Skip to content

Commit 3ce9afc

Browse files
ivaeri-norkartivaeri-norkart
committed
Add support for extra values in elasticsearch-keystore. Cleanup use of shell with pipes
1 parent a0f47b9 commit 3ce9afc

File tree

4 files changed

+91
-176
lines changed

4 files changed

+91
-176
lines changed

‎roles/elasticsearch/defaults/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ elasticsearch_conf_dir: "/etc/elasticsearch/"
2222
elasticsearch_user: elasticsearch
2323
elasticsearch_group: elasticsearch
2424
elasticsearch_api_host: localhost
25+
elasticsearch_keystore_extra: {}
26+
elasticsearch_keystore_purge: false
2527

2628
# JVM custom parameters
2729
elasticsearch_java_home: ''

‎roles/elasticsearch/tasks/elasticsearch-keystore-addupdate.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
3+
# Unless we clear the variable there is an edgecase
4+
# where we skip the Get task, and procced to the
5+
# set task with results from the previous run.
6+
# If the previous variable matches the new one,
7+
# we end up never setting the var.
8+
- name: Clear temporary variable
9+
ansible.builtin.set_fact:
10+
elasticsearch_keystore_current_value: null
11+
12+
- name: Get keystore value for {{ item.key }}
13+
ansible.builtin.command:
14+
argv:
15+
- /usr/share/elasticsearch/bin/elasticsearch-keystore
16+
- show
17+
- "{{ item.key | quote }}"
18+
changed_when: false
19+
register: elasticsearch_keystore_current_value
20+
failed_when: elasticsearch_keystore_current_value.rc != 0
21+
when:
22+
- "item.key in elasticsearch_keystore_current_items.stdout_lines"
23+
24+
- name: Set keystore value for {{ item.key }}
25+
ansible.builtin.command:
26+
argv:
27+
- /usr/share/elasticsearch/bin/elasticsearch-keystore
28+
- add
29+
- -f
30+
- -x
31+
- "{{ item.key | quote }}"
32+
stdin: "{{ item.value }}"
33+
changed_when: true
34+
register: result
35+
failed_when: result.rc != 0
36+
when:
37+
- elasticsearch_keystore_current_value.stdout is undefined or item.value != elasticsearch_keystore_current_value.stdout
38+
notify:
39+
- Restart Elasticsearch

‎roles/elasticsearch/tasks/elasticsearch-keystore.yml‎

Lines changed: 37 additions & 176 deletions
Original file line numberDiff line numberDiff line change
@@ -1,184 +1,45 @@
11
---
22

3-
- name: Create keystore
3+
- name: "Elasticsearch keystore: Create keystore"
44
ansible.builtin.command: /usr/share/elasticsearch/bin/elasticsearch-keystore create
55
args:
66
creates: /etc/elasticsearch/elasticsearch.keystore
77

8-
- name: Check for bootstrap password
8+
- name: "Elasticsearch keystore: Get current variables"
99
ansible.builtin.command: /usr/share/elasticsearch/bin/elasticsearch-keystore list
1010
changed_when: false
11-
register: elasticsearch_keystore
12-
13-
- name: Set bootstrap password # noqa: risky-shell-pipe
14-
ansible.builtin.shell: >
15-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
16-
echo "{{ elasticsearch_bootstrap_pw }}" |
17-
/usr/share/elasticsearch/bin/elasticsearch-keystore
18-
add -x 'bootstrap.password'
19-
when: "'bootstrap.password' not in elasticsearch_keystore.stdout_lines"
20-
changed_when: false
21-
no_log: true
22-
notify:
23-
- Restart Elasticsearch
24-
ignore_errors: "{{ ansible_check_mode }}"
25-
26-
- name: Get xpack.security.http.ssl.keystore.secure_password # noqa: risky-shell-pipe
27-
ansible.builtin.shell: >
28-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
29-
/usr/share/elasticsearch/bin/elasticsearch-keystore
30-
show 'xpack.security.http.ssl.keystore.secure_password'
31-
when:
32-
- "'xpack.security.http.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
33-
- elasticsearch_http_security
34-
register: elasticsearch_http_ssl_keystore_secure_password
35-
ignore_errors: "{{ ansible_check_mode }}"
36-
no_log: true
37-
changed_when: false
38-
39-
- name: Set xpack.security.http.ssl.keystore.secure_password # noqa: risky-shell-pipe
40-
ansible.builtin.shell: >
41-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
42-
echo "{{ elasticsearch_tls_key_passphrase }}" |
43-
/usr/share/elasticsearch/bin/elasticsearch-keystore
44-
add -f -x 'xpack.security.http.ssl.keystore.secure_password'
45-
changed_when: false
46-
no_log: true
47-
when:
48-
- elasticsearch_http_ssl_keystore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_http_ssl_keystore_secure_password.stdout
49-
- elasticsearch_http_security
50-
notify:
51-
- Restart Elasticsearch
52-
53-
- name: Remove xpack.security.http.ssl.keystore.secure_password # noqa: risky-shell-pipe
54-
ansible.builtin.shell: >
55-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
56-
/usr/share/elasticsearch/bin/elasticsearch-keystore
57-
remove 'xpack.security.http.ssl.keystore.secure_password'
58-
changed_when: false
59-
no_log: true
60-
when:
61-
- "'xpack.security.http.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
62-
- not elasticsearch_http_security
63-
notify:
64-
- Restart Elasticsearch
65-
66-
- name: Get xpack.security.http.ssl.truststore.secure_password # noqa: risky-shell-pipe
67-
ansible.builtin.shell: >
68-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
69-
/usr/share/elasticsearch/bin/elasticsearch-keystore
70-
show 'xpack.security.http.ssl.truststore.secure_password'
71-
when:
72-
- "'xpack.security.http.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
73-
- elasticsearch_http_security
74-
register: elasticsearch_http_ssl_truststore_secure_password
75-
ignore_errors: "{{ ansible_check_mode }}"
76-
no_log: true
77-
changed_when: false
78-
79-
- name: Set xpack.security.http.ssl.truststore.secure_password # noqa: risky-shell-pipe
80-
ansible.builtin.shell: >
81-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
82-
echo "{{ elasticsearch_tls_key_passphrase }}" |
83-
/usr/share/elasticsearch/bin/elasticsearch-keystore
84-
add -f -x 'xpack.security.http.ssl.truststore.secure_password'
85-
changed_when: false
86-
no_log: true
87-
when:
88-
- elasticsearch_http_ssl_truststore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_http_ssl_truststore_secure_password.stdout
89-
- elasticsearch_http_security
90-
notify:
91-
- Restart Elasticsearch
92-
93-
- name: Remove xpack.security.http.ssl.truststore.secure_password # noqa: risky-shell-pipe
94-
ansible.builtin.shell: >
95-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
96-
/usr/share/elasticsearch/bin/elasticsearch-keystore
97-
remove 'xpack.security.http.ssl.truststore.secure_password'
98-
changed_when: false
99-
no_log: true
100-
when:
101-
- "'xpack.security.http.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
102-
- not elasticsearch_http_security
103-
notify:
104-
- Restart Elasticsearch
105-
106-
- name: Get xpack.security.transport.ssl.keystore.secure_password # noqa: risky-shell-pipe
107-
ansible.builtin.shell: >
108-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
109-
/usr/share/elasticsearch/bin/elasticsearch-keystore
110-
show 'xpack.security.transport.ssl.keystore.secure_password'
111-
when:
112-
- "'xpack.security.transport.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
113-
- elasticsearch_security
114-
register: elasticsearch_transport_ssl_keystore_secure_password
115-
ignore_errors: "{{ ansible_check_mode }}"
116-
no_log: true
117-
changed_when: false
118-
119-
- name: Set xpack.security.transport.ssl.keystore.secure_password # noqa: risky-shell-pipe
120-
ansible.builtin.shell: >
121-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
122-
echo "{{ elasticsearch_tls_key_passphrase }}" |
123-
/usr/share/elasticsearch/bin/elasticsearch-keystore
124-
add -f -x 'xpack.security.transport.ssl.keystore.secure_password'
