Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #20357 to 7.x: Add template for ssl config reference settings #20678

Merged
merged 1 commit into from
Aug 24, 2020
Merged

Cherry-pick #20357 to 7.x: Add template for ssl config reference settings #20678

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 48 additions & 27 deletions auditbeat/auditbeat.reference.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -605,11 +605,11 @@ output.elasticsearch:
# Resolve names locally when using a proxy server. Defaults to false.
#proxy_use_local_resolver: false

# Enable SSL support. SSL is automatically enabled if any SSL setting is set.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -618,7 +618,6 @@ output.elasticsearch:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# Optional SSL configuration options. SSL is off by default.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

Expand All @@ -628,7 +627,7 @@ output.elasticsearch:
# Client certificate key
#ssl.key: "/etc/pki/client/cert.key"

# Optional passphrase for decrypting the Certificate Key.
# Optional passphrase for decrypting the certificate key.
#ssl.key_passphrase: ''

# Configure cipher suites to be used for SSL connections
Expand Down Expand Up @@ -791,15 +790,11 @@ output.elasticsearch:
# purposes. The default is "beats".
#client_id: beats

# Enable SSL support. SSL is automatically enabled if any SSL setting is set.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Optional SSL configuration options. SSL is off by default.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -808,13 +803,16 @@ output.elasticsearch:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key
# Client certificate key
#ssl.key: "/etc/pki/client/cert.key"

# Optional passphrase for decrypting the Certificate Key.
# Optional passphrase for decrypting the certificate key.
#ssl.key_passphrase: ''

# Configure cipher suites to be used for SSL connections
Expand All @@ -827,6 +825,12 @@ output.elasticsearch:
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""

# Enable Kerberos support. Kerberos is automatically enabled if any Kerberos setting is set.
#kerberos.enabled: true

Expand Down Expand Up @@ -934,11 +938,11 @@ output.elasticsearch:
# occurs on the proxy server.
#proxy_use_local_resolver: false

# Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -947,29 +951,35 @@ output.elasticsearch:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# Optional SSL configuration options. SSL is off by default.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key
# Client certificate key
#ssl.key: "/etc/pki/client/cert.key"

# Optional passphrase for decrypting the Certificate Key.
# Optional passphrase for decrypting the certificate key.
#ssl.key_passphrase: ''

# Configure cipher suites to be used for SSL connections
#ssl.cipher_suites: []

# Configure curve types for ECDHE based cipher suites
# Configure curve types for ECDHE-based cipher suites
#ssl.curve_types: []

# Configure what types of renegotiation are supported. Valid options are
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""


# -------------------------------- File Output ---------------------------------
#output.file:
# Boolean flag to enable or disable the output module.
Expand Down Expand Up @@ -1205,15 +1215,11 @@ setup.kibana:
# Optional Kibana space ID.
#space.id: ""

# Custom HTTP headers to add to each request
#headers:
# X-My-Header: Contents of the header

# Use SSL settings for HTTPS. Default is true.
# Use SSL settings for HTTPS.
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -1222,7 +1228,6 @@ setup.kibana:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# SSL configuration. The default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

Expand All @@ -1241,6 +1246,17 @@ setup.kibana:
# Configure curve types for ECDHE-based cipher suites
#ssl.curve_types: []

# Configure what types of renegotiation are supported. Valid options are
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""


# ================================== Logging ===================================

# There are four options for the log output: file, stderr, syslog, eventlog
Expand Down Expand Up @@ -1392,7 +1408,7 @@ logging.files:
#ssl.enabled: true

# Configure SSL verification mode. If `none` is configured, all server hosts
# and certificates will be accepted. In this mode, SSL based connections are
# and certificates will be accepted. In this mode, SSL-based connections are
# susceptible to man-in-the-middle attacks. Use only for testing. Default is
# `full`.
#ssl.verification_mode: full
Expand All @@ -1401,7 +1417,6 @@ logging.files:
# up to 1.3 are enabled.
#ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

# SSL configuration. The default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

Expand All @@ -1424,6 +1439,12 @@ logging.files:
# never, once, and freely. Default is never.
#ssl.renegotiation: never

# Configure a pin that can be used to do extra validation of the verified certificate chain,
# this allow you to ensure that a specific certificate is used to validate the chain of trust.
#
# The pin is a base64 encoded string of the SHA-256 fingerprint.
#ssl.ca_sha256: ""

# Enable Kerberos support. Kerberos is automatically enabled if any Kerberos setting is set.
#kerberos.enabled: true

Expand Down
24 changes: 23 additions & 1 deletion dev-tools/mage/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,12 @@
package mage

import (
"bytes"
"fmt"
"io/ioutil"
"os"
"path/filepath"
"regexp"
"sort"
"strings"
"text/template"
Expand Down Expand Up @@ -160,14 +162,26 @@ func makeConfigTemplate(destination string, mode os.FileMode, confParams ConfigF
"ExcludeDashboards": false,
}
params = joinMaps(params, confParams.ExtraVars, tmplParams)
tmpl := template.New("config").Option("missingkey=error")
funcs := joinMaps(FuncMap, template.FuncMap{
"header": header,
"subheader": subheader,
"indent": indent,
// include is necessary because you cannot pipe 'template' to a function
// since 'template' is an action. This allows you to include a
// template and indent it (e.g. {{ include "x.tmpl" . | indent 4 }}).
"include": func(name string, data interface{}) (string, error) {
buf := bytes.NewBuffer(nil)
if err := tmpl.ExecuteTemplate(buf, name, data); err != nil {
return "", err
}
return buf.String(), nil
},
})
tmpl = tmpl.Funcs(funcs)

fmt.Printf(">> Building %v for %v/%v\n", destination, params["GOOS"], params["GOARCH"])
var err error
tmpl := template.New("config").Option("missingkey=error").Funcs(funcs)
for _, templateGlob := range confParams.Templates {
if tmpl, err = tmpl.ParseGlob(templateGlob); err != nil {
return errors.Wrapf(err, "failed to parse config templates in %q", templateGlob)
Expand Down Expand Up @@ -205,6 +219,14 @@ func subheader(title string) string {
return makeHeading(title, "-")
}

var nonWhitespaceRegex = regexp.MustCompile(`(?m)(^.*\S.*$)`)

// indent pads all non-whitespace lines with the number of spaces specified.
func indent(spaces int, content string) string {
pad := strings.Repeat(" ", spaces)
return nonWhitespaceRegex.ReplaceAllString(content, pad+"$1")
}

func makeHeading(title, separator string) string {
const line = 80
leftEquals := (line - len("# ") - len(title) - 2*len(" ")) / 2
Expand Down
Loading