/
enable-tls.yml
118 lines (99 loc) · 3.75 KB
/
enable-tls.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
---
# OPS file to enable secure node-to-node communications across Elasticsearch cluster
# Please mind to disable post-start when you run this OPS first time
#
# elasticsearch_master
- type: replace
path: /instance_groups/name=elasticsearch_master/jobs/name=elasticsearch/properties/elasticsearch/http_host?
value: 127.0.0.1
- type: replace
path: /instance_groups/name=elasticsearch_master/jobs/name=elasticsearch/properties/elasticsearch/admin?
value:
dn: CN=admin.elasticsearch.internal
- type: replace
path: /instance_groups/name=elasticsearch_master/jobs/name=elasticsearch/properties/elasticsearch/node/ssl?
value: &tls_properties
dn: "CN=node.elasticsearch.internal"
ca: ((elasticsearch_node.ca))
certificate: ((elasticsearch_node.certificate))
private_key: ((elasticsearch_node.private_key))
- type: replace
path: /instance_groups/name=elasticsearch_master/jobs/name=elasticsearch/properties/elasticsearch/plugins?
value: &tls_plugin
- opendistro-security: "https://logsearch-tile.s3.amazonaws.com/opendistro_security-1.6.0.0-noauth.zip"
# elasticsearch_data
- type: replace
path: /instance_groups/name=elasticsearch_data/jobs/name=elasticsearch/properties/elasticsearch/http_host?
value: 127.0.0.1
- type: replace
path: /instance_groups/name=elasticsearch_data/jobs/name=elasticsearch/properties/elasticsearch/admin?
value:
dn: CN=admin.elasticsearch.internal
certificate: ((elasticsearch_admin.certificate))
private_key: ((elasticsearch_admin.private_key))
- type: replace
path: /instance_groups/name=elasticsearch_data/jobs/name=elasticsearch/properties/elasticsearch/node/ssl?
value: *tls_properties
- type: replace
path: /instance_groups/name=elasticsearch_data/jobs/name=elasticsearch/properties/elasticsearch/plugins?
value: *tls_plugin
# kibana
- type: replace
path: /instance_groups/name=kibana/jobs/name=elasticsearch/properties?/elasticsearch?/http_host?
value: 127.0.0.1
- type: replace
path: /instance_groups/name=kibana/jobs/name=elasticsearch/properties/elasticsearch/node?/ssl?
value: *tls_properties
- type: replace
path: /instance_groups/name=kibana/jobs/name=elasticsearch/properties/elasticsearch/plugins?
value: *tls_plugin
# ingestor
- type: replace
path: /instance_groups/name=ingestor/jobs/name=elasticsearch/properties?/elasticsearch?/http_host?
value: 127.0.0.1
- type: replace
path: /instance_groups/name=ingestor/jobs/name=elasticsearch/properties/elasticsearch/node?/ssl?
value: *tls_properties
- type: replace
path: /instance_groups/name=ingestor/jobs/name=elasticsearch/properties/elasticsearch/plugins?
value: *tls_plugin
# maintenance
- type: replace
path: /instance_groups/name=maintenance/jobs/name=elasticsearch/properties?/elasticsearch?/http_host?
value: 127.0.0.1
- type: replace
path: /instance_groups/name=maintenance/jobs/name=elasticsearch/properties/elasticsearch/node?/ssl?
value: *tls_properties
- type: replace
path: /instance_groups/name=maintenance/jobs/name=elasticsearch/properties/elasticsearch/plugins?
value: *tls_plugin
# variables
- type: replace
path: /variables/name=elasticsearch_ca?
value:
name: elasticsearch_ca
type: certificate
options:
is_ca: true
common_name: elasticsearch-ca
- type: replace
path: /variables/name=elasticsearch_node?
value:
name: elasticsearch_node
type: certificate
options:
ca: elasticsearch_ca
common_name: node.elasticsearch.internal
extended_key_usage:
- server_auth
- client_auth
- type: replace
path: /variables/name=elasticsearch_admin?
value:
name: elasticsearch_admin
type: certificate
options:
ca: elasticsearch_ca
common_name: admin.elasticsearch.internal
extended_key_usage:
- client_auth