Skip to content

Commit dc2f877

Browse files
lcndsmrafeefghannam89widhalmtdenise
authored
Feature/use uri not curl 123 (#186)
Close #123 Close #266 Close #265 Close #11 --------- Co-authored-by: Afeef Ghannam <afeef.ghannam@netways.de> Co-authored-by: Afeef Ghannam <39904920+afeefghannam89@users.noreply.github.com> Co-authored-by: Thomas Widhalm <thomas.widhalm@netways.de> Co-authored-by: denise <denise.siemer@hotmail.de>
1 parent d6d2e75 commit dc2f877

File tree

10 files changed

+293
-334
lines changed

10 files changed

+293
-334
lines changed

‎README.md‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -35,31 +35,34 @@ collections:
3535

3636
You will need the following Ansible collections installed
3737

38-
* community.general (probably already present)
38+
* `community.general` (probably already present)
39+
40+
You will need these packages / libraries installed. Some very basic packages like `openssl` get handled by the collection if needed. The following list contains packages and libraries which only apply to special cases or need for you to decide on the installation method.
41+
42+
* `passlib` Python library if you do not disable password hashing for logstash user and you want to use logstash role from this collection. It should be installed with pip on the Ansible controller.
3943

4044
You may want the following Ansible roles installed. There other ways to achieve what they are doing but using them is easy and convenient.
4145

42-
* geerlingguy.redis
43-
* openssl if you want to use Elastic Security
46+
* `geerlingguy.redis` if you want to use logstash role
4447

4548
### Supported systems
4649

4750
We test the collection on the following Linux distributions. Each one with Elastic Stack 7 and 8.
4851

52+
* Rocky Linux 9
4953
* Rocky Linux 8
50-
* Ubuntu 20.04 LTS
5154
* Ubuntu 22.04 LTS
55+
* Ubuntu 20.04 LTS
5256
* Debian 11
57+
* Debian 10
58+
* CentOS 8
5359

5460
We know from personal experience, that the collections work in following combinations. Missing tests mostly come from incompatibilties between the distribution and our testing environment, not from problems with the collection itself.
5561

5662
* CentOS 7 - Elastic Stack 7
5763

5864
### Known Issues
5965

60-
There are known issues with the following Linux distributions.
61-
62-
* Rocky Linux 9: The GnuPG key used by Elastic seems to be incompatible with this version of Rocky.
6366

6467
## Usage
6568

‎docs/role-logstash.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ Requirements
2020

2121
* `community.general` collection
2222

23+
You will need these packages / libraries installed. Some very basic packages like `openssl` get handled by the collection if needed. The following list contains packages and libraries which only apply to special cases or need for you to decide on the installation method.
24+
25+
* `passlib` Python library if you do not disable password hashing for logstash user. It should be installed with pip on the Ansible controller.
26+
2327
You need to have the Elastic Repos configured on your system. You can use our [role](./role-repos.md)
2428

2529
If you want to use the default pipeline configuration you need to have `git` available.
@@ -68,7 +72,7 @@ Aside from `logstash.yml` we can manage Logstashs pipelines.
6872
* *logstash_password_hash*: Generate and use a hash from your `logstash_password` (default: `true`)
6973
* *logstash_password_hash_algorithm*: Password hashing algorithms. Value must be same as `xpack.security.authc.password_hashing.algorithm` (default: `bcrypt`)
7074
* *logstash_password_salt_length*: base64 encoded Salt character lenght. This value must be integer and must be compatible to the selected password hashing algorithms (default: `22`)
71-
**logstash_password_hash_salt_seed*: A seed to generate random but idempotent salt on the elasticstack ca host. The salt will be used to create idempotent logstash hashed user password (default: `SeedChangeMe`)
75+
* *logstash_password_hash_salt_seed*: A seed to generate random but idempotent salt on the elasticstack ca host. The salt will be used to create idempotent logstash hashed user password (default: `SeedChangeMe`)
7276
* *logstash_password*: Password of Elasticsearch user. It must be at least 6 characters long (default: `password`)
7377
* *logstash_user_indices*: Indices the user has access to (default: `'"ecs-logstash*", "logstash*", "logs*"'`)
7478
* *logstash_reset_writer_role*: Reset user and role with every run: (default: `true`)

