Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes for Elasticsearch issue #184 - Testing Elasticsearch functionality when network.host is not localhost. #212

Merged
merged 3 commits into from
Jul 24, 2019
Merged

Fixes for Elasticsearch issue #184 - Testing Elasticsearch functionality when network.host is not localhost. #212

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8575aec
fixed the problem by adding a new variable to test the connectivity t…
rshad Jul 23, 2019
fcb584a
fixed linting errors by refactoring ansible tests and change a variab…
rshad Jul 24, 2019
125b211
changed elasticssearch: network.host from 0.0.0.0 to 127.0.0.1
rshad Jul 24, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions molecule/elasticsearch/molecule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,12 @@ platforms:
command: /sbin/init
ulimits:
- nofile:262144:262144
# - name: trusty
# image: ubuntu:trusty
# privileged: true
# memory_reservation: 2048m
# ulimits:
# - nofile:262144:262144
#- name: trusty
#image: ubuntu:trusty
#privileged: true
#memory_reservation: 2048m
#ulimits:
#- nofile:262144:262144
- name: centos6
image: centos:6
privileged: true
Expand Down
1 change: 1 addition & 0 deletions roles/elastic-stack/ansible-elasticsearch/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ elasticsearch_cluster_name: wazuh
elasticsearch_node_name: node-1
elasticsearch_http_port: 9200
elasticsearch_network_host: 127.0.0.1
elasticsearch_host: 127.0.0.1
elasticsearch_jvm_xms: null
elastic_stack_version: 7.2.0
single_node: false
Expand Down
2 changes: 1 addition & 1 deletion roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@

- name: Install Oracle Java 8
become: true
apt: name=openjdk-8-jdk state=latest
apt: name=openjdk-8-jdk
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is the state=latest statement not needed anymore?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @manuasir,

This change came as result to Ansible-Linting error:

Package installs should not use latest reported in this issue: ansible/ansible-lint#479

This change was made in this commit: ansible/ansible-lint@f5fcee4#diff-42252eea388ddb7d54414f584e9ebc78.

Sincerely, and like many other users facing this issue, I think this restriction has no logic due to the need to upgrade a package to its latest version without worrying about specifying a determined one.

Anyway, I think apt will take the last version by default, so no worries.

Kind regards,

Rshad


when:
- ansible_distribution == "Ubuntu"
Expand Down
77 changes: 47 additions & 30 deletions roles/elastic-stack/ansible-elasticsearch/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,15 +65,15 @@

- name: Check if certificate exists locally
stat:
path: "{{node_certs_destination}}/{{ elasticsearch_node_name }}.crt"
path: "{{ node_certs_destination }}/{{ elasticsearch_node_name }}.crt"
register: certificate_file_exists
when:
- elasticsearch_xpack_security

- name: Write the instances.yml file in the selected node (force = no)
template:
src: instances.yml.j2
dest: "{{node_certs_source}}/instances.yml"
dest: "{{ node_certs_source }}/instances.yml"
force: no
register: instances_file_exists
tags:
Expand All @@ -86,23 +86,25 @@

- name: Update instances.yml status after generation
stat:
path: "{{node_certs_source}}/instances.yml"
path: "{{ node_certs_source }}/instances.yml"
register: instances_file_exists
when:
when:
- node_certs_generator
- elasticsearch_xpack_security

- name: Check if the certificates ZIP file exists
stat:
path: "{{node_certs_source}}/certs.zip"
path: "{{ node_certs_source }}/certs.zip"
register: xpack_certs_zip
when:
when:
- node_certs_generator
- elasticsearch_xpack_security

- name: Generating certificates for Elasticsearch security
shell: "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in {{node_certs_source}}/instances.yml --out {{node_certs_source}}/certs.zip"
when:
command: >-
"/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in
{{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip"
when:
- node_certs_generator
- elasticsearch_xpack_security
- not xpack_certs_zip.stat.exists
Expand All @@ -112,10 +114,10 @@

