From 160c4bb0764c13422243bdd3ade1e55e1206704f Mon Sep 17 00:00:00 2001 From: Segev Elmalech Date: Wed, 28 Oct 2026 10:19:19 +0200 Subject: [PATCH 1/3] feat(aws): support RHEL 9 in CTE/DDC agent module and PoC example Add rhel_major_version input (8 default, 9) to the cte-ddc-agent module, selecting the RHEL AMI and the matching EPEL release. Expose it in the dsf_deployment PoC example as cte_ddc_agents_linux_rhel_version. RHEL 8 remains the default, so existing deployments are unchanged. Co-Authored-By: Claude Sonnet 5.5 --- README.md | 3 ++- examples/aws/poc/dsf_deployment/README.md | 5 +++-- examples/aws/poc/dsf_deployment/cte_ddc_agents.tf | 1 + examples/aws/poc/dsf_deployment/variables.tf | 14 ++++++++++++-- modules/aws/cte-ddc-agent/README.md | 5 +++-- modules/aws/cte-ddc-agent/ami.tf | 8 ++++++-- modules/aws/cte-ddc-agent/linux.tf | 4 ++-- modules/aws/cte-ddc-agent/variables.tf | 11 +++++++++++ 8 files changed, 40 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 83b32f23f..9bcf76c60 100644 --- a/README.md +++ b/README.md @@ -667,7 +667,8 @@ The following table lists the _latest_ DSF Kit releases, their release date and 1.7.38 1. Added support for Terraform versions up to 1.16.x. -
2. Improvements and bug fixes. +
2. Added support for RHEL 9 in the CTE/DDC agent module and the PoC example (new `rhel_major_version` / `cte_ddc_agents_linux_rhel_version` variables, default remains RHEL 8). +
3. Improvements and bug fixes. diff --git a/examples/aws/poc/dsf_deployment/README.md b/examples/aws/poc/dsf_deployment/README.md index 82278ddb7..509ff6216 100644 --- a/examples/aws/poc/dsf_deployment/README.md +++ b/examples/aws/poc/dsf_deployment/README.md @@ -115,8 +115,9 @@ Several variables in the `variables.tf` file are important for configuring the d ### CTE / DDC Agents for Simulation Purposes -- `cte_agent_linux_installation_file`: Local path to the CTE agent installation file for Linux (RHEL 8.9). -- `ddc_agent_linux_installation_file`: Local path to the DDC agent installation file for Linux (RHEL 8.9). +- `cte_ddc_agents_linux_rhel_version`: RHEL major version of the Linux agent servers, `8` (default) or `9`. The Linux installation files must match it. +- `cte_agent_linux_installation_file`: Local path to the CTE agent installation file for Linux (RHEL 8 or 9, according to `cte_ddc_agents_linux_rhel_version`). +- `ddc_agent_linux_installation_file`: Local path to the DDC agent installation file for Linux (RHEL 8 or 9, according to `cte_ddc_agents_linux_rhel_version`). - `cte_agent_windows_installation_file`: Local path to the CTE agent installation file for Windows (Windows Server 2022). - `ddc_agent_windows_installation_file`: Local path to the DDC agent installation file for Windows (Windows Server 2022). diff --git a/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf b/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf index c54a551f1..3b4c4a541 100644 --- a/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf +++ b/examples/aws/poc/dsf_deployment/cte_ddc_agents.tf @@ -94,6 +94,7 @@ module "cte_ddc_agents" { ssh_public_key_name = module.key_pair.key_pair.key_pair_name } os_type = each.value.os_type + rhel_major_version = var.cte_ddc_agents_linux_rhel_version attach_persistent_public_ip = true use_public_ip = true allowed_ssh_cidrs = concat(local.workstation_cidr, var.allowed_ssh_cidrs) diff --git a/examples/aws/poc/dsf_deployment/variables.tf b/examples/aws/poc/dsf_deployment/variables.tf index afee7db65..dea432bf4 100644 --- a/examples/aws/poc/dsf_deployment/variables.tf +++ b/examples/aws/poc/dsf_deployment/variables.tf @@ -446,15 +446,25 @@ variable "cte_ddc_agent_ebs_details" { } } +variable "cte_ddc_agents_linux_rhel_version" { + type = string + default = "8" + description = "RHEL major version of the CTE and/or DDC agent linux servers, available versions are: ['8', '9']. The Linux installation files must match this version." + validation { + condition = contains(["8", "9"], var.cte_ddc_agents_linux_rhel_version) + error_message = "Valid values for cte_ddc_agents_linux_rhel_version are: '8', '9'" + } +} + variable "cte_agent_linux_installation_file" { type = string - description = "Path to the CTE agent linux (RHEL 8.9) installation file" + description = "Path to the CTE agent linux (RHEL 8 or 9, according to cte_ddc_agents_linux_rhel_version) installation file" default = null } variable "ddc_agent_linux_installation_file" { type = string - description = "Path to the DDC agent linux (RHEL 8.9) installation file" + description = "Path to the DDC agent linux (RHEL 8 or 9, according to cte_ddc_agents_linux_rhel_version) installation file" default = null } diff --git a/modules/aws/cte-ddc-agent/README.md b/modules/aws/cte-ddc-agent/README.md index ab05ca998..5081ccfea 100644 --- a/modules/aws/cte-ddc-agent/README.md +++ b/modules/aws/cte-ddc-agent/README.md @@ -1,7 +1,7 @@ # DSF CTE-DDC Agent [![GitHub tag](https://img.shields.io/github/v/tag/imperva/dsfkit.svg)](https://github.com/imperva/dsfkit/tags) -This Terraform module provisions a CipherTrust Transparent Encryption (CTE) and/or Data Discovery and Classification (DDC) agent instance on AWS EC2, installs the required agent packages, registers them with a CipherTrust Manager, and handles connectivity, registration, and reboot where required. The module supports both Linux (RHEL 8.9) and Windows Server 2022. +This Terraform module provisions a CipherTrust Transparent Encryption (CTE) and/or Data Discovery and Classification (DDC) agent instance on AWS EC2, installs the required agent packages, registers them with a CipherTrust Manager, and handles connectivity, registration, and reboot where required. The module supports both Linux (RHEL 8 or 9) and Windows Server 2022. ## Requirements * Terraform, refer to [versions.tf](https://github.com/imperva/dsfkit/blob/master/modules/aws/cte-ddc-agent/versions.tf) for supported versions. @@ -12,7 +12,7 @@ This Terraform module provisions a CipherTrust Transparent Encryption (CTE) and/ ## Resources Provisioned This Terraform module provisions several resources on AWS to create the DSF CTE-DDC Agent instance. These resources include: -* An EC2 instance running Linux (RHEL 8.9) or Windows Server 2022. +* An EC2 instance running Linux (RHEL 8 or 9) or Windows Server 2022. * A network interface (ENI). * A security group, unless a list of security groups is provided. * An optional elastic public IP. @@ -32,6 +32,7 @@ The following input variables are **required**: Additionally, the following variables are often **required unless defaults suffice**: +* `rhel_major_version`: RHEL major version when `os_type` is `Red Hat`. Supported values: `8` (default, RHEL 8.10), `9` (RHEL 9.4). The CTE and DDC installation files must match this version (e.g. the CTE `rh8` vs `rh9` build). * `allowed_ssh_cidrs`: CIDRs allowed to SSH into Linux/Windows agent instance (port 22). * `allowed_rdp_cidrs`: CIDRs allowed to RDP into Windows agent instance (port 3389). * `attach_persistent_public_ip`: Whether to allocate and attach an Elastic IP (default: `false`). diff --git a/modules/aws/cte-ddc-agent/ami.tf b/modules/aws/cte-ddc-agent/ami.tf index ab0f5240b..8aa2cd636 100644 --- a/modules/aws/cte-ddc-agent/ami.tf +++ b/modules/aws/cte-ddc-agent/ami.tf @@ -1,6 +1,10 @@ locals { - agent_ami_owner_linux = "309956199498" // aws - agent_ami_name_linux = "RHEL-8.10.*" + agent_ami_owner_linux = "309956199498" // aws + agent_ami_names_linux = { + "8" = "RHEL-8.10.*" + "9" = "RHEL-9.4.*" + } + agent_ami_name_linux = local.agent_ami_names_linux[var.rhel_major_version] agent_ami_ssh_user_linux = "ec2-user" agent_ami_owner_windows = "amazon" diff --git a/modules/aws/cte-ddc-agent/linux.tf b/modules/aws/cte-ddc-agent/linux.tf index f8a59d369..9bf06a186 100644 --- a/modules/aws/cte-ddc-agent/linux.tf +++ b/modules/aws/cte-ddc-agent/linux.tf @@ -7,8 +7,8 @@ locals { ] : [] ddc_agent_inline_commands_linux = var.agent_installation.ddc_agent_installation_file != null ? [ "set -xe", - "sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm", - "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio libnsl -y", + "sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-${var.rhel_major_version}.noarch.rpm", + "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio ${var.rhel_major_version == "8" ? "libnsl" : "libnsl2"} -y", "sudo rpm -ivh ${basename(var.agent_installation.ddc_agent_installation_file)}", "sudo er2-config -i ${var.cipher_trust_manager_address}", "sudo er2-config -t", diff --git a/modules/aws/cte-ddc-agent/variables.tf b/modules/aws/cte-ddc-agent/variables.tf index cd2644c7b..88b651e3e 100644 --- a/modules/aws/cte-ddc-agent/variables.tf +++ b/modules/aws/cte-ddc-agent/variables.tf @@ -91,6 +91,17 @@ variable "os_type" { } } +variable "rhel_major_version" { + type = string + description = "Red Hat Enterprise Linux major version of the agent instance, available versions are: ['8', '9']. Relevant only when 'os_type' is 'Red Hat'. The CTE and DDC installation files must match this version." + default = "8" + nullable = false + validation { + condition = contains(["8", "9"], var.rhel_major_version) + error_message = "Valid values for rhel_major_version are: '8', '9'" + } +} + variable "agent_installation" { type = object({ registration_token = string From 547f8b52574ee386514da60e879acf6096f87cee Mon Sep 17 00:00:00 2001 From: Segev Elmalech Date: Wed, 28 Oct 2026 13:21:46 +0200 Subject: [PATCH 2/3] fix(aws): install libnsl and libnsl2 for CTE/DDC agents on RHEL 9 The CTE installer requires libnsl2 and the DDC RPM requires libnsl.so.1 (package libnsl) on RHEL 9. RHEL 8 package lists are unchanged. Co-Authored-By: Claude Sonnet 5.5 --- modules/aws/cte-ddc-agent/linux.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/aws/cte-ddc-agent/linux.tf b/modules/aws/cte-ddc-agent/linux.tf index 9bf06a186..bb2737392 100644 --- a/modules/aws/cte-ddc-agent/linux.tf +++ b/modules/aws/cte-ddc-agent/linux.tf @@ -1,6 +1,6 @@ locals { cte_agent_inline_commands_linux = var.agent_installation.cte_agent_installation_file != null ? [ - "sudo yum install lsof -y", + "sudo yum install lsof ${var.rhel_major_version == "8" ? "" : "libnsl2"} -y", "sudo chmod +x ${basename(var.agent_installation.cte_agent_installation_file)}", "sudo ./${basename(var.agent_installation.cte_agent_installation_file)} -i -y", "sudo /opt/vormetric/DataSecurityExpert/agent/vmd/bin/register_host silent ${local.reg_params_template_name}" @@ -8,7 +8,7 @@ locals { ddc_agent_inline_commands_linux = var.agent_installation.ddc_agent_installation_file != null ? [ "set -xe", "sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-${var.rhel_major_version}.noarch.rpm", - "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio ${var.rhel_major_version == "8" ? "libnsl" : "libnsl2"} -y", + "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio libnsl ${var.rhel_major_version == "8" ? "" : "libnsl2"} -y", "sudo rpm -ivh ${basename(var.agent_installation.ddc_agent_installation_file)}", "sudo er2-config -i ${var.cipher_trust_manager_address}", "sudo er2-config -t", From c7f1d02c010d174e2eadf4234ec8e243887f75ec Mon Sep 17 00:00:00 2001 From: Segev Elmalech Date: Wed, 28 Oct 2026 15:33:59 +0200 Subject: [PATCH 3/3] fix(aws): install chkconfig for the DDC agent on RHEL 9 RHEL 9 does not ship chkconfig, so the er2 RPM post-install script silently failed to register the er2-agent init script. The agent did not start after the module's reboot and showed as Not Connected. RHEL 8 is unchanged. Co-Authored-By: Claude Sonnet 5.5 --- modules/aws/cte-ddc-agent/linux.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/aws/cte-ddc-agent/linux.tf b/modules/aws/cte-ddc-agent/linux.tf index bb2737392..df6635150 100644 --- a/modules/aws/cte-ddc-agent/linux.tf +++ b/modules/aws/cte-ddc-agent/linux.tf @@ -8,7 +8,7 @@ locals { ddc_agent_inline_commands_linux = var.agent_installation.ddc_agent_installation_file != null ? [ "set -xe", "sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-${var.rhel_major_version}.noarch.rpm", - "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio libnsl ${var.rhel_major_version == "8" ? "" : "libnsl2"} -y", + "sudo yum install libxml2 libgsasl openssl libcurl libuuid protobuf krb5-libs libaio libnsl ${var.rhel_major_version == "8" ? "" : "libnsl2 chkconfig"} -y", "sudo rpm -ivh ${basename(var.agent_installation.ddc_agent_installation_file)}", "sudo er2-config -i ${var.cipher_trust_manager_address}", "sudo er2-config -t",