a879b74def
- Stop forcing es_xpack_features variable in order to let elasticsearch install default features described in http://localhost:9200/_xpack - Change xpack test scope to be able to test default xpack install - xpack scenario will test xpack install with default features - xpack upgrade scenario will fully test security feature - oss-to-xpack-upgrade will test installing only other specific features - Cleanup some duplicate serverspec tests - Remove `system_key`feature (deprecated in 5.6 and removed in 6.0 - [Breaking Changes 6.0.0](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/breaking-6.0.0-xes.html)) - Cleanup some ansible code (especially in `when` conditions)
64 lines
2.5 KiB
YAML
64 lines
2.5 KiB
YAML
---
|
|
#Security specific configuration done here
|
|
|
|
#TODO: 1. Skip users with no password defined or error 2. Passwords | length > 6
|
|
|
|
#Ensure x-pack conf directory is created if necessary
|
|
- name: Ensure x-pack conf directory exists (file)
|
|
file: path={{ conf_dir }}{{ es_xpack_conf_subdir }} state=directory owner={{ es_user }} group={{ es_group }}
|
|
changed_when: False
|
|
when: (es_users is defined and es_users.file is defined) or (es_roles is defined and es_roles.file is defined) or (es_role_mapping is defined)
|
|
|
|
#-----------------------------Create Bootstrap User-----------------------------------
|
|
### START BLOCK elasticsearch keystore ###
|
|
- name: create the elasticsearch keystore
|
|
block:
|
|
- name: create the keystore if it doesn't exist yet
|
|
become: yes
|
|
command: >
|
|
{{es_home}}/bin/elasticsearch-keystore create
|
|
args:
|
|
creates: "{{ conf_dir }}/elasticsearch.keystore"
|
|
environment:
|
|
ES_PATH_CONF: "{{ conf_dir }}"
|
|
|
|
- name: Check if bootstrap password is set
|
|
become: yes
|
|
command: >
|
|
{{es_home}}/bin/elasticsearch-keystore list
|
|
register: list_keystore
|
|
changed_when: False
|
|
environment:
|
|
ES_PATH_CONF: "{{ conf_dir }}"
|
|
check_mode: no
|
|
|
|
- name: Create Bootstrap password for elastic user
|
|
become: yes
|
|
shell: echo "{{es_api_basic_auth_password}}" | {{es_home}}/bin/elasticsearch-keystore add -x 'bootstrap.password'
|
|
when:
|
|
- es_api_basic_auth_username is defined and list_keystore is defined and es_api_basic_auth_username == 'elastic' and 'bootstrap.password' not in list_keystore.stdout_lines
|
|
environment:
|
|
ES_PATH_CONF: "{{ conf_dir }}"
|
|
no_log: true
|
|
### END BLOCK elasticsearch keystore ###
|
|
|
|
#-----------------------------FILE BASED REALM----------------------------------------
|
|
|
|
- include: elasticsearch-security-file.yml
|
|
when: (es_users is defined and es_users.file is defined) or (es_roles is defined and es_roles.file is defined)
|
|
|
|
#-----------------------------ROLE MAPPING ----------------------------------------
|
|
|
|
#Copy Roles files
|
|
- name: Copy role_mapping.yml File for Instance
|
|
become: yes
|
|
template: src=security/role_mapping.yml.j2 dest={{conf_dir}}{{es_xpack_conf_subdir}}/role_mapping.yml owner={{ es_user }} group={{ es_group }} mode=0644 force=yes
|
|
when: es_role_mapping is defined
|
|
|
|
#------------------------------------------------------------------------------------
|
|
|
|
#Ensure security conf directory is created
|
|
- name: Ensure security conf directory exists
|
|
become: yes
|
|
file: path={{ conf_dir }}/security state=directory owner={{ es_user }} group={{ es_group }}
|
|
changed_when: False
|