diff --git a/README.md b/README.md index 83b32f23..9bcf76c6 100644 --- a/README.md +++ b/README.md @@ -667,7 +667,8 @@ The following table lists the _latest_ DSF Kit releases, their release date and 1.7.38 1. Added support for Terraform versions up to 1.16.x. -
2. Improvements and bug fixes. +
2. Added support for RHEL 9 in the CTE/DDC agent module and the PoC example (new `rhel_major_version` / `cte_ddc_agents_linux_rhel_version` variables, default remains RHEL 8). +
3. Improvements and bug fixes. diff --git a/examples/aws/poc/dsf_deployment/README.md b/examples/aws/poc/dsf_deployment/README.md index 82278ddb..509ff621 100644 --- a/examples/aws/poc/dsf_deployment/README.md +++ b/examples/aws/poc/dsf_deployment/README.md @@ -115,8 +115,9 @@ Several variables in the `variables.tf` file are important for configuring the d ### CTE / DDC Agents for Simulation Purposes -- `cte_agent_linux_installation_file`: Local path to the CTE agent installation file for Linux (RHEL 8.9). -- `ddc_agent_linux_installation_file`: Local path to the DDC agent installation file for Linux (RHEL 8.9). +- `cte_ddc_agents_linux_rhel_version`: RHEL major version of the Linux agent servers, `8` (default) or `9`. The Linux installation files must match it. +- `cte_agent_linux_installation_file`: Local path to the CTE agent installation file for Linux (RHEL 8 or 9, according to `cte_ddc_agents_linux_rhel_version`). +- `ddc_agent_linux_installation_file`: Local path to the DDC agent installation file for Linux (RHEL 8 or 9, according to `cte_ddc_agents_linux_rhel_version`). - `cte_agent_windows_installation_file`: Local path to the CTE agent installation file for Windows (Windows Server 2022). - `ddc_agent_windows_installation_file`: Local path to the DDC agent installation file for Windows (Windows Server 2022). diff --git a/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf b/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf index c54a551f..3b4c4a54 100644 --- a/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf +++ b/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf @@ -94,6 +94,7 @@ module "cte_ddc_agents" { ssh_public_key_name = module.key_pair.key_pair.key_pair_name } os_type = each.value.os_type + rhel_major_version = var.cte_ddc_agents_linux_rhel_version attach_persistent_public_ip = true use_public_ip = true allowed_ssh_cidrs = concat(local.workstation_cidr, var.allowed_ssh_cidrs) diff --git a/examples/aws/poc/dsf_deployment/variables.tf b/examples/aws/poc/dsf_deployment/variables.tf index afee7db6..dea432bf 100644 --- a/examples/aws/poc/dsf_deployment/variables.tf +++ b/examples/aws/poc/dsf_deployment/variables.tf @@ -446,15 +446,25 @@ variable "cte_ddc_agent_ebs_details" { } } +variable "cte_ddc_agents_linux_rhel_version" { + type = string + default = "8" + description = "RHEL major version of the CTE and/or DDC agent linux servers, available versions are: ['8', '9']. The Linux installation files must match this version." + validation { + condition = contains(["8", "9"], var.cte_ddc_agents_linux_rhel_version) + error_message = "Valid values for cte_ddc_agents_linux_rhel_version are: '8', '9'" + } +} + variable "cte_agent_linux_installation_file" { type = string - description = "Path to the CTE agent linux (RHEL 8.9) installation file" + description = "Path to the CTE agent linux (RHEL 8 or 9, according to cte_ddc_agents_linux_rhel_version) installation file" default = null } variable "ddc_agent_linux_installation_file" { type = string - description = "Path to the DDC agent linux (RHEL 8.9) installation file" + description = "Path to the DDC agent linux (RHEL 8 or 9, according to cte_ddc_agents_linux_rhel_version) installation file" default = null } diff --git a/modules/aws/cte-ddc-agent/README.md b/modules/aws/cte-ddc-agent/README.md index ab05ca99..5081ccfe 100644 --- a/modules/aws/cte-ddc-agent/README.md +++ b/modules/aws/cte-ddc-agent/README.md @@ -1,7 +1,7 @@ # DSF CTE-DDC Agent [![GitHub tag](https://img.shields.io/github/v/tag/imperva/dsfkit.svg)](https://github.com/imperva/dsfkit/tags) -This Terraform module provisions a CipherTrust Transparent Encryption (CTE) and/or Data Discovery and Classification (DDC) agent instance on AWS EC2, installs the required agent packages, registers them with a CipherTrust Manager, and handles connectivity, registration, and reboot where required. The module supports both Linux (RHEL 8.9) and Windows