Allow disabling of Beats TLS explicitly

molecule/kibana_default/prepare.yml

@@ -8,6 +8,7 @@
           - gpg
           - curl
           - procps
+          - gpg-agent
         update_cache: yes
       when: ansible_os_family == "Debian"
     - name: Install git

roles/beats/defaults/main.yml

@@ -66,3 +66,7 @@ elastic_security: true
 elastic_ca_dir: /opt/es-ca
 elastic_ca_pass: PleaseChangeMe
 elastic_initial_passwords: /usr/share/elasticsearch/initial_passwords
+
+# Variables for debugging and development
+
+elastic_override_beats_tls: false

roles/beats/tasks/main.yml

@@ -11,6 +11,7 @@
     when:
     - elastic_security | bool
     - elastic_variant != "oss"
+    - not elastic_override_beats_tls | bool
 
   - name: Set elasticsearch_ca variable if not already done by user
     set_fact:

roles/logstash/defaults/main.yml

@@ -68,3 +68,7 @@ elastic_ca_pass: PleaseChangeMe
 elastic_release: 7
 elastic_variant: elastic
 elastic_security: true
+
+# Variables for debugging and development
+
+elastic_override_beats_tls: false

roles/logstash/tasks/main.yml

@@ -18,7 +18,9 @@
   - name: Activate TLS for Beats for full stack
     set_fact:
       logstash_beats_tls: true
-    when: logstash_beats_tls is undefined
+    when:
+      - logstash_beats_tls is undefined
+      - not elastic_override_beats_tls | bool
 
 - name: Set Elasticsearch hosts to localhost if no other information available
   set_fact: