[afeefghannam89]

elasticsearch_role and elasticsearch_user need version 8 of the elasticsearch Python library on the host they run on. The elasticstack role installed it on every host, pip first and the distribution package if pip failed. A fresh host has no pip, so it got the distribution package, version 7 on Ubuntu 22.04 and EL 9, and creating the logstash writer role failed.

The logstash role now installs the library where the two modules run, on the Logstash host, and only when logstash_create_role or logstash_create_user is true. It goes into its own virtual environment, /opt/netways-elasticstack/venv, created with the Python that Ansible uses on that host, and the two tasks run with that interpreter. The system Python stays untouched. The distribution package is no option: of the current releases only Debian 13 ships 8.x, Ubuntu 22.04, Ubuntu 24.04 and EPEL 9 ship 7.x, and Ubuntu 26.04 ships 9.x, which does not work with Elasticsearch 8.

Besides python3-venv on Debian and Ubuntu the role installs python3-packaging. The pip module stops without packaging or setuptools in the system Python, and a fresh host has neither.

The pip/package fallback is removed from the elasticstack role, and with it elasticstack_manage_pip and elasticstack_force_pip. Setups that set them get no error, the values just have no effect anymore. python3-cryptography stays, the certificate checks need it on every host.

The README listed the library under the control node and said that no version works with Elasticsearch 8 and 9. It now lists it under the target hosts, and version 8 works with both. The logstash README says that the Logstash host needs access to PyPI or to a pip mirror.

The full stack Molecule scenario removes pip, packaging and setuptools from its containers and checks that they are gone, so it runs like a fresh host. The images ship all three, which is why CI never saw the problem. elasticsearch<9 is dropped from requirements-test.txt, the modules run in the containers and not on the runner.

Tested in containers with ansible-core 2.18 and 2.21 on Ubuntu 22.04, Debian 13 and Rocky 9: the first run creates the venv with elasticsearch 8.19.3, the second changes nothing, and elasticsearch_role loads the library from the venv.

https://github.com/elastic/elasticsearch-py#compatibility

Closes #562