santerikainulainen/ansible-role-elasticsearch
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add option to forgo autogenerated SSL config

Browse source
This commit is contained in:
pemontto 2019-11-15 12:24:29 +00:00
parent 9496192bc3
commit 8156ab4821
No known key found for this signature in database
GPG key ID: EDCB93C3DA1B5DA9
3 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/ssl-tls-setup.md
View file

@ -2,6 +2,8 @@
The role allows configuring HTTP and transport layer SSL/TLS for the cluster. You will need to generate and provide your own PKCS12 or PEM encoded certificates as described in [Encrypting communications in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/configuring-tls.html#configuring-tls).
If you don't want this role to add autogenerated SSL configuration to elasticsearch.yml set `es_enable_auto_ssl_configuration` to `false` (default: `true`).
The following should be configured to ensure a security-enabled cluster successfully forms:
* `es_enable_http_ssl` Default `false`. Setting this to `true` will enable HTTP client SSL/TLS
@ -38,6 +40,7 @@ $ bin/elasticsearch-certutil cert --ca ./my-ca.p12 --out ./my-keystore.p12 --pas
## Additional optional SSL/TLS configuration
* `es_enable_auto_ssl_configuration` Default `true`. Whether this role should add automatically generated SSL config to elasticsearch.yml.
* `es_ssl_certificate_path` Default `{{ es_conf_dir }}/certs`. The location where certificates should be stored on the ES node.
* `es_ssl_verification_mode` Default `certificate`. See [SSL verification_mode](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html#ssl-tls-settings) for options.
* `es_ssl_certificate_authority` PEM encoded certificate file that should be trusted.