salt['pillar.get']('setup:manager') %}
|
|
{% set NEWNODE = salt['pillar.get']('setup:newnode') %}
|
|
|
|
# tell the minion to populate the mine with data from mine_functions which is populated during setup
|
|
# this only needs to happen on non managers since they handle this during setup
|
|
# and they need to wait for ca creation to update the mine
|
|
{{NEWNODE}}_update_mine:
|
|
salt.function:
|
|
- name: mine.update
|
|
- tgt: {{ NEWNODE }}
|
|
- retry:
|
|
attempts: 36
|
|
interval: 5
|
|
|
|
# we need to prepare the manager for a new searchnode or heavynode
|
|
{% if NEWNODE.split('_')|last in ['searchnode', 'heavynode'] %}
|
|
manager_run_es_soc:
|
|
salt.state:
|
|
- tgt: {{ MANAGER }}
|
|
- sls:
|
|
- elasticsearch
|
|
- soc
|
|
- queue: True
|
|
- require:
|
|
- salt: {{NEWNODE}}_update_mine
|
|
{% endif %}
|
|
|
|
{{NEWNODE}}_run_highstate:
|
|
salt.state:
|
|
- tgt: {{ NEWNODE }}
|
|
- highstate: True
|
|
- queue: True
|