Skip to content

Commit 4e74001

Browse files
medantheliniummedanthelinium
authored
Merge pull request #1 from punktDe/v8-update
Kibana v8 support
2 parents f772262 + 162ccb6 commit 4e74001

File tree

10 files changed

+191
-82
lines changed

10 files changed

+191
-82
lines changed

‎defaults/main.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
kibana:
2+
version: 8
23
prefix:
34
config: >-
45
{%- if ansible_system == 'Linux' -%}
@@ -9,8 +10,7 @@ kibana:
910
repository:
1011
apt:
1112
key_url: https://artifacts.elastic.co/GPG-KEY-elasticsearch
12-
repository: |
13-
deb https://artifacts.elastic.co/packages/7.x/apt stable main
13+
repository: https://artifacts.elastic.co/packages/{{ vars.kibana.version }}.x/apt
1414
domain:
1515
use_dehydrated: yes
1616
oauth2_proxy:

‎meta/main.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
dependencies:
22
- role: nginx
3+
- role: elasticsearch

‎tasks/configure.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
- name: Enable Kibana
3+
service:
4+
name: kibana
5+
enabled: yes

‎tasks/install.yaml

+56-28
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,61 @@
1-
- when: ansible_distribution == 'Ubuntu'
2-
block:
3-
- name: Add Elastic repository key
4-
apt_key:
5-
url: "{{ kibana.repository.apt.key_url }}"
1+
---
2+
- name: Install python3-debian package with apt
3+
ansible.builtin.apt:
4+
name: python3-debian
5+
update_cache: yes
66

7-
- name: Add Elastic repository
8-
loop:
9-
- /etc/apt/sources.list.d/elastic.list
10-
copy:
11-
content: "{{ kibana.repository.apt.repository }}"
12-
dest: "{{ item }}"
13-
register: kibana_add_apt_repository
7+
- name: Remove the legacy apt repository
8+
ansible.builtin.file:
9+
dest: /etc/apt/sources.list.d/elastic.list
10+
state: absent
11+
12+
- name: Add the Kibana apt repository
13+
register: kibana_repository_added
14+
ansible.builtin.deb822_repository:
15+
name: elastic
16+
uris: "{{ kibana.repository.apt.repository }}"
17+
signed_by: "{{ kibana.repository.apt.key_url }}"
18+
types: [deb]
19+
components: [main]
20+
suites: [stable]
21+
state: present
22+
enabled: yes
1423

15-
- name: Update apt cache
16-
when: kibana_add_apt_repository.changed
17-
apt:
18-
update_cache: yes
24+
- name: Update apt cache
25+
when: kibana_repository_added.changed
26+
ansible.builtin.apt:
27+
update_cache: yes
1928

20-
- name: Install Kibana
21-
apt:
22-
name: kibana
29+
- name: Install Kibana
30+
notify: Restart Kibana
31+
ansible.builtin.apt:
32+
name: kibana
2333

24-
- name: Restart Kibana after package upgrade
25-
lineinfile:
26-
path: /etc/default/kibana
27-
regexp: '^#?RESTART_ON_UPGRADE='
28-
line: RESTART_ON_UPGRADE=true
34+
- name: Restart Kibana after package upgrade
35+
ansible.builtin.lineinfile:
36+
path: /etc/default/kibana
37+
regexp: '^#?RESTART_ON_UPGRADE='
38+
line: RESTART_ON_UPGRADE=true
2939

30-
- name: Enable Kibana
31-
service:
32-
name: kibana
33-
enabled: yes
40+
- name: Handle Kibana v8 service ovverides
41+
when: kibana.version >= 8
42+
block:
43+
- name: Make sure the service override folder exists for the Kibana systemd service
44+
ansible.builtin.file:
45+
dest: /etc/systemd/system/kibana.service.d
46+
state: directory
47+
owner: root
48+
mode: "0755"
49+
50+
- name: Override the Kibana systemd service to disable the log.dest parameter
51+
notify: Restart Kibana
52+
ansible.builtin.copy:
53+
content: |
54+
[Service]
55+
ExecStart=
56+
ExecStart=/usr/share/kibana/bin/kibana --pid.file="/run/kibana/kibana.pid"
57+
dest: /etc/systemd/system/kibana.service.d/override.conf
58+
59+
- name: Reload systemd daemons
60+
ansible.builtin.systemd:
61+
daemon_reload: yes