125-
changed_when: false
126-
no_log: true
127-
when:
128-
- elasticsearch_transport_ssl_keystore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_transport_ssl_keystore_secure_password.stdout
129-
- elasticsearch_security
130-
notify:
131-
- Restart Elasticsearch
132-
133-
- name: Remove xpack.security.transport.ssl.keystore.secure_password # noqa: risky-shell-pipe
134-
ansible.builtin.shell: >
135-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
136-
/usr/share/elasticsearch/bin/elasticsearch-keystore
137-
remove 'xpack.security.transport.ssl.keystore.secure_password'
138-
changed_when: false
139-
no_log: true
140-
when:
141-
- "'xpack.security.transport.ssl.keystore.secure_password' in elasticsearch_keystore.stdout_lines"
142-
- not elasticsearch_security
143-
notify:
144-
- Restart Elasticsearch
145-
146-
- name: Get xpack.security.transport.ssl.truststore.secure_password # noqa: risky-shell-pipe
147-
ansible.builtin.shell: >
148-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
149-
/usr/share/elasticsearch/bin/elasticsearch-keystore
150-
show 'xpack.security.transport.ssl.truststore.secure_password'
151-
when:
152-
- "'xpack.security.transport.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
153-
- elasticsearch_security
154-
register: elasticsearch_transport_ssl_truststore_secure_password
155-
ignore_errors: "{{ ansible_check_mode }}"
156-
no_log: true
157-
changed_when: false
158-
159-
- name: Set xpack.security.transport.ssl.truststore.secure_password # noqa: risky-shell-pipe
160-
ansible.builtin.shell: >
161-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
162-
echo "{{ elasticsearch_tls_key_passphrase }}" |
163-
/usr/share/elasticsearch/bin/elasticsearch-keystore
164-
add -f -x 'xpack.security.transport.ssl.truststore.secure_password'
165-
changed_when: false
166-
no_log: true
167-
when:
168-
- elasticsearch_transport_ssl_truststore_secure_password.stdout is undefined or elasticsearch_tls_key_passphrase != elasticsearch_transport_ssl_truststore_secure_password.stdout
169-
- elasticsearch_security
170-
notify:
171-
- Restart Elasticsearch
172-
173-
- name: Remove xpack.security.transport.ssl.truststore.secure_password # noqa: risky-shell-pipe
174-
ansible.builtin.shell: >
175-
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
176-
/usr/share/elasticsearch/bin/elasticsearch-keystore
177-
remove 'xpack.security.transport.ssl.truststore.secure_password'
178-
changed_when: false
179-
no_log: true
180-
when:
181-
- "'xpack.security.transport.ssl.truststore.secure_password' in elasticsearch_keystore.stdout_lines"
182-
- not elasticsearch_security
183-
notify:
184-
- Restart Elasticsearch
11+
register: elasticsearch_keystore_current_items
12+
13+
- name: "Elasticsearch keystore: Include xpack.security.http.ssl variables"
14+
ansible.builtin.set_fact:
15+
# Combine data into the dictionary
16+
elasticsearch_keystore_vars: "{{ elasticsearch_keystore_vars | combine({'xpack.security.http.ssl.keystore.secure_password': elasticsearch_tls_key_passphrase, 'xpack.security.http.ssl.truststore.secure_password': elasticsearch_tls_key_passphrase}) }}"
17+
no_log: "{{ elasticstack_no_log }}"
18+
when: elasticsearch_http_security | default(false) | bool
19+
20+
- name: "Elasticsearch keystore: Include xpack.security.transport.ssl variables"
21+
ansible.builtin.set_fact:
22+
# Combine data into the dictionary
23+
elasticsearch_keystore_vars: "{{ elasticsearch_keystore_vars | combine({'xpack.security.transport.ssl.keystore.secure_password': elasticsearch_tls_key_passphrase, 'xpack.security.transport.ssl.truststore.secure_password': elasticsearch_tls_key_passphrase}) }}"
24+
no_log: "{{ elasticstack_no_log }}"
25+
when: elasticsearch_security | default(false) | bool
26+
27+
- name: Add/update elements to elasticsearch keystore
28+
ansible.builtin.include_tasks:
29+
elasticsearch-keystore-addupdate.yml
30+
no_log: "{{ elasticstack_no_log }}"
31+
loop: "{{ (elasticsearch_keystore_extra | dict2items) + (elasticsearch_keystore_vars | dict2items) }}"
32+
33+
- name: Purge keys from elasticsearch keystore
34+
ansible.builtin.command:
35+
argv:
36+
- /usr/share/elasticsearch/bin/elasticsearch-keystore
37+
- remove
38+
- "{{ item | quote }}"
39+
changed_when: true
40+
loop: "{{ elasticsearch_keystore_current_items.stdout_lines }}"
41+
when:
42+
- elasticsearch_keystore_purge
43+
- item not in elasticsearch_keystore_vars
44+
- item not in elasticsearch_keystore_extra
45+
- item not in elasticsearch_keystore_builtin

‎roles/elasticsearch/vars/main.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,15 @@
11
---
22
# vars file for elasticsearch
3+
4+
# List all keystore items added by elastic
5+
# to avoid deleting them if role is set to
6+
# pruge keystore
7+
elasticsearch_keystore_builtin:
8+
- keystore.seed
9+
- autoconfiguration.password_hash
10+
11+
# We always set bootstrap.password
12+
# Other variables are added to the dict in elasticsearch-keystore.yml
13+
elasticsearch_keystore_vars: {
14+
bootstrap.password: "{{ elasticsearch_bootstrap_pw }}"
15+
}

0 commit comments

Comments
 (0)