- name: Unzip generated certs.zip
unarchive:
src: "{{node_certs_source}}/certs.zip"
dest: "{{node_certs_source}}/"
src: "{{ node_certs_source }}/certs.zip"
dest: "{{ node_certs_source }}/"
remote_src: yes
when:
when:
- node_certs_generator
- elasticsearch_xpack_security
- certs_file_generated is defined
Expand All @@ -124,35 +126,39 @@

- name: Copy key & certificate files in generator node (locally)
synchronize:
src: "{{node_certs_source}}/{{elasticsearch_node_name}}/"
dest: "{{node_certs_destination}}/"
src: "{{ node_certs_source }}/{{ elasticsearch_node_name }}/"
dest: "{{ node_certs_destination }}/"
delegate_to: "{{ node_certs_generator_ip }}"
when:
when:
- node_certs_generator
- elasticsearch_xpack_security
tags: xpack-security

- name: Copy ca certificate file in generator node (locally)
synchronize:
src: "{{node_certs_source}}/ca/"
dest: "{{node_certs_destination}}/"
src: "{{ node_certs_source }}/ca/"
dest: "{{ node_certs_destination }}/"
delegate_to: "{{ node_certs_generator_ip }}"
register: check_certs_permissions
when:
when:
- node_certs_generator
- elasticsearch_xpack_security
tags: xpack-security

- name: Importing key & certificate files from generator node
shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/{{elasticsearch_node_name}}/ {{node_certs_destination}}/"
command: >-
{{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
{{ node_certs_source }}/{{ elasticsearch_node_name }}/ {{ node_certs_destination }}/
when:
- not node_certs_generator
- elasticsearch_xpack_security
- not certificate_file_exists.stat.exists
tags: xpack-security

- name: Importing ca certificate file from generator node
shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/ca/ {{node_certs_destination}}/"
- name: Importing ca certificate file from generator node
command: >-
{{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
{{ node_certs_source }}/ca/ {{ node_certs_destination }}/
when:
- not node_certs_generator
- elasticsearch_xpack_security
Expand All @@ -161,23 +167,32 @@
tags: xpack-security

- name: Ensuring certificates folder owner
shell: "chown -R elasticsearch: {{node_certs_destination}}/"
file:
path: "{{ node_certs_destination }}/"
state: directory
recurse: yes
owner: elasticsearch
group: elasticsearch
when:
- check_certs_permissions is defined
- elasticsearch_xpack_security
tags: xpack-security

- name: Ensuring certificates folder owner
shell: "chmod -R 770 {{node_certs_destination}}/"
file:
path: "{{ node_certs_destination }}/"
mode: '0770'
recurse: yes
when:
- check_certs_permissions is defined
- elasticsearch_xpack_security
tags: xpack-security


- name: Remove generated certs file
shell: /bin/rm -f {{node_certs_source}}/certs.zip*
when:
file:
state: absent
path: "{{ node_certs_source }}/certs.zip*"
when:
- node_certs_generator
- elasticsearch_xpack_security
tags: xpack-security
Expand All @@ -193,10 +208,12 @@
tags: configure

- name: Set elasticsearch bootstrap password
shell: "echo '{{elasticsearch_xpack_security_password}}' | {{node_certs_source}}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
shell: |
set -o pipefail
"echo '{{ elasticsearch_xpack_security_password }}' | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
when:
- elasticsearch_xpack_security

- name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf
lineinfile:
path: /etc/security/limits.conf
Expand Down Expand Up @@ -242,7 +259,7 @@
state: started

- name: Make sure Elasticsearch is running before proceeding
wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=300
wait_for: host={{ elasticsearch_host }} port={{ elasticsearch_http_port }} delay=3 timeout=400
tags:
- configure
- init
Expand All @@ -252,7 +269,7 @@
url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh"
method: GET
status_code: 200, 404
when:
when:
- elasticsearch_bootstrap_node or single_node
- not elasticsearch_xpack_security
poll: 30
Expand All @@ -267,7 +284,7 @@
status_code: 200
body_format: json
body: "{{ lookup('template','wazuh-elastic7-template-alerts.json.j2') }}"
when:
when:
- wazuh_alerts_template_exits.status is defined
- wazuh_alerts_template_exits.status != 200
- not elasticsearch_xpack_security
Expand Down