‎tasks/kibana.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
- name: Template Kibana config
22
loop:
3-
- src: kibana/kibana.yml
3+
- src: kibana/kibana.yml.j2
44
dest: "{{ kibana.prefix.config }}/kibana.yml"
55
loop_control:
66
label: "{{ item.dest }}"

‎tasks/main.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
---
12
- import_tasks: install.yaml
3+
when: ansible_os_family == "Debian"
4+
5+
- import_tasks: configure.yaml
6+
27
- import_tasks: nginx.yaml
8+
9+
- import_tasks: password.yaml
10+
when: kibana.version is version('8', '>=')
11+
312
- import_tasks: kibana.yaml

‎tasks/password.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
- name: Display an error about missing kibana_system password
3+
when: not elasticsearch.users.builtin.kibana_system.password
4+
ansible.builtin.fail:
5+
msg: >-
6+
[ERROR]: The password for built-in user 'kibana_system' is not defined.
7+
Starting with ElasticSearch 8, security is enabled by default,
8+
which means that the built-in users must be password-protected.
9+
Please set the variable `elasticsearch.users.builtin.kibana_system.password`
10+
to your desired password.
11+
12+
- name: Check if the password for the kibana_system user is already defined
13+
changed_when: kibana_system_password_already_set.status == 401
14+
failed_when: kibana_system_password_already_set is failed and kibana_system_password_already_set.status != 401
15+
register: kibana_system_password_already_set
16+
ansible.builtin.uri:
17+
url: http://localhost:9200
18+
user: kibana_system
19+
password: "{{ elasticsearch.users.builtin.kibana_system.password }}"
20+
force_basic_auth: yes
21+
22+
- name: Define a password for the kibana_password user
23+
when: kibana_system_password_already_set is changed
24+
changed_when: yes
25+
ansible.builtin.shell:
26+
cmd: >-
27+
printf "{{ elasticsearch.users.builtin.kibana_system.password }}\n{{ elasticsearch.users.builtin.kibana_system.password }}" |
28+
{{ elasticsearch.prefix.bin }}/elasticsearch-reset-password -b -u kibana_system -i

‎templates/kibana/kibana.yml

-1
This file was deleted.

‎templates/kibana/kibana.yml.j2

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{% if kibana.version is not defined or kibana.version is version('8', '<') %}
2+
{{ kibana['kibana.yml'] | to_nice_yaml(indent=2) }}
3+
{% else %}
4+
{{ kibana['kibana.yml'] | ansible.utils.remove_keys(target=['apm', 'graph', 'ml', 'reporting', 'xpack']) | to_nice_yaml(indent=2) }}
5+
{% endif %}

‎templates/nginx/http.d/kibana.conf

+84-50
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,92 @@
1+
map $http_upgrade $connection_upgrade {
2+
default upgrade;
3+
'' close;
4+
}
5+
6+
{% if dehydrated | cert_exists(kibana.domain) and kibana.use_dehydrated %}
17
server {
2-
{% if dehydrated|cert_exists(kibana.domain) and kibana.use_dehydrated %}
3-
listen 0.0.0.0:443 ssl http2;
4-
listen [::]:443 ssl http2;
5-
{% else %}
6-
listen 0.0.0.0:80;
7-
listen [::]:80;
8-
{% endif %}
8+
listen 0.0.0.0:80;
9+
listen [::]:80;
10+
{% if ansible_local.proserver|default(none) and ansible_local.proserver.routing.with_gate64 -%}
11+
listen [::1]:87 proxy_protocol;
12+
{%- endif %}
13+
14+
server_name {{ kibana.domain }};
15+
16+
root /var/null;
17+
18+
location / {
19+
return 301 https://$host$request_uri;
20+
}
21+
22+
include {{ nginx.prefix.config }}/include/letsencrypt.conf;
23+
}
24+
25+
server {
26+
listen 0.0.0.0:443 ssl http2;
27+
listen [::]:443 ssl http2;
928

10-
server_name {{ kibana.domain }};
29+
server_name {{ kibana.domain }};
30+
31+
client_max_body_size 100M;
1132

12-
include {{ nginx.prefix.config }}/include/security_headers.conf;
33+
include {{ nginx.prefix.config }}/include/security_headers.conf;
1334

