Skip to content

Feature request: Security role management via role variables #67

@Oddly

Description

@Oddly

Summary

It would be useful if the role could manage custom Elasticsearch security roles via role variables, similar to how it manages other Elasticsearch configuration.

Current situation

Users need to write individual ansible.builtin.uri tasks for each custom ES role:

- name: Create logstash_writer role
  ansible.builtin.uri:
    url: "https://{{ inventory_hostname }}:9200/_security/role/logstash_writer"
    method: PUT
    # ... auth boilerplate ...
    body:
      cluster: [manage_index_templates, monitor, manage_ilm]
      indices:
        - names: ["*"]
          privileges: [write, delete, create_index, manage, manage_ilm]
    body_format: json

Proposed solution

Add a role variable like:

elasticsearch_security_roles:
  - name: logstash_writer
    cluster: [manage_index_templates, monitor, manage_ilm]
    indices:
      - names: ["*"]
        privileges: [write, delete, create_index, manage, manage_ilm]
  - name: sensu_user
    cluster: [monitor]
    indices:
      - names: ["filebeat-*", "metricbeat-*"]
        privileges: [all]

The role would loop over this list and create the roles via the _security/role API. Combined with #65 (user management) and #66 (role mappings), this would allow full declarative security configuration via role variables.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions