Skip to content

Commit 5eef485

Browse files
widhalmtwidhalmt
committed
Merge branch 'main' into feature/update-216
2 parents 5d92f58 + 99f5ded commit 5eef485

29 files changed

+854
-33
lines changed

‎.github/workflows/test_elasticsearch_modules.yml

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
name: Test Elasticsearch modules
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
logLevel:
7+
description: 'Log level'
8+
required: true
9+
default: 'warning'
10+
type: choice
11+
options:
12+
- info
13+
- warning
14+
- debug
15+
pull_request:
16+
paths:
17+
- '.github/workflows/test_elasticsearch_modules.yml'
18+
- 'molecule/elasticsearch_test_modules/*'
19+
20+
jobs:
21+
molecule_elasticsearch_modules:
22+
runs-on: ubuntu-latest
23+
24+
env:
25+
COLLECTION_NAMESPACE: netways
26+
COLLECTION_NAME: elasticstack
27+
28+
strategy:
29+
fail-fast: false
30+
matrix:
31+
distro: [ubuntu2204]
32+
scenario:
33+
- elasticsearch_test_modules
34+
release:
35+
- 8
36+
37+
steps:
38+
- name: Check out code
39+
uses: actions/checkout@v4
40+
41+
- name: Set up Python 3.8
42+
uses: actions/setup-python@v5
43+
with:
44+
python-version: 3.8
45+
46+
- name: Install dependencies
47+
run: |
48+
python3 -m pip install --upgrade pip
49+
python3 -m pip install -r requirements-test.txt
50+
51+
- name: Install collection
52+
run: |
53+
mkdir -p ~/.ansible/collections/ansible_collections/$COLLECTION_NAMESPACE
54+
cp -a ../ansible-collection-$COLLECTION_NAME ~/.ansible/collections/ansible_collections/$COLLECTION_NAMESPACE/$COLLECTION_NAME
55+
56+
- name: Test with molecule
57+
run: |
58+
molecule test -s ${{ matrix.scenario }}
59+
env:
60+
MOLECULE_DISTRO: ${{ matrix.distro }}
61+
PY_COLORS: '1'
62+
ANSIBLE_FORCE_COLOR: '1'
63+
ELASTIC_RELEASE: ${{ matrix.release }}

‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
.cache
22
*.swp
3-
__pycache__*
3+
__pycache__*
4+
.vscode

‎README.md

+6-1
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,19 @@ Every role is documented with all variables, please refer to the documentation f
88

99
**Please note**: If you are already using this collection before version `1.0.0`, please note that we had to rename a significant amount of variables due to naming schema changes made by Ansible. Please review the variables you have set in your playbooks and variable files.
1010

11-
## Roles Documentation
11+
## Roles documentation
1212

1313
* [Beats](docs/role-beats.md)
1414
* [Elasticsearch](docs/role-elasticsearch.md)
1515
* [Kibana](docs/role-kibana.md)
1616
* [Logstash](docs/role-logstash.md)
1717
* [Repos](docs/role-repos.md)
1818

19+
## Modules documentation
20+
21+
* [elasticsearch_role](docs/module-elasticsearch_role.md)
22+
* [elasticsearch_user](docs/module-elasticsearch_user.md)
23+
1924
## Installation
2025

2126
You can easily install the collection with the `ansible-galaxy` command.

‎docs/module-elasticsearch_role.md

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
Ansible module: elasticsearch_role
2+
===
3+
4+
This module creates, updates and deletes roles from your Elasticsearch.
5+
6+
Requirements
7+
---
8+
9+
As this module uses the Elasticsearch API you will need to install the `elasticsearch` Python3 library.
10+
```
11+
pip3 install elasticsearch
12+
```
13+
14+
Module arguments
15+
---
16+
17+
* *name*: Name of your role (**Required**)
18+
* *cluster*: List of clusters
19+
* *indicies*: List of indicies
20+
* *names*: List of names (**Required**)
21+
* *privileges*: List of privileges (**Required**)
22+
* *state*: State of the role (Default: `present`)
23+
* *host*: API endpoint (**Required**)
24+
* *auth_user*: User to authenticate on the Elasticsearch API (**Required**)
25+
* *auth_pass*: Password for the given user (**Required**)
26+
* *verify_certs*: Verify certificates (Default: `true`)
27+
* *ca_certs*: Verify HTTPS connection by using ca certificate. Path to ca needs to be given
28+
29+
Example usage
30+
---
31+
```
32+
- name: Create elasticsearch role 'new-role1'
33+
netways.elasticstack.elasticsearch_role:
34+
name: new-role1
35+
cluster:
36+
- manage_own_api_key
37+
- delegate_pki
38+
indicies:
39+
- names:
40+
- default01
41+
privileges:
42+
- read
43+
- write
44+
state: present
45+
host: https://localhost:9200
46+
auth_user: elastic
47+
auth_pass: changeMe123!
48+
verify_certs: true
49+
ca_certs: /etc/elasticsearch/certs/http_ca.crt
50+
51+
- name: Create elasticsearch role 'new-role2'
52+
netways.elasticstack.elasticsearch_role:
53+
name: new-role2
54+
cluster:
55+
- manage_own_api_key
56+
- delegate_pki
57+
indicies:
58+
- names:
59+
- default01
60+
privileges:
61+
- read
62+
- write
63+
state: present
64+
host: https://localhost:9200
65+
auth_user: elastic
66+
auth_pass: changeMe123!
67+
verify_certs: false
68+
```

