Skip to content

Don't elevate when running tasks on localhost #397

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tbauriedel merged 1 commit into from
Sep 26, 2025
Merged

Don't elevate when running tasks on localhost #397

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions roles/elasticsearch/tasks/elasticsearch-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,24 @@
---

- name: Ensure ca exists

Check warning on line 3 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint_full / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (register: elasticstack_ca_exists)

Check warning on line 3 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (register: elasticstack_ca_exists)
ansible.builtin.stat:
path: "{{ elasticstack_ca_dir }}/elastic-stack-ca.p12"
register: elasticstack_ca_exists
when: inventory_hostname == elasticstack_ca

- name: Get CA informations

Check warning on line 9 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint_full / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (register: elasticstack_ca_infos)

Check warning on line 9 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (register: elasticstack_ca_infos)
cert_info:
path: "{{ elasticstack_ca_dir }}/elastic-stack-ca.p12"
passphrase: "{{ elasticstack_ca_pass | default(omit, true) }}"
register: elasticstack_ca_infos
when: inventory_hostname == elasticstack_ca and elasticstack_ca_exists.stat.exists | bool

- name: Set the ca expiration date in days

Check warning on line 16 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint_full / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (set_fact: elasticstack_ca_expiration_days)

Check warning on line 16 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (set_fact: elasticstack_ca_expiration_days)
ansible.builtin.set_fact:
elasticstack_ca_expiration_days: "{{ ((elasticstack_ca_infos.not_valid_after | to_datetime()) - (ansible_date_time.date | to_datetime('%Y-%m-%d'))).days }}"
when: inventory_hostname == elasticstack_ca and elasticstack_ca_infos.skipped is not defined

- name: Set ca will expire soon to true

Check warning on line 21 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint_full / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (set_fact: elasticstack_ca_will_expire_soon)

Check warning on line 21 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (set_fact: elasticstack_ca_will_expire_soon)
ansible.builtin.set_fact:
elasticstack_ca_will_expire_soon: true
when: >
Expand Down Expand Up @@ -77,6 +77,7 @@
path: "{{ lookup('config', 'DEFAULT_LOCAL_TMP') | dirname }}/ca.crt"
register: elasticsearch_check_temporary_ca
delegate_to: localhost
become: false

- name: Move temporary ca file on Ansible controler
ansible.builtin.copy:
Expand All @@ -85,6 +86,7 @@
mode: preserve
when: elasticsearch_check_temporary_ca.stat.exists
delegate_to: localhost
become: false
register: elasticsearch_move_ca_file

- name: Remove temporary ca file on Ansible controler
Expand All @@ -93,6 +95,7 @@
state: absent
when: elasticsearch_move_ca_file.changed
delegate_to: localhost
become: false

- name: Ensure elasticsearch certificate exists
ansible.builtin.stat:
Expand Down Expand Up @@ -179,6 +182,7 @@
- name: Backup elasticsearch cert on localhost then remove
when: "'renew_es_cert' in ansible_run_tags or 'renew_ca' in ansible_run_tags or elasticsearch_cert_will_expire_soon | bool"
delegate_to: localhost
become: false
tags:
- renew_es_cert
- renew_ca
Expand Down Expand Up @@ -404,7 +408,7 @@
retries: 5
delay: 10

- name: Fetch Elastic password # noqa: risky-shell-pipe

Check warning on line 411 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint_full / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (register: elasticstack_password)

Check warning on line 411 in roles/elasticsearch/tasks/elasticsearch-security.yml

View workflow job for this annotation

GitHub Actions / lint

var-naming[no-role-prefix] 

Variables names from within roles should use elasticsearch_ as a prefix. (register: elasticstack_password)
ansible.builtin.shell: >
if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
grep "PASSWORD elastic" {{ elasticstack_initial_passwords }} |
Expand Down
Loading