configure-es.yml

---
# This file is meant to be also used by upgrade role

- name: Ensure snapshot folder exists
  file:
    path: "{{ specification.paths.repo }}/"
    state: directory
    owner: elasticsearch
    group: elasticsearch
    mode: u=rwx,go=

- name: Provide JVM configuration file
  template:
    backup: yes
    src: jvm.options.j2
    dest: /etc/elasticsearch/jvm.options
    owner: root
    group: elasticsearch
    mode: ug=rw,o=
  register: change_jvm_config
  vars:
    xmx: "{{ specification.jvm_options.Xmx }}"

- name: Generate certificates
  when: not is_upgrade_run  # in upgrade mode certs are required at early stage and should be already generated
  block:
    # Install requirements for Ansible certificate modules
    - include_role:
        name: certificate
        tasks_from: install-packages.yml

    - include_tasks: generate-certs.yml

- name: Provide Elasticsearch configuration file
  template:
    backup: yes
    src: elasticsearch.yml.j2
    dest: /etc/elasticsearch/elasticsearch.yml
    owner: root
    group: elasticsearch
    mode: ug=rw,o=
  register: change_config
  vars:
    node_cert_filename:
      http: >-
        {{ existing_es_config['opendistro_security.ssl.http.pemcert_filepath'] if (is_upgrade_run) else
           certificates.files.node.cert.filename }}
      transport: >-
        {{ existing_es_config['opendistro_security.ssl.transport.pemcert_filepath'] if (is_upgrade_run) else
           certificates.files.node.cert.filename }}
    node_key_filename:
      http: >-
        {{ existing_es_config['opendistro_security.ssl.http.pemkey_filepath'] if (is_upgrade_run) else
           certificates.files.node.key.filename }}
      transport: >-
        {{ existing_es_config['opendistro_security.ssl.transport.pemkey_filepath'] if (is_upgrade_run) else
           certificates.files.node.key.filename }}
    root_ca_cert_filename:
      http: >-
        {{ existing_es_config['opendistro_security.ssl.http.pemtrustedcas_filepath'] if (is_upgrade_run) else
           certificates.files.root_ca.cert.filename }}
      transport: >-
        {{ existing_es_config['opendistro_security.ssl.transport.pemtrustedcas_filepath'] if (is_upgrade_run) else
           certificates.files.root_ca.cert.filename }}
    _epiphany_subjects:
      admin: "{{ certificates.files.admin.cert.subject }}"
      node:  "{{ certificates.files.node.cert.subject }}"
    _epiphany_dn_attributes:
      admin: "{{ certificates.dn_attributes_order | intersect(_epiphany_subjects.admin.keys()) }}"
      node:  "{{ certificates.dn_attributes_order | intersect(_epiphany_subjects.node.keys()) }}"
    _epiphany_DNs:
      admin: >-
        {{ _epiphany_dn_attributes.admin | zip(_epiphany_dn_attributes.admin | map('extract', _epiphany_subjects.admin))
                                         | map('join','=') | join(',') }}
      node: >-
        {{ _epiphany_dn_attributes.node | zip(_epiphany_dn_attributes.node | map('extract', _epiphany_subjects.node))
                                        | map('join','=') | join(',') }}
    admin_dn: >-
      {{ existing_es_config['opendistro_security.authcz.admin_dn'] if (is_upgrade_run) else
         [ _epiphany_DNs.admin ] }}
    _epiphany_nodes_dn: >-
      {%- if groups[current_group_name] | length > 1 -%}
        {%- set nodes_to_iterate = ansible_play_hosts_all -%}
      {%- else -%}
        {%- set nodes_to_iterate = [ inventory_hostname ] -%}
      {%- endif -%}
      {%- for node in nodes_to_iterate -%}
        {%- if loop.first -%}[{%- endif -%}
          '{{ _epiphany_DNs.node.split(',') | map('regex_replace', '^CN=.+$', 'CN=' + hostvars[node].ansible_nodename) | join(',') }}'
        {%- if not loop.last -%},{%- else -%}]{%- endif -%}
      {%- endfor -%}
    nodes_dn: >-
      {{ existing_es_config['opendistro_security.nodes_dn'] if (is_upgrade_run) else
         _epiphany_nodes_dn }}
    opendistro_security_allow_unsafe_democertificates: "{{ certificates.files.demo.opendistro_security.allow_unsafe_democertificates }}"

    http_port:      "{{ is_upgrade_run | ternary(existing_es_config['http.port'],      ports.http) }}"
    transport_port: "{{ is_upgrade_run | ternary(existing_es_config['transport.port'], ports.transport) }}"

# When 'opendistro_security.allow_unsafe_democertificates' is set to 'false' all demo certificate files must be removed,
# otherwise elasticsearch service doesn't start.
# For apply mode, demo certificate files are removed based only on their names. For upgrade mode,
# public key fingerprints are checked to protect against unintentional deletion (what takes additional time).