‎requirements-test.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ ansible-lint
33
molecule
44
molecule-plugins[docker]
55
pytest
6-
passlib
6+
passlib

‎roles/elasticsearch/tasks/elasticsearch-keystore.yml‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
---
2+
3+
- name: Create keystore
4+
ansible.builtin.command: /usr/share/elasticsearch/bin/elasticsearch-keystore create
5+
args:
6+
creates: /etc/elasticsearch/elasticsearch.keystore
7+
8+
- name: Check for bootstrap password
9+
ansible.builtin.command: /usr/share/elasticsearch/bin/elasticsearch-keystore list
10+
changed_when: false
11+
register: elasticsearch_keystore
12+
13+
- name: Set bootstrap password # noqa: risky-shell-pipe
14+
ansible.builtin.shell: >
15+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
16+
echo "{{ elasticsearch_bootstrap_pw }}" |
17+
/usr/share/elasticsearch/bin/elasticsearch-keystore
18+
add -x 'bootstrap.password'
19+
when: "'bootstrap.password' not in elasticsearch_keystore.stdout_lines"
20+
changed_when: false
21+
no_log: true
22+
notify:
23+
- Restart Elasticsearch
24+
ignore_errors: "{{ ansible_check_mode }}"
25+
26+
- name: Get xpack.security.http.ssl.keystore.secure_password # noqa: risky-shell-pipe
27+
ansible.builtin.shell: >
28+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
29+
/usr/share/elasticsearch/bin/elasticsearch-keystore
30+
show 'xpack.security.http.ssl.keystore.secure_password'
31+
when:
32+
- "'xpack.security.http.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
33+
- elasticsearch_http_security
34+
register: elasticsearch_http_ssl_keystore_secure_password
35+
ignore_errors: "{{ ansible_check_mode }}"
36+
no_log: true
37+
changed_when: false
38+
39+
- name: Set xpack.security.http.ssl.keystore.secure_password # noqa: risky-shell-pipe
40+
ansible.builtin.shell: >
41+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
42+
echo "{{ elasticsearch_tls_key_passphrase }}" |
43+
/usr/share/elasticsearch/bin/elasticsearch-keystore
44+
add -f -x 'xpack.security.http.ssl.keystore.secure_password'
45+
changed_when: false
46+
no_log: true
47+
when:
48+
- elasticsearch_http_ssl_keystore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_http_ssl_keystore_secure_password.stdout
49+
- elasticsearch_http_security
50+
notify:
51+
- Restart Elasticsearch
52+
53+
- name: Remove xpack.security.http.ssl.keystore.secure_password # noqa: risky-shell-pipe
54+
ansible.builtin.shell: >
55+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
56+
/usr/share/elasticsearch/bin/elasticsearch-keystore
57+
remove 'xpack.security.http.ssl.keystore.secure_password'
58+
changed_when: false
59+
no_log: true
60+
when:
61+
- "'xpack.security.http.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
62+
- not elasticsearch_http_security
63+
notify:
64+
- Restart Elasticsearch
65+
66+
- name: Get xpack.security.http.ssl.truststore.secure_password # noqa: risky-shell-pipe
67+
ansible.builtin.shell: >
68+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
69+
/usr/share/elasticsearch/bin/elasticsearch-keystore
70+
show 'xpack.security.http.ssl.truststore.secure_password'
71+
when:
72+
- "'xpack.security.http.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
73+
- elasticsearch_http_security
74+
register: elasticsearch_http_ssl_truststore_secure_password
75+
ignore_errors: "{{ ansible_check_mode }}"
76+
no_log: true
77+
changed_when: false
78+
79+
- name: Set xpack.security.http.ssl.truststore.secure_password # noqa: risky-shell-pipe
80+
ansible.builtin.shell: >
81+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
82+
echo "{{ elasticsearch_tls_key_passphrase }}" |
83+
/usr/share/elasticsearch/bin/elasticsearch-keystore
84+
add -f -x 'xpack.security.http.ssl.truststore.secure_password'
85+
changed_when: false
86+
no_log: true
87+
when:
88+
- elasticsearch_http_ssl_truststore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_http_ssl_truststore_secure_password.stdout
89+
- elasticsearch_http_security
90+
notify:
91+
- Restart Elasticsearch
92+
93+
