From e2b7d6ea42107f128cb12383d2898df2c1b8d1f7 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 11:22:37 +0100 Subject: [PATCH 1/7] improve encryption key handling and adjustable encryption key size, also output if existing encryption keys are found --- roles/elasticstack/defaults/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/elasticstack/defaults/main.yml b/roles/elasticstack/defaults/main.yml index ee14ca30..819934c0 100644 --- a/roles/elasticstack/defaults/main.yml +++ b/roles/elasticstack/defaults/main.yml @@ -25,6 +25,7 @@ elasticstack_security: true elasticstack_variant: elastic elasticstack_force_pip: false elasticstack_manage_pip: false +elasticstack_encryption_key_size: 64 # for debugging only elasticstack_no_log: true From 93897fb964d5d3a25a10a8a501465af598d9a418 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 12:09:57 +0100 Subject: [PATCH 2/7] implemented checks if encryption keys already exist --- roles/kibana/tasks/kibana-security.yml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index db4479ed..40d226fa 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -1,5 +1,15 @@ --- +- name: Ensure encryption key exists + ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/encryption_key" + register: encryption_key_exists + +- name: Ensure saved encryption key exists + ansible.builtin.stat: + path: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + register: savedobjects_encryption_key_exists + - name: Ensure kibana certificate exists ansible.builtin.stat: path: "/etc/kibana/certs/{{ ansible_hostname }}-kibana.p12" @@ -125,11 +135,14 @@ - name: Generate encryption key # noqa: risky-shell-pipe ansible.builtin.shell: > if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi; - openssl rand -base64 36 > + openssl rand -base64 {{ elasticstack_encryption_key_size }} > {{ elasticstack_ca_dir }}/encryption_key changed_when: false args: creates: "{{ elasticstack_ca_dir }}/encryption_key" + - debug: + msg: "File exists..." + when: encryption_key_exists.stat.exits - name: Fetch encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/encryption_key @@ -139,12 +152,14 @@ - name: Generate saved objects encryption key # noqa: risky-shell-pipe ansible.builtin.shell: > if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi; - openssl rand - -base64 36 > + openssl rand -base64 {{ elasticstack_encryption_key_size }} > {{ elasticstack_ca_dir }}/savedobjects_encryption_key changed_when: false args: creates: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" + - debug: + msg: "File exists..." + when: savedobjects_encryption_key_exists.stat.exits - name: Fetch saved objects encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/savedobjects_encryption_key From d63b1c2782e65bedf317e4ec27bb47ff0d5be94f Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 14:19:36 +0100 Subject: [PATCH 3/7] removed trailing spaces for lint --- roles/kibana/tasks/kibana-security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index 40d226fa..3851b2f9 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -8,7 +8,7 @@ - name: Ensure saved encryption key exists ansible.builtin.stat: path: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" - register: savedobjects_encryption_key_exists + register: savedobjects_encryption_key_exists - name: Ensure kibana certificate exists ansible.builtin.stat: @@ -142,7 +142,7 @@ creates: "{{ elasticstack_ca_dir }}/encryption_key" - debug: msg: "File exists..." - when: encryption_key_exists.stat.exits + when: encryption_key_exists.stat.exits - name: Fetch encryption key ansible.builtin.command: cat {{ elasticstack_ca_dir }}/encryption_key From 817f79e1b9db346ad12f7cc2ece8bf61e5ff86eb Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 15:29:44 +0100 Subject: [PATCH 4/7] Added seperate Task for setting new default index and introduced variable for index UUID --- roles/kibana/defaults/main.yml | 1 + roles/kibana/tasks/kibana-default-index.yml | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 roles/kibana/tasks/kibana-default-index.yml diff --git a/roles/kibana/defaults/main.yml b/roles/kibana/defaults/main.yml index 725d70f5..5e981cac 100644 --- a/roles/kibana/defaults/main.yml +++ b/roles/kibana/defaults/main.yml @@ -14,6 +14,7 @@ kibana_cert_validity_period: 1095 kibana_cert_will_expire_soon: false kibana_sniff_on_start: false kibana_sniff_on_connection_fault: false +kibana_custom_default_index: 979390d0-3def-11ea-ad1f-5b09c073c7d3 kibana_freshstart: changed: false diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml new file mode 100644 index 00000000..c7f92cf9 --- /dev/null +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -0,0 +1,16 @@ +--- + +- name: Set Custom Default Index + uri: + url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings' + method: POST + body: + changes: + defaultIndex: {{ kibana_custom_default_index }} + body_format: json + headers: + kbn-version: 8.19.11 + Content-Type: application/json + register: result +- debug: + msg: "setting new custom Index to {{ kibana_custom_default_index }}" From 9996efbc125d08e72cb3bc3bf54903515df7f689 Mon Sep 17 00:00:00 2001 From: David Okon Date: Fri, 13 Feb 2026 15:40:22 +0100 Subject: [PATCH 5/7] adjusted trailing spaces for linting --- roles/kibana/tasks/kibana-default-index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml index c7f92cf9..5eead598 100644 --- a/roles/kibana/tasks/kibana-default-index.yml +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -1,6 +1,6 @@ --- -- name: Set Custom Default Index +- name: Set Custom Default Index uri: url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings' method: POST From 172b0961f4e4f693927aa5468b6df02bc73490d3 Mon Sep 17 00:00:00 2001 From: David Okon Date: Tue, 17 Feb 2026 11:53:55 +0100 Subject: [PATCH 6/7] fixed linint error debug and fixed variable path --- roles/kibana/tasks/kibana-default-index.yml | 2 +- roles/kibana/tasks/kibana-security.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml index 5eead598..4c7df0e9 100644 --- a/roles/kibana/tasks/kibana-default-index.yml +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -6,7 +6,7 @@ method: POST body: changes: - defaultIndex: {{ kibana_custom_default_index }} + defaultIndex: '{{ kibana_custom_default_index }}' body_format: json headers: kbn-version: 8.19.11 diff --git a/roles/kibana/tasks/kibana-security.yml b/roles/kibana/tasks/kibana-security.yml index 3851b2f9..cb830470 100644 --- a/roles/kibana/tasks/kibana-security.yml +++ b/roles/kibana/tasks/kibana-security.yml @@ -140,7 +140,7 @@ changed_when: false args: creates: "{{ elasticstack_ca_dir }}/encryption_key" - - debug: + - ansible.builtin.debug: msg: "File exists..." when: encryption_key_exists.stat.exits @@ -157,7 +157,7 @@ changed_when: false args: creates: "{{ elasticstack_ca_dir }}/savedobjects_encryption_key" - - debug: + - ansible.builtin.debug: msg: "File exists..." when: savedobjects_encryption_key_exists.stat.exits From 7d455b0cb881a28865d85f8efc36466dff6274fe Mon Sep 17 00:00:00 2001 From: David Okon Date: Tue, 17 Feb 2026 12:09:18 +0100 Subject: [PATCH 7/7] fixed missing fqdn for ansible linting --- roles/kibana/tasks/kibana-default-index.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/kibana/tasks/kibana-default-index.yml b/roles/kibana/tasks/kibana-default-index.yml index 4c7df0e9..56cdbaaa 100644 --- a/roles/kibana/tasks/kibana-default-index.yml +++ b/roles/kibana/tasks/kibana-default-index.yml @@ -1,7 +1,7 @@ --- - name: Set Custom Default Index - uri: + ansible.builtin.uri: url: 'http://{{ ansible_default_ipv4.address }}:5601/api/kibana/settings' method: POST body: @@ -12,5 +12,5 @@ kbn-version: 8.19.11 Content-Type: application/json register: result -- debug: +- ansible.builtin.debug: msg: "setting new custom Index to {{ kibana_custom_default_index }}"