diff --git a/docs/getting-started.md b/docs/getting-started.md index 320e757f..4a010af3 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -61,3 +61,27 @@ Every role got its own set of variables, in addition a few variables are useable * *elasticstack_release*: Major release version of Elastic stack to configure. (default: `7`) * *elasticstack_variant*: Variant of the stack to install. Valid values: `elastic` or `oss`. (default: `elastic`) + +Tags +----------- + +As of the beginning of now, we introduce the usage of tags in the role as well for quicker and more precise control of the installs. +More Info on the usable tags can be found in the respective documentation of the role part. + +As of now *Beats*,*Elasticsearch*,*Kibana* and *Logstash* have tags available for usage. + +Most tags can be used in the role the following way: + +``` +- name: Playbook + hosts: some_host_pattern + collections: + - netways.elasticstack + vars: + component_install_tags: "tag1, tag2, tag3" + tasks: + - name: install elastic component + import_role: + name: netways.elasticstack.logstash + tags: "{{ component_install_tags }}" +``` diff --git a/roles/beats/tasks/auditbeat.yml b/roles/beats/tasks/auditbeat.yml index 3db33713..f79c7841 100644 --- a/roles/beats/tasks/auditbeat.yml +++ b/roles/beats/tasks/auditbeat.yml @@ -10,6 +10,9 @@ string ) if (elasticstack_version is defined and elasticstack_version | length > 0)) | replace(' ', '') }} + tags: + - auditbeat + - name - name: Install Auditbeat - rpm - full stack ansible.builtin.package: @@ -22,6 +25,9 @@ when: - ansible_os_family == "RedHat" - elasticstack_full_stack | bool + tags: + - auditbeat + - rpm - name: Install Auditbeat - rpm - standalone ansible.builtin.package: @@ -32,6 +38,10 @@ when: - ansible_os_family == "RedHat" - not elasticstack_full_stack | bool + tags: + - auditbeat + - standalone + - rpm - name: Install Auditbeat - deb ansible.builtin.package: @@ -41,6 +51,9 @@ - Restart Auditbeat when: - ansible_os_family == "Debian" + tags: + - auditbeat + - deb - name: Configure Auditbeat ansible.builtin.template: @@ -68,6 +81,9 @@ when: - beats_auditbeat_setup | bool - beats_auditbeat_output == "elasticsearch" + tags: + - auditbeat + - setup - name: Start Auditbeat ansible.builtin.service: @@ -75,3 +91,6 @@ state: started enabled: true when: beats_auditbeat_enable | bool + tags: + - auditbeat + - start diff --git a/roles/elasticstack/defaults/main.yml b/roles/elasticstack/defaults/main.yml index 4aaf3291..5cf9fec4 100644 --- a/roles/elasticstack/defaults/main.yml +++ b/roles/elasticstack/defaults/main.yml @@ -26,6 +26,7 @@ elasticstack_security: true elasticstack_variant: elastic elasticstack_force_pip: false elasticstack_manage_pip: false +elasticstack_encryption_key_size: 64 # for debugging only elasticstack_no_log: true diff --git a/roles/kibana/defaults/main.yml b/roles/kibana/defaults/main.yml index acbfde6f..3e48b08d 100644 --- a/roles/kibana/defaults/main.yml +++ b/roles/kibana/defaults/main.yml @@ -14,6 +14,7 @@ kibana_cert_validity_period: 1095 kibana_cert_will_expire_soon: false kibana_sniff_on_start: false kibana_sniff_on_connection_fault: false +kibana_custom_default_index: 979390d0-3def-11ea-ad1f-5b09c073c7d3 kibana_manage_logging: false kibana_logpath: /var/log/kibana diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml new file mode 100644 index 00000000..56cdbaaa --- /dev/null +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -0,0 +1,16 @@ +--- + +- name: Set Custom Default Index + ansible.builtin.uri: + url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings' + method: POST + body: + changes: + defaultIndex: '{{ kibana_custom_default_index }}' + body_format: json + headers: + kbn-version: 8.19.11 + Content-Type: application/json + register: result +- ansible.builtin.debug: + msg: "setting new custom Index to {{ kibana_custom_default_index }}" diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index 350d46b7..3a5d32c0 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -1,5 +1,15 @@ --- +- name: Ensure encryption key exists + ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/encryption_key" + register: encryption_key_exists + +- name: Ensure saved encryption key exists + ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + register: savedobjects_encryption_key_exists + - name: Ensure kibana certificate exists ansible.builtin.stat: path: "/etc/kibana/certs/{{ ansible_hostname }}-kibana.p12" @@ -125,11 +135,17 @@ - name: Generate encryption key # noqa: risky-shell-pipe ansible.builtin.shell: > if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi; - openssl rand -base64 36 > + openssl rand -base64 {{ elasticstack_encryption_key_size }} > {{ elasticstack_ca_dir }}/encryption_key changed_when: false args: creates: "{{ elasticstack_ca_dir }}/encryption_key" + - ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/encryption_key" + register: encryption_key_exists + - ansible.builtin.debug: + msg: "File exists..." + when: encryption_key_exists.stat.exists - name: Fetch encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/encryption_key @@ -139,12 +155,17 @@ - name: Generate saved objects encryption key # noqa: risky-shell-pipe ansible.builtin.shell: > if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi; - openssl rand - -base64 36 > + openssl rand -base64 {{ elasticstack_encryption_key_size }} > {{ elasticstack_ca_dir }}/savedobjects_encryption_key changed_when: false args: creates: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + - ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + register: savedobjects_encryption_key + - ansible.builtin.debug: + msg: "File exists..." + when: savedobjects_encryption_key.stat.exists - name: Fetch saved objects encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/savedobjects_encryption_key