- name: Remove xpack.security.http.ssl.truststore.secure_password # noqa: risky-shell-pipe
94+
ansible.builtin.shell: >
95+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
96+
/usr/share/elasticsearch/bin/elasticsearch-keystore
97+
remove 'xpack.security.http.ssl.truststore.secure_password'
98+
changed_when: false
99+
no_log: true
100+
when:
101+
- "'xpack.security.http.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
102+
- not elasticsearch_http_security
103+
notify:
104+
- Restart Elasticsearch
105+
106+
- name: Get xpack.security.transport.ssl.keystore.secure_password # noqa: risky-shell-pipe
107+
ansible.builtin.shell: >
108+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
109+
/usr/share/elasticsearch/bin/elasticsearch-keystore
110+
show 'xpack.security.transport.ssl.keystore.secure_password'
111+
when:
112+
- "'xpack.security.transport.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
113+
- elasticsearch_security
114+
register: elasticsearch_transport_ssl_keystore_secure_password
115+
ignore_errors: "{{ ansible_check_mode }}"
116+
no_log: true
117+
changed_when: false
118+
119+
- name: Set xpack.security.transport.ssl.keystore.secure_password # noqa: risky-shell-pipe
120+
ansible.builtin.shell: >
121+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
122+
echo "{{ elasticsearch_tls_key_passphrase }}" |
123+
/usr/share/elasticsearch/bin/elasticsearch-keystore
124+
add -f -x 'xpack.security.transport.ssl.keystore.secure_password'
125+
changed_when: false
126+
no_log: true
127+
when:
128+
- elasticsearch_transport_ssl_keystore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_transport_ssl_keystore_secure_password.stdout
129+
- elasticsearch_security
130+
notify:
131+
- Restart Elasticsearch
132+
133+
- name: Remove xpack.security.transport.ssl.keystore.secure_password # noqa: risky-shell-pipe
134+
ansible.builtin.shell: >
135+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
136+
/usr/share/elasticsearch/bin/elasticsearch-keystore
137+
remove 'xpack.security.transport.ssl.keystore.secure_password'
138+
changed_when: false
139+
no_log: true
140+
when:
141+
- "'xpack.security.transport.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
142+
- not elasticsearch_security
143+
notify:
144+
- Restart Elasticsearch
145+
146+
- name: Get xpack.security.transport.ssl.truststore.secure_password # noqa: risky-shell-pipe
147+
ansible.builtin.shell: >
148+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
149+
/usr/share/elasticsearch/bin/elasticsearch-keystore
150+
show 'xpack.security.transport.ssl.truststore.secure_password'
151+
when:
152+
- "'xpack.security.transport.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
153+
- elasticsearch_security
154+
register: elasticsearch_transport_ssl_truststore_secure_password
155+
ignore_errors: "{{ ansible_check_mode }}"
156+
no_log: true
157+
changed_when: false
158+
159+
- name: Set xpack.security.transport.ssl.truststore.secure_password # noqa: risky-shell-pipe
160+
ansible.builtin.shell: >
161+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
162+
echo "{{ elasticsearch_tls_key_passphrase }}" |
163+
/usr/share/elasticsearch/bin/elasticsearch-keystore
164+
add -f -x 'xpack.security.transport.ssl.truststore.secure_password'
165+
changed_when: false
166+
no_log: true
167+
when:
168+
- elasticsearch_transport_ssl_truststore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_transport_ssl_truststore_secure_password.stdout
169+
- elasticsearch_security
170+
notify:
171+
- Restart Elasticsearch
172+
173+
- name: Remove xpack.security.transport.ssl.truststore.secure_password # noqa: risky-shell-pipe
174+
ansible.builtin.shell: >
175+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
176+
/usr/share/elasticsearch/bin/elasticsearch-keystore
177+
remove 'xpack.security.transport.ssl.truststore.secure_password'
178+
changed_when: false
179+
no_log: true
180+
when:
181+
- "'xpack.security.transport.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
182+
- not elasticsearch_security
183+
notify:
184+
- Restart Elasticsearch

0 commit comments

Comments
 (0)