‎docs/module-elasticsearch_user.md

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
Ansible module: elasticsearch_user
2+
===
3+
4+
This module creates, updates and deletes users from your Elasticsearch.
5+
6+
Requirements
7+
---
8+
9+
As this module uses the Elasticsearch API you will need to install the `elasticsearch` Python3 library.
10+
```
11+
pip3 install elasticsearch
12+
```
13+
14+
Module arguments
15+
---
16+
17+
* *name*: Name of your user (**Required**)
18+
* *fullname*: Fullname of your user
19+
* *password*: Password for your user (**Required**)
20+
* *email*: Email for your user
21+
* *roles*: List of roles (**Required**)
22+
* *enabled*: Define wheter this user should be enabled (Default: `true`)
23+
* *state*: State of the role. `absent` to delete the user (Default: `present`)
24+
* *host*: API endpoint (**Required**)
25+
* *auth_user*: User to authenticate on the Elasticsearch API (**Required**)
26+
* *auth_pass*: Password for the given user (**Required**)
27+
* *verify_certs*: Verify certificates (Default: `true`)
28+
* *ca_certs*: Verify HTTPS connection by using ca certificate. Path to ca needs to be given
29+
30+
Example usage
31+
---
32+
```
33+
- name: Create elasticsearch user 'new-user1'
34+
netways.elasticstack.elasticsearch_user:
35+
name: new-user1
36+
fullname: New User 1
37+
password: changeMe321!
38+
email: [email protected]
39+
roles:
40+
- new-role
41+
- logstash-writer
42+
enabled: true
43+
state: present
44+
host: https://localhost:9200
45+
auth_user: elastic
46+
auth_pass: changeMe123!
47+
verify_certs: true
48+
ca_certs: /etc/elasticsearch/certs/http_ca.crt
49+
50+
- name: Create elasticsearch user 'new-user2'
51+
netways.elasticstack.elasticsearch_user:
52+
name: new-user2
53+
fullname: New User 2
54+
password: changeMe321!
55+
email: [email protected]
56+
roles:
57+
- new-role
58+
- logstash-writer
59+
enabled: true
60+
state: present
61+
host: https://localhost:9200
62+
auth_user: elastic
63+
auth_pass: changeMe123!
64+
verify_certs: false
65+
```

‎docs/role-elasticsearch.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ Role Variables
3232
* *elasticsearch_pamlimits*: Set pam_limits neccessary for Elasticsearch. (Default: `true`)
3333
* *elasticsearch_check_calculation*: End play in checks (Default: `false`)
3434
* *elasticsearch_network_host*: You can configure multipe network addresses where the networking is bind to. You can assign IP addresses or interfaces by their names. You can also use elasticsearch internal variabels as it set as default. Example: `"_ens190_,_local_"` (Default: `"_local_,"_site_"`) (Optional; if not defined `default` is used)
35-
35+
* *elasticsearch_api_host*: Hostname or IP elasticsearch is listening on. Only used for connection checks by ansible role. (Default: `localhost`)
3636
* *elasticsearch_extra_config*: You can set additional configuration in YAML-notation as you would write in the `elasaticsearch.yml`. Example:
3737

