mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-09 12:52:38 +02:00
Mike Reeves
3fad895d6a
Lays the database-backed pillar foundation for the postsalt branch. Salt
continues to read on-disk SLS first; the new ext_pillar config overlays
values from the so_pillar.* schema in so-postgres.
- salt/postgres/files/schema/pillar/00{1..7}_*.sql: idempotent DDL for
scope/role/role_member/minion/pillar_entry/pillar_entry_history/
drift_log, secret pgcrypto helpers, RLS, pg_cron retention.
- salt/postgres/schema_pillar.sls: applies the SQL files inside the
so-postgres container after it's healthy, configures the master_key
GUC, and runs so-pillar-import once. Gated on
postgres:so_pillar:enabled feature flag (default false).
- salt/salt/master/ext_pillar_postgres.{sls,conf.jinja}: drops
/etc/salt/master.d/ext_pillar_postgres.conf with list-form ext_pillar
queries (global/role/minion/secrets) and ext_pillar_first: False so
bootstrap pillars on disk render before the PG overlay.
- salt/postgres/init.sls + salt/salt/master.sls: include the new states.
Both new state branches are guarded so a default install with the flag
off is a no-op.
40 lines
2.2 KiB
SQL
40 lines
2.2 KiB
SQL
-- Seed the so_pillar.role table with the role buckets defined in pillar/top.sls.
|
|
-- The match_expr column preserves the original Salt compound expression purely
|
|
-- as documentation; PG-side membership is materialised in role_member.
|
|
-- Idempotent: ON CONFLICT lets re-application leave existing rows untouched.
|
|
|
|
INSERT INTO so_pillar.role(role_name, match_kind, match_expr, description) VALUES
|
|
('manager', 'compound', '*_manager or *_managersearch or *_managerhype',
|
|
'Manager-class node. Includes managersearch and managerhype subtypes.'),
|
|
('managersearch', 'compound', '*_managersearch',
|
|
'Combined manager + searchnode role.'),
|
|
('managerhype', 'compound', '*_managerhype',
|
|
'Combined manager + hypervisor role.'),
|
|
('sensor', 'compound', '*_sensor',
|
|
'Sensor node running zeek/suricata/strelka.'),
|
|
('eval', 'compound', '*_eval',
|
|
'Single-node evaluation install (manager + sensor + storage on one host).'),
|
|
('standalone', 'compound', '*_standalone',
|
|
'Single-node production install (no distributed cluster).'),
|
|
('heavynode', 'compound', '*_heavynode',
|
|
'Distributed manager node carrying logstash + ES.'),
|
|
('idh', 'compound', '*_idh',
|
|
'Intrusion-detection-honeypot node.'),
|
|
('searchnode', 'compound', '*_searchnode',
|
|
'Distributed Elasticsearch search node.'),
|
|
('receiver', 'compound', '*_receiver',
|
|
'Kafka receiver node.'),
|
|
('import', 'compound', '*_import',
|
|
'Single-node import-only install.'),
|
|
('fleet', 'compound', '*_fleet',
|
|
'Elastic Fleet server node.'),
|
|
('hypervisor', 'compound', '*_hypervisor',
|
|
'Hypervisor host (libvirt). Hosts VM minions.'),
|
|
('desktop', 'compound', '*_desktop',
|
|
'Desktop minion (no firewall/nginx pillars apply).'),
|
|
('not_desktop', 'compound', '* and not *_desktop',
|
|
'Pseudo-role; matches every minion that is not a desktop. Used for global firewall/nginx.'),
|
|
('libvirt', 'grain', 'salt-cloud:driver:libvirt',
|
|
'Pseudo-role; matches any minion with grain salt-cloud.driver = libvirt.')
|
|
ON CONFLICT (role_name) DO NOTHING;
|