35+
{% if kibana.oauth2_proxy %}
36+
location /proserver/iap {
37+
proxy_pass http://[::1]:{{ oauth2_proxy.config[kibana.oauth2_proxy].http_address.split(":")[-1] }};
38+
proxy_set_header Host $host;
39+
proxy_set_header X-Real-IP $remote_addr;
40+
proxy_set_header X-Scheme $scheme;
41+
proxy_set_header X-Auth-Request-Redirect $request_uri;
42+
}
43+
44+
location = /proserver/iap/auth {
45+
proxy_pass http://[::1]:{{ oauth2_proxy.config[kibana.oauth2_proxy].http_address.split(":")[-1] }};
46+
proxy_set_header Host $host;
47+
proxy_set_header X-Real-IP $remote_addr;
48+
proxy_set_header X-Scheme $scheme;
49+
proxy_set_header Content-Length "";
50+
proxy_pass_request_body off;
51+
}
52+
{% endif %}
53+
54+
location / {
1455
{% if kibana.oauth2_proxy %}
15-
location /proserver/iap {
16-
proxy_pass http://[::1]:{{ oauth2_proxy.config[kibana.oauth2_proxy].http_address.split(":")[-1] }};
17-
proxy_set_header Host $host;
18-
proxy_set_header X-Real-IP $remote_addr;
19-
proxy_set_header X-Scheme $scheme;
20-
proxy_set_header X-Auth-Request-Redirect $request_uri;
21-
}
22-
23-
location = /proserver/iap/auth {
24-
proxy_pass http://[::1]:{{ oauth2_proxy.config[kibana.oauth2_proxy].http_address.split(":")[-1] }};
25-
proxy_set_header Host $host;
26-
proxy_set_header X-Real-IP $remote_addr;
27-
proxy_set_header X-Scheme $scheme;
28-
proxy_set_header Content-Length "";
29-
proxy_pass_request_body off;
30-
}
56+
auth_request /proserver/iap/auth;
57+
error_page 401 = /proserver/iap/sign_in;
58+
auth_request_set $auth_cookie $upstream_http_set_cookie;
59+
add_header Set-Cookie $auth_cookie;
3160
{% endif %}
3261

33-
location / {
34-
{% if kibana.oauth2_proxy %}
35-
auth_request /proserver/iap/auth;
36-
error_page 401 = /proserver/iap/sign_in;
37-
auth_request_set $auth_cookie $upstream_http_set_cookie;
38-
add_header Set-Cookie $auth_cookie;
39-
{% endif %}
40-
41-
proxy_pass http://127.0.0.1:5601;
42-
proxy_http_version 1.1;
43-
proxy_set_header Upgrade $http_upgrade;
44-
proxy_set_header Connection "upgrade";
45-
proxy_set_header Host $host;
46-
proxy_cache_bypass $http_upgrade;
47-
}
48-
49-
{% if dehydrated|cert_exists(kibana.domain) and kibana.use_dehydrated -%}
50-
############################################################################
51-
# HTTPS
52-
############################################################################
53-
ssl_certificate {{ dehydrated|cert_fullchain(kibana.domain) }};
54-
ssl_certificate_key {{ dehydrated|cert_privkey(kibana.domain) }};
55-
ssl_trusted_certificate {{ dehydrated|cert_chain(kibana.domain) }};
56-
include {{ nginx.prefix.config }}/include/https_params.conf;
57-
{% endif %}
62+
proxy_pass http://127.0.0.1:5601;
63+
proxy_http_version 1.1;
64+
proxy_set_header Upgrade $http_upgrade;
65+
proxy_set_header Connection "upgrade";
66+
proxy_set_header Host $host;
67+
proxy_cache_bypass $http_upgrade;
68+
}
69+
70+
ssl_certificate {{ dehydrated|cert_fullchain(kibana.domain) }};
71+
ssl_certificate_key {{ dehydrated|cert_privkey(kibana.domain) }};
72+
ssl_trusted_certificate {{ dehydrated|cert_chain(kibana.domain) }};
73+
include {{ nginx.prefix.config }}/include/https_params.conf;
74+
}
75+
{% else %}
76+
77+
server {
78+
listen 0.0.0.0:80;
79+
listen [::]:80;
80+
81+
server_name {{ kibana.domain }};
82+
83+
location / {
84+
proxy_pass http://127.0.0.1:5601;
85+
proxy_http_version 1.1;
86+
proxy_set_header Upgrade $http_upgrade;
87+
proxy_set_header Connection "upgrade";
88+
proxy_set_header Host $host;
89+
proxy_cache_bypass $http_upgrade;
90+
}
5891
}
92+
{% endif %}

0 commit comments

Comments
 (0)