From e2b7d6ea42107f128cb12383d2898df2c1b8d1f7 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 11:22:37 +0100 Subject: [PATCH 01/11] improve encryption key handling and adjustable encryption key size, also output if existing encryption keys are found --- roles/elasticstack/defaults/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/elasticstack/defaults/main.yml b/roles/elasticstack/defaults/main.yml index ee14ca30..819934c0 100644 --- a/roles/elasticstack/defaults/main.yml +++ b/roles/elasticstack/defaults/main.yml @@ -25,6 +25,7 @@ elasticstack_security: true elasticstack_variant: elastic elasticstack_force_pip: false elasticstack_manage_pip: false +elasticstack_encryption_key_size: 64 # for debugging only elasticstack_no_log: true From 93897fb964d5d3a25a10a8a501465af598d9a418 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 12:09:57 +0100 Subject: [PATCH 02/11] implemented checks if encryption keys already exist --- roles/kibana/tasks/kibana-security.yml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index db4479ed..40d226fa 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -1,5 +1,15 @@ --- +- name: Ensure encryption key exists + ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/encryption_key" + register: encryption_key_exists + +- name: Ensure saved encryption key exists + ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + register: savedobjects_encryption_key_exists + - name: Ensure kibana certificate exists ansible.builtin.stat: path: "/etc/kibana/certs/{{ ansible_hostname }}-kibana.p12" @@ -125,11 +135,14 @@ - name: Generate encryption key # noqa: risky-shell-pipe ansible.builtin.shell: > if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi; - openssl rand -base64 36 > + openssl rand -base64 {{ elasticstack_encryption_key_size }} > {{ elasticstack_ca_dir }}/encryption_key changed_when: false args: creates: "{{ elasticstack_ca_dir }}/encryption_key" + - debug: + msg: "File exists..." + when: encryption_key_exists.stat.exits - name: Fetch encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/encryption_key @@ -139,12 +152,14 @@ - name: Generate saved objects encryption key # noqa: risky-shell-pipe ansible.builtin.shell: > if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi; - openssl rand - -base64 36 > + openssl rand -base64 {{ elasticstack_encryption_key_size }} > {{ elasticstack_ca_dir }}/savedobjects_encryption_key changed_when: false args: creates: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + - debug: + msg: "File exists..." + when: savedobjects_encryption_key_exists.stat.exits - name: Fetch saved objects encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/savedobjects_encryption_key From d63b1c2782e65bedf317e4ec27bb47ff0d5be94f Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 14:19:36 +0100 Subject: [PATCH 03/11] removed trailing spaces for lint --- roles/kibana/tasks/kibana-security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index 40d226fa..3851b2f9 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -8,7 +8,7 @@ - name: Ensure saved encryption key exists ansible.builtin.stat: path: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" - register: savedobjects_encryption_key_exists + register: savedobjects_encryption_key_exists - name: Ensure kibana certificate exists ansible.builtin.stat: @@ -142,7 +142,7 @@ creates: "{{ elasticstack_ca_dir }}/encryption_key" - debug: msg: "File exists..." - when: encryption_key_exists.stat.exits + when: encryption_key_exists.stat.exits - name: Fetch encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/encryption_key From 817f79e1b9db346ad12f7cc2ece8bf61e5ff86eb Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 15:29:44 +0100 Subject: [PATCH 04/11] Added seperate Task for setting new default index and introduced variable for index UUID --- roles/kibana/defaults/main.yml | 1 + roles/kibana/tasks/kibana-default-index.yml | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 roles/kibana/tasks/kibana-default-index.yml diff --git a/roles/kibana/defaults/main.yml b/roles/kibana/defaults/main.yml index 725d70f5..5e981cac 100644 --- a/roles/kibana/defaults/main.yml +++ b/roles/kibana/defaults/main.yml @@ -14,6 +14,7 @@ kibana_cert_validity_period: 1095 kibana_cert_will_expire_soon: false kibana_sniff_on_start: false kibana_sniff_on_connection_fault: false +kibana_custom_default_index: 979390d0-3def-11ea-ad1f-5b09c073c7d3 kibana_freshstart: changed: false diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml new file mode 100644 index 00000000..c7f92cf9 --- /dev/null +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -0,0 +1,16 @@ +--- + +- name: Set Custom Default Index + uri: + url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings' + method: POST + body: + changes: + defaultIndex: {{ kibana_custom_default_index }} + body_format: json + headers: + kbn-version: 8.19.11 + Content-Type: application/json + register: result +- debug: + msg: "setting new custom Index to {{ kibana_custom_default_index }}" From 9996efbc125d08e72cb3bc3bf54903515df7f689 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 15:40:22 +0100 Subject: [PATCH 05/11] adjusted trailing spaces for linting --- roles/kibana/tasks/kibana-default-index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml index c7f92cf9..5eead598 100644 --- a/roles/kibana/tasks/kibana-default-index.yml +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -1,6 +1,6 @@ --- -- name: Set Custom Default Index +- name: Set Custom Default Index uri: url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings' method: POST From 8d690b0ec11caa6d93433d4c017f741af70c63b8 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 16:29:56 +0100 Subject: [PATCH 06/11] added taggig to auditbeat.yml as an start. this shouldnt collide with anything --- roles/beats/tasks/auditbeat.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/roles/beats/tasks/auditbeat.yml b/roles/beats/tasks/auditbeat.yml index 46a84a00..8edd1ffd 100644 --- a/roles/beats/tasks/auditbeat.yml +++ b/roles/beats/tasks/auditbeat.yml @@ -10,6 +10,9 @@ string ) if (elasticstack_version is defined and elasticstack_version | length > 0)) | replace(' ', '') }} + tags: + - auditbeat + - name - name: Install Auditbeat - rpm - full stack ansible.builtin.package: @@ -21,6 +24,9 @@ when: - ansible_os_family == "RedHat" - elasticstack_full_stack | bool + tags: + - auditbeat + - rpm - name: Install Auditbeat - rpm - standalone ansible.builtin.package: @@ -30,6 +36,10 @@ when: - ansible_os_family == "RedHat" - not elasticstack_full_stack | bool + tags: + - auditbeat + - standalone + - rpm - name: Install Auditbeat - deb ansible.builtin.package: @@ -38,6 +48,9 @@ - Restart Auditbeat when: - ansible_os_family == "Debian" + tags: + - auditbeat + - deb # KICS complains about "latest" package but this is a dedicated update task @@ -55,6 +68,10 @@ - elasticstack_version == "latest" - ansible_os_family == "RedHat" - elasticstack_full_stack | bool + tags: + - auditbeat + - fullstack + - rpm - name: Install Auditbeat latest version - rpm - standalone ansible.builtin.package: @@ -67,6 +84,10 @@ - elasticstack_version == "latest" - ansible_os_family == "RedHat" - not elasticstack_full_stack | bool + tags: + - auditbeat + - latest + - rpm - name: Install Auditbeat latest version - deb ansible.builtin.package: @@ -78,6 +99,10 @@ - elasticstack_version is defined - elasticstack_version == "latest" - ansible_os_family == "Debian" + tags: + - auditbeat + - latest + - deb - name: Configure Auditbeat ansible.builtin.template: @@ -105,6 +130,9 @@ when: - beats_auditbeat_setup | bool - beats_auditbeat_output == "elasticsearch" + tags: + - auditbeat + - setup - name: Start Auditbeat ansible.builtin.service: @@ -112,3 +140,6 @@ state: started enabled: true when: beats_auditbeat_enable | bool + tags: + - auditbeat + - start From 0fc540ab5edc73061b795458ad72abe7dd204791 Mon Sep 17 00:00:00 2001 From: David Okon Date: Mon, 16 Feb 2026 15:49:43 +0100 Subject: [PATCH 07/11] fixed unhashable key error --- roles/kibana/tasks/kibana-default-index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml index 5eead598..4c7df0e9 100644 --- a/roles/kibana/tasks/kibana-default-index.yml +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -6,7 +6,7 @@ method: POST body: changes: - defaultIndex: {{ kibana_custom_default_index }} + defaultIndex: '{{ kibana_custom_default_index }}' body_format: json headers: kbn-version: 8.19.11 From 2c16ee943d87c653a39c0d39cebf8532181b107d Mon Sep 17 00:00:00 2001 From: David Okon Date: Mon, 16 Feb 2026 16:15:09 +0100 Subject: [PATCH 08/11] changed debug into ansible.builtin.debug --- roles/kibana/tasks/kibana-security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index 3851b2f9..cb830470 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -140,7 +140,7 @@ changed_when: false args: creates: "{{ elasticstack_ca_dir }}/encryption_key" - - debug: + - ansible.builtin.debug: msg: "File exists..." when: encryption_key_exists.stat.exits @@ -157,7 +157,7 @@ changed_when: false args: creates: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" - - debug: + - ansible.builtin.debug: msg: "File exists..." when: savedobjects_encryption_key_exists.stat.exits From 2d608a2ae63b84dd224e837bf43a8973a66e2d01 Mon Sep 17 00:00:00 2001 From: David Okon Date: Mon, 16 Feb 2026 16:22:10 +0100 Subject: [PATCH 09/11] added missing fqdn for ansible linter --- roles/kibana/tasks/kibana-default-index.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml index 4c7df0e9..56cdbaaa 100644 --- a/roles/kibana/tasks/kibana-default-index.yml +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -1,7 +1,7 @@ --- - name: Set Custom Default Index - uri: + ansible.builtin.uri: url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings' method: POST body: @@ -12,5 +12,5 @@ kbn-version: 8.19.11 Content-Type: application/json register: result -- debug: +- ansible.builtin.debug: msg: "setting new custom Index to {{ kibana_custom_default_index }}" From aa2b34f124dfee4962cc06d63b2dd924646aaae3 Mon Sep 17 00:00:00 2001 From: David Okon Date: Thu, 26 Mar 2026 17:07:57 +0100 Subject: [PATCH 10/11] added ansible.builtin.stat and fixed typos --- roles/kibana/tasks/kibana-security.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index cb830470..e25a2e19 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -140,9 +140,12 @@ changed_when: false args: creates: "{{ elasticstack_ca_dir }}/encryption_key" + - ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/encryption_key" + register: encryption_key_exists - ansible.builtin.debug: msg: "File exists..." - when: encryption_key_exists.stat.exits + when: encryption_key_exists.stat.exists - name: Fetch encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/encryption_key @@ -157,9 +160,12 @@ changed_when: false args: creates: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + - ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + register: savedobjects_encryption_key - ansible.builtin.debug: msg: "File exists..." - when: savedobjects_encryption_key_exists.stat.exits + when: savedobjects_encryption_key.stat.exists - name: Fetch saved objects encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/savedobjects_encryption_key From b2506e3a3be23f03f945eb7c9d690e30b4b30497 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 27 Mar 2026 17:31:03 +0100 Subject: [PATCH 11/11] first initial suggestion for doc explanation of the tags --- docs/getting-started.md | 24 ++++++++++++++++++++++++ docs/role-beats.md | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/docs/getting-started.md b/docs/getting-started.md index 79569b50..6b258973 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -61,3 +61,27 @@ Every role got its own set of variables, in addition a few variables are useable * *elasticstack_release*: Major release version of Elastic stack to configure. (default: `7`) * *elasticstack_variant*: Variant of the stack to install. Valid values: `elastic` or `oss`. (default: `elastic`) + +Tags +----------- + +As of the beginning of now, we introduce the usage of tags in the role as well for quicker and more precise control of the installs. +More Info on the usable tags can be found in the respective documentation of the role part. + +As of now *Beats*,*Elasticsearch*,*Kibana* and *Logstash* have tags available for usage. + +Most tags can be used in the role the following way: + +``` +- name: Playbook + hosts: some_host_pattern + collections: + - netways.elasticstack + vars: + component_install_tags: "tag1, tag2, tag3" + tasks: + - name: install elastic component + import_role: + name: netways.elasticstack.logstash + tags: "{{ component_install_tags }}" +``` diff --git a/docs/role-beats.md b/docs/role-beats.md index 5d742c82..373bd194 100644 --- a/docs/role-beats.md +++ b/docs/role-beats.md @@ -122,3 +122,35 @@ If you want to use this role with your own TLS certificates, use these variables - repos - beats ``` + +## Tags + +We introduce now tags for more precise actions in the roles itself. +Example instead of running the auditbeat install with rpm you can run on dedicated debian based systems with `-t "auditbeat, deb"` or `--tags "auditbeat, deb"` +the role to install directly the debian part. + +Here a short list of available Tags: + +* *auditbeat*,*filebeat*,*metricbeat* and *beats-security*: Name of the selectable Beat +* *name*: For debugging purpose if you need the exact Name of the Package which will be installed +* *rpm*,*deb*: The Choice of the Operating System for quicker and more precise installation +* *standalone*: As the naming suggests standalone install +* *latest*: For choice of the latest Version available +* *configuration*,*beats_auditbeat_configuration*,*beats_configuration*: For creating the configuration file of the beat +* *setup*: For the elasticsearch auditbeat setup +* *start*: If you need to trigger the start of the Beat + +``` +- name: Install Elastic Beats + hosts: beats-hosts + collections: + - netways.elasticstack + vars: + elasticsearch_jna_workaround: true + elasticsearch_disable_systemcallfilterchecks: true + beats_install_tags: "auditbeat, deb" + roles: + - repos + - beats + tags: "{{ beats_install_tags }}" +```