Repository navigation
Address mode - #560
Merged
Merged
Address mode#560
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
elasticstack_address_modeto the elasticstack role, so the user chooses how the Ansible roles address a host of the elasticsearch, logstash or kibana inventory group:inventory(default, as before),fqdn,hostnameorip. Each host is addressed in the mode set for it in the inventory (group_vars, host_vars) or with-e. The other hosts read it throughhostvars, which has no play vars or role parameters, so a value set there stops the run instead of being ignored. To run that check in every play, the component roles import the elasticstack role without thewhen; the role still runs its setup once per host.The address of every such host is picked once in
roles/elasticstack/tasks/node_address.ymland kept in a table. Beats, Kibana and Logstash replace the inventory names they get fromgroups[...]with the entries of that table. The variable proposed in the issue, computed in the role defaults and read throughhostvars, cannot work: role defaults of another host are not visible there.iptakes the address of the network card with the default route. To reach a single host at another address, for example through a different card, its host_vars can setelasticstack_node_address, an IPv4 address or a DNS name. That address wins over the mode and is added to the certificate of Elasticsearch hosts and to the certificate a Logstash host presents to the Beats. Existing certificates get it when they are renewed.For
fqdn,hostnameandipthe table needs the facts of those hosts. When they are missing, for example in a run limited with--limit, they are gathered first. With the defaults nothing is gathered, and every rendered config file and certutil call stays the same as on main. The mode of every host in the table is checked as well, a typo on a host left out with--limitwould otherwise end up asip.The Elasticsearch nodes keep finding each other by IP,
elasticsearch_seed_hostsalready overrides that. The logstash role keeps creating its role and user through the IP of the CA host.The full stack Molecule scenario now sets
ipin its inventory and no longer writes /etc/hosts.Closes #524