- name: Remove demo certificate files
  include_tasks:
    file: "{{ is_upgrade_run | ternary('remove-known-demo-certs.yml', 'remove-demo-certs.yml') }}"
  when: not certificates.files.demo.opendistro_security.allow_unsafe_democertificates

- name: Include log4j patch
  include_tasks: patch-log4j.yml

- name: Restart elasticsearch service
  systemd:
    name: elasticsearch
    state: restarted
  register: restart_elasticsearch
  when: change_config.changed
    or log4j_patch.changed
    or change_jvm_config.changed
    or install_elasticsearch_package.changed
    or (install_opendistro_packages is defined and install_opendistro_packages.changed)

- name: Enable and start elasticsearch service
  systemd:
    name: elasticsearch
    state: started
    enabled: yes

- name: Change default users
  when: not is_upgrade_run
  block:
    - name: Wait for elasticsearch service to start up
      when: restart_elasticsearch.changed
      wait_for:
        port: 9200
        host: "{{ ansible_default_ipv4.address | default(ansible_all_ipv4_addresses[0]) }}"

    - name: Set helper facts
      set_fact:
        elasticsearch_endpoint: https://{{ ansible_default_ipv4.address }}:9200
      vars:
        uri_template: &uri
          client_cert: "{{ certificates.dirs.certs }}/{{ certificates.files.admin.cert.filename }}"
          client_key:  "{{ certificates.dirs.certs }}/{{ certificates.files.admin.key.filename }}"
          validate_certs: false
          body_format: json

    - name: Check if default admin user exists
      uri:
        <<: *uri
        url: "{{ elasticsearch_endpoint }}/_opendistro/_security/api/internalusers/admin"
        method: GET
        # 404 code is used there as someone can remove admin user on its own.
        status_code: [200, 404]
      register: admin_check_response
      until: admin_check_response is success
      retries: 60
      delay: 1
      run_once: true

    - name: Set OpenDistro admin password
      uri:
        <<: *uri
        url: "{{ elasticsearch_endpoint }}/_opendistro/_security/api/internalusers/"
        method: PATCH
        status_code: [200]
        body:
          - op: "replace"
            path: "/admin"
            value:
              password: "{{ specification.admin_password }}"
              reserved: "true"
              backend_roles:
                - "admin"
              description: "Admin user"
      register: uri_response
      until: uri_response is success
      retries: 15
      delay: 1
      run_once: true
      when: admin_check_response.status == 200

    - name: Check if default kibanaserver user exists
      uri:
        <<: *uri
        url: "{{ elasticsearch_endpoint }}/_opendistro/_security/api/internalusers/kibanaserver"
        method: GET
        status_code: [200]
      register: kibanaserver_check_response
      until: kibanaserver_check_response is success
      retries: 60
      delay: 1
      run_once: true
      when: specification.kibanaserver_user_active

    - name: Set OpenDistro kibanaserver password
      uri:
        <<: *uri
        url: "{{ elasticsearch_endpoint }}/_opendistro/_security/api/internalusers/"
        method: PATCH
        status_code: [200]
        body:
          - op: "replace"
            path: "/kibanaserver"
            value:
              password: "{{ specification.kibanaserver_password }}"
              reserved: "true"
              description: "Kibana server user"
      register: uri_response
      until: uri_response is success
      retries: 15
      delay: 1
      run_once: true
      when: specification.kibanaserver_user_active

    - name: Check if default logstash user exists
      uri:
        <<: *uri
        url: "{{ elasticsearch_endpoint }}/_opendistro/_security/api/internalusers/logstash"
        method: GET
        status_code: [200]
      register: logstash_check_response
      until: logstash_check_response is success
      retries: 60
      delay: 1
      run_once: true
      when: specification.logstash_user_active

    - name: Set OpenDistro logstash password
      uri:
        <<: *uri
        url: "{{ elasticsearch_endpoint }}/_opendistro/_security/api/internalusers/"
        method: PATCH
        status_code: [200]
        body:
          - op: "replace"
            path: "/logstash"
            value:
              password: "{{ specification.logstash_password }}"
              reserved: "true"
              backend_roles:
                - "logstash"
              description: "Logstash user"
      register: uri_response
      until: uri_response is success
      retries: 3
      delay: 5
      run_once: true
      when: specification.logstash_user_active

    - name: Remove OpenDistro demo users
      uri:
        <<: *uri
        url: "{{ elasticsearch_endpoint }}/_opendistro/_security/api/internalusers/{{ item }}"
        method: DELETE
        status_code: [200, 404]
      register: uri_response
      until: uri_response is success
      retries: 15
      delay: 1
      run_once: true
      loop: "{{ specification.demo_users_to_remove }}"