Server 2022. +This Terraform module provisions a CipherTrust Transparent Encryption (CTE) and/or Data Discovery and Classification (DDC) agent instance on AWS EC2, installs the required agent packages, registers them with a CipherTrust Manager, and handles connectivity, registration, and reboot where required. The module supports both Linux (RHEL 8 or 9) and Windows Server 2022. ## Requirements * Terraform, refer to [versions.tf](https://github.com/imperva/dsfkit/blob/master/modules/aws/cte-ddc-agent/versions.tf) for supported versions. @@ -12,7 +12,7 @@ This Terraform module provisions a CipherTrust Transparent Encryption (CTE) and/ ## Resources Provisioned This Terraform module provisions several resources on AWS to create the DSF CTE-DDC Agent instance. These resources include: -* An EC2 instance running Linux (RHEL 8.9) or Windows Server 2022. +* An EC2 instance running Linux (RHEL 8 or 9) or Windows Server 2022. * A network interface (ENI). * A security group, unless a list of security groups is provided. * An optional elastic public IP. @@ -32,6 +32,7 @@ The following input variables are **required**: Additionally, the following variables are often **required unless defaults suffice**: +* `rhel_major_version`: RHEL major version when `os_type` is `Red Hat`. Supported values: `8` (default, RHEL 8.10), `9` (RHEL 9.4). The CTE and DDC installation files must match this version (e.g. the CTE `rh8` vs `rh9` build). * `allowed_ssh_cidrs`: CIDRs allowed to SSH into Linux/Windows agent instance (port 22). * `allowed_rdp_cidrs`: CIDRs allowed to RDP into Windows agent instance (port 3389). * `attach_persistent_public_ip`: Whether to allocate and attach an Elastic IP (default: `false`). diff --git a/modules/aws/cte-ddc-agent/ami.tf b/modules/aws/cte-ddc-agent/ami.tf index ab0f5240..8aa2cd63 100644 --- a/modules/aws/cte-ddc-agent/ami.tf +++ b/modules/aws/cte-ddc-agent/ami.tf @@ -1,6 +1,10 @@ locals { - agent_ami_owner_linux = "309956199498" // aws - agent_ami_name_linux = "RHEL-8.10.*" + agent_ami_owner_linux = "309956199498" // aws + agent_ami_names_linux = { + "8" = "RHEL-8.10.*" + "9" = "RHEL-9.4.*" + } + agent_ami_name_linux = local.agent_ami_names_linux[var.rhel_major_version] agent_ami_ssh_user_linux = "ec2-user" agent_ami_owner_windows = "amazon" diff --git a/modules/aws/cte-ddc-agent/linux.tf b/modules/aws/cte-ddc-agent/linux.tf index f8a59d36..df663515 100644 --- a/modules/aws/cte-ddc-agent/linux.tf +++ b/modules/aws/cte-ddc-agent/linux.tf @@ -1,14 +1,14 @@ locals { cte_agent_inline_commands_linux = var.agent_installation.cte_agent_installation_file != null ? [ - "sudo yum install lsof -y", + "sudo yum install lsof ${var.rhel_major_version == "8" ? "" : "libnsl2"} -y", "sudo chmod +x ${basename(var.agent_installation.cte_agent_installation_file)}", "sudo ./${basename(var.agent_installation.cte_agent_installation_file)} -i -y", "sudo /opt/vormetric/DataSecurityExpert/agent/vmd/bin/register_host silent ${local.reg_params_template_name}" ] : [] ddc_agent_inline_commands_linux = var.agent_installation.ddc_agent_installation_file != null ? [ "set -xe", - "sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm", - "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio libnsl -y", + "sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-${var.rhel_major_version}.noarch.rpm", + "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio libnsl ${var.rhel_major_version == "8" ? "" : "libnsl2 chkconfig"} -y", "sudo rpm -ivh ${basename(var.agent_installation.ddc_agent_installation_file)}", "sudo er2-config -i ${var.cipher_trust_manager_address}", "sudo er2-config -t", diff --git a/modules/aws/cte-ddc-agent/variables.tf b/modules/aws/cte-ddc-agent/variables.tf index cd2644c7..88b651e3 100644 --- a/modules/aws/cte-ddc-agent/variables.tf +++ b/modules/aws/cte-ddc-agent/variables.tf @@ -91,6 +91,17 @@ variable "os_type" { } } +variable "rhel_major_version" { + type = string + description = "Red Hat Enterprise Linux major version of the agent instance, available versions are: ['8', '9']. Relevant only when 'os_type' is 'Red Hat'. The CTE and DDC installation files must match this version." + default = "8" + nullable = false + validation { + condition = contains(["8", "9"], var.rhel_major_version) + error_message = "Valid values for rhel_major_version are: '8', '9'" + } +} + variable "agent_installation" { type = object({ registration_token = string