3838
```YAML
@@ -49,6 +49,10 @@ elasticsearch_extra_config:
4949
This variable activates a workaround to start on systems that have certain hardening measures active. See [Stackoverflow](https://stackoverflow.com/questions/47824643/unable-to-load-jna-native-support-library-elasticsearch-6-x/50371992#50371992) for details and logmessages to look for. **WARNING**: This will change your `/etc/sysconfig/elasticseach`or `/etc/default/elasticsearch` file and overwrite `ES_JAVA_OPTS`. See this [issue](https://github.com/netways/ansible-role-elasticsearch/issues/79) for details.
5050

5151
* *elasticsearch_jna_workaround*: Activate JNA workaround. (default: `false`)
52+
* *elasticsearch_ssl_verification_mode*: Defines how to verify the certificates presented by another party in the TLS connection
53+
* *elasticsearch_transport_port*: The port to bind for communication between nodes
54+
* *elasticsearch_seed_hosts*: Set elasticsearch seed hosts
55+
* *elasticsearch_security_enrollment*: Controls enrollment (of nodes and Kibana) to a local node that’s been autoconfigured for security.
5256

5357
These variables are identical over all our elastic related roles, hence the different naming schemes.
5458

‎molecule/elasticsearch_test_modules/converge.yml

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
# The workaround for arbitrarily named role directory is important because the git repo has one name and the role within it another
3+
# Found at: https://github.com/ansible-community/molecule/issues/1567#issuecomment-436876722
4+
- name: Converge
5+
collections:
6+
- netways.elasticstack
7+
hosts: all
8+
vars:
9+
elasticstack_full_stack: false
10+
elasticsearch_jna_workaround: true
11+
elasticsearch_disable_systemcallfilterchecks: true
12+
#elasticstack_release: "{{ lookup('env', 'ELASTIC_RELEASE') | int}}"
13+
elasticstack_release: 8
14+
elasticsearch_heap: "1"
15+
elasticstack_no_log: false
16+
tasks:
17+
- name: Include Elastics repos role
18+
ansible.builtin.include_role:
19+
name: repos
20+
- name: Include Elasticsearch
21+
ansible.builtin.include_role:
22+
name: elasticsearch
23+
24+
- name: Fetch Elastic password # noqa: risky-shell-pipe
25+
ansible.builtin.shell: >
26+
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
27+
grep "PASSWORD elastic" /usr/share/elasticsearch/initial_passwords |
28+
awk {' print $4 '}
29+
register: elasticstack_password
30+
changed_when: false
31+
32+
- name: Create elasticsearch role 'new-role'
33+
netways.elasticstack.elasticsearch_role:
34+
name: new-role1
35+
cluster:
36+
- manage_own_api_key
37+
- delegate_pki
38+
indicies:
39+
- names:
40+
- foobar321
41+
privileges:
42+
- read
43+
- write
44+
state: present
45+
host: https://localhost:9200
46+
auth_user: elastic
47+
auth_pass: "{{ elasticstack_password.stdout }}"
48+
verify_certs: false
49+
50+
- name: Create elasticsearch user 'new-user'
51+
netways.elasticstack.elasticsearch_user:
52+
name: new-user1
53+
fullname: New User
54+
password: changeMe123!
55+
email: [email protected]
56+
roles:
57+
- new-role1
58+
- logstash-writer
59+
enabled: true
60+
state: present
61+
host: https://localhost:9200
62+
auth_user: elastic
63+
auth_pass: "{{ elasticstack_password.stdout }}"
64+
verify_certs: false
65+
ca_certs: /etc/elasticsearch/certs/http_ca.crt

‎molecule/elasticsearch_test_modules/molecule.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
options:
5+
requirements-file: requirements.yml
6+
driver:
7+
name: docker
8+
platforms:
9+
- name: elasticsearch_default
10+
groups:
11+
- elasticsearch
12+
image: "geerlingguy/docker-${MOLECULE_DISTRO:-debian11}-ansible:latest"
13+
command: ${MOLECULE_DOCKER_COMMAND:-""}
14+
volumes:
15+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
16+
cgroupns_mode: host
17+
privileged: true
18+
pre_build_image: true
19+
provisioner:
20+
name: ansible
21+
env:
22+
ANSIBLE_VERBOSITY: 3
23+
verifier:
24+
name: ansible

‎molecule/elasticsearch_test_modules/prepare.yml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
- name: Prepare
3+
hosts: all
4+
tasks:
5+
- name: Install packages for Debian
6+
ansible.builtin.apt:
7+
name:
8+
- gpg
9+
- gpg-agent
10+
- procps
11+
- curl
12+
- iproute2
13+
- git
14+
- openssl
15+
- python3
16+
update_cache: yes
17+
18+
- name: Install python module dependencies
19+
ansible.builtin.pip:
20+
name: "{{ item }}"
21+
loop:
22+
- elasticsearch

‎molecule/elasticsearch_test_modules/requirements.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
collections:
3+
- community.general

‎plugins/module_utils/api.py

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# !/usr/bin/python3
2+
3+
# Copyright (c) 2024, Tobias Bauriedel <[email protected]>
4+
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or
5+
# https://www.gnu.org/licenses/gpl-3.0.txt)
6+
7+
from elasticsearch import Elasticsearch
8+
import ssl
9+
10+
class Api():
11+
def new_client_basic_auth(host, auth_user, auth_pass, ca_certs, verify_certs) -> Elasticsearch:
12+
ctx = ssl.create_default_context(cafile=ca_certs)
13+
ctx.check_hostname = False
14+
ctx.verify_mode = False
15+
return Elasticsearch(hosts=[host], basic_auth=(auth_user, auth_pass), ssl_context=ctx, verify_certs=verify_certs)

0 commit comments

Comments
 (0)