mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-09 12:52:38 +02:00
Mike Reeves
5f28e9b191
Simpler, race-free replacement for the reactor + orch + fan-out chain.
- salt/manager/tools/sbin/so-minion: expand add_telegraf_to_minion to
generate a random 72-char password, reuse any existing password from
the aggregate pillar, write postgres.telegraf.{user,pass} into the
minion's own pillar file, and update the aggregate pillar so
postgres.telegraf_users can CREATE ROLE on the next manager apply.
Every create<ROLE> function already calls this hook, so add / addVM /
setup dispatches are all covered identically and synchronously.
- salt/postgres/auth.sls: strip the fanout_targets loop and the
postgres_telegraf_minion_pillar_<safe> cmd.run block — it's now
redundant. The state still manages the so_postgres admin user and
writes the aggregate pillar for postgres.telegraf_users to consume.
- salt/reactor/telegraf_user_sync.sls: deleted.
- salt/orch/telegraf_postgres_sync.sls: deleted.
- salt/salt/master.sls: drop the reactor_config_telegraf block that
registered the reactor on /etc/salt/master.d/reactor_telegraf.conf.
- salt/orch/deploy_newnode.sls: drop the manager_fanout_postgres_telegraf
step and the require: it added to the newnode highstate. Back to its
original 3/dev shape.
No more ephemeral postgres_fanout_minion pillar, no more async salt/key
reactor, no more so-minion setupMinionFiles race: the pillar write
happens inline inside setupMinionFiles itself.
59 lines
2.3 KiB
Plaintext
59 lines
2.3 KiB
Plaintext
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
{% from 'allowed_states.map.jinja' import allowed_states %}
|
|
{% if sls in allowed_states %}
|
|
|
|
{% set DIGITS = "1234567890" %}
|
|
{% set LOWERCASE = "qwertyuiopasdfghjklzxcvbnm" %}
|
|
{% set UPPERCASE = "QWERTYUIOPASDFGHJKLZXCVBNM" %}
|
|
{% set SYMBOLS = "~!@#^&*()-_=+[]|;:,.<>?" %}
|
|
{% set CHARS = DIGITS~LOWERCASE~UPPERCASE~SYMBOLS %}
|
|
{% set so_postgres_user_pass = salt['pillar.get']('postgres:auth:users:so_postgres_user:pass', salt['random.get_str'](72, chars=CHARS)) %}
|
|
|
|
{# Per-minion Telegraf Postgres credentials. Merge currently-up minions with any #}
|
|
{# previously-known entries in pillar so existing passwords persist across runs. #}
|
|
{% set existing = salt['pillar.get']('postgres:auth:users', {}) %}
|
|
{% set up_minions = salt['saltutil.runner']('manage.up') or [] %}
|
|
{% set telegraf_users = {} %}
|
|
{% for key, entry in existing.items() %}
|
|
{%- if key.startswith('telegraf_') and entry.get('user') and entry.get('pass') %}
|
|
{%- do telegraf_users.update({key: entry}) %}
|
|
{%- endif %}
|
|
{% endfor %}
|
|
{% for mid in up_minions %}
|
|
{%- set safe = mid | replace('.','_') | replace('-','_') | lower %}
|
|
{%- set key = 'telegraf_' ~ safe %}
|
|
{%- if key not in telegraf_users %}
|
|
{%- do telegraf_users.update({key: {'user': 'so_telegraf_' ~ safe, 'pass': salt['random.get_str'](72, chars=CHARS)}}) %}
|
|
{%- endif %}
|
|
{% endfor %}
|
|
|
|
postgres_auth_pillar:
|
|
file.managed:
|
|
- name: /opt/so/saltstack/local/pillar/postgres/auth.sls
|
|
- mode: 640
|
|
- reload_pillar: True
|
|
- contents: |
|
|
postgres:
|
|
auth:
|
|
users:
|
|
so_postgres_user:
|
|
user: so_postgres
|
|
pass: "{{ so_postgres_user_pass }}"
|
|
{% for key, entry in telegraf_users.items() %}
|
|
{{ key }}:
|
|
user: {{ entry.user }}
|
|
pass: "{{ entry.pass }}"
|
|
{% endfor %}
|
|
- show_changes: False
|
|
{% else %}
|
|
|
|
{{sls}}_state_not_allowed:
|
|
test.fail_without_changes:
|
|
- name: {{sls}}_state_not_allowed
|
|
|
|
{% endif %}
|