updated role as previous version was failing in versioning

README.md

@@ -8,12 +8,13 @@ Version History
 |**Date**| **Version**| **Description**| **Changed By** |
 |----------|---------|---------------|-----------------|
 |**June '15** | v0.1 | Initial Draft | Sudipt Sharma |
+|**July '22** | v0.2 | Updated  | Varghese Kurian |
 
 Supported OS
 ------------
-  * Redhat : 7
+  * Redhat : 7/8
   * CentOS : 7
-  * Ubuntu : 14/16/18/20
+  * Ubuntu : 14/16/18/20/22
   * Amazon Linux
 
 Dependencies
@@ -26,7 +27,8 @@ Role Variables/Defaults
 
 |**Variables**| **Default Values**| **Description**|
 |----------|---------|---------------|
-| elasticsearch_version | "6.8.22" | Elasticsearch version you want to install |
+| elasticsearch_version | "7.17.2" | Elasticsearch version you want to install |
+| major_revision | "7" | Elasticsearch major revision version you want to install |
 | cluster_name | es-stanalone | Name of the Elasticsearch cluster | 
 | es_jvm_dump | /var/lib/elasticsearch/heap | Path for jvm dump |
 | data_path | /var/lib/elasticsearch | Place to store Elasticsearch content |
@@ -71,3 +73,4 @@ Author Information
 ------------------
 
 - Sumit Anand
+- Varghese Kurian

defaults/main.yml

@@ -1,25 +1,7 @@
 ---
-elasticsearch_version: "6.8.22"
-cluster_name: es-standalone
-
 # Static value ####
 esurl: "elasticsearch/elasticsearch-{{ elasticsearch_version }}"
 es_s: "elasticsearch.service"
 es: "elasticsearch"
-# Static value end #####
-
-es_jvm_dump: /var/lib/elasticsearch/heap
-data_path: /var/lib/elasticsearch
-log_path: /var/log/elasticsearch
-esIP: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
-http_port: 9200
-tcp_port: 9300
-
-min_heap: "{{ ansible_memtotal_mb // 2 }}m"
-max_heap: "{{ ansible_memtotal_mb // 2 }}m"
 
-m_lock: "true"
-nofile_limit: "65536"
-nproc_limit: "4096"
-swapness: "1"
-vm_max_count: "2621444"
+repo_burl: https://artifacts.elastic.co/packages

handlers/main.yml

@@ -1,8 +1,12 @@
 ---
 # handlers file for elasticsearch
 - name: restart elasticsearch
-  service: name=elasticsearch state=restarted
+  service:
+    name: elasticsearch
+    state: restarted
+    enabled: true
 
 # reload systemd after modification
 - name: reload systemd
-  systemd: daemon_reload=yes
+  systemd:
+    daemon_reload: true

meta/main.yml

@@ -1,24 +1,26 @@
 ---
 galaxy_info:
-    author: sumitopstree
+    author: sumitopstree varghese.palamoottil@opstree.com
     description: Install Elasticsearch in Standalone mode
-    license: "license (BSD, MIT)"
-
-    min_ansible_version: 2.7
-
+    role_name: elasticsearch
+    company: "Opstree Solutions"
+    min_ansible_version: 2.3
+    license: license (GPLv2)
     platforms:
         - name: Ubuntu
           versions:
-              - xenial
-              - precise
-              - trusty
+              - bionic
+              - focal
+              - jammy
         - name: Debian
           versions:
               - jessie
               - wheezy
         - name: EL
           versions:
+              - 8
               - 7
+              - 6
     galaxy_tags:
         - web
         - system

tasks/es-Debian.yml

@@ -1,25 +1,22 @@
 ---
-- name: Set vm.swappiness
-  sysctl:
-    name: vm.swappiness
-    value: "{{ swapness }}"
-    state: present
-
-- name: Set virtual max area
-  sysctl:
-    name: vm.max_map_count
-    value: "{{ vm_max_count }}"
+# Download elasticsearch key
+- name: Apt signing key
+  apt_key:
+    url: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     state: present
 
 # Install apt-transports package required for Installation of Elasticsearch
 - name: Install apt-transports
-  apt: name=apt-transport-https state=present update_cache=yes
+  apt:
+    name: apt-transport-https
+    state: present
+    update_cache: true
 
-# Download elasticsearch
-- name: Download deb.
-  get_url:
-    url: https://artifacts.elastic.co/downloads/{{ esurl }}.deb
-    dest: /tmp/elasticsearch-{{ elasticsearch_version }}.deb
+# Download elasticsearch repository
+- name: Add specified repository into sources list
+  apt_repository:
+    repo: "deb {{ repo_burl }}/{{ major_revision }}.x/apt stable main"
+    state: present
 
 # enable openfile limit without restart
 - name: Enable open file witout restart
@@ -28,7 +25,10 @@
 
 # Install deb file elasticsearch
 - name: Install elasticsearch
-  apt: deb=/tmp/elasticsearch-{{ elasticsearch_version }}.deb
+  apt:
+    name: "elasticsearch={{ elasticsearch_version }}"
+    state: present
+    update_cache: true
 
 # Create directory for es_data and heap_dump storage
 - name: Create data_path directory
@@ -45,6 +45,5 @@
   notify:
     - restart elasticsearch
 
-# Enable elaticsearch
-- name: Enable elasticsearch
-  service: name=elasticsearch enabled=yes
+- name: Reload systemd before restarting elasticsearch
+  meta: flush_handlers

tasks/es-RedHat.yml

@@ -1,36 +1,31 @@
 ---
-# install libselinux-python on centos7
-- name: Install net-tools
-  yum: name=net-tools
-  when:
-    - "ansible_os_family == 'RedHat'"
-
-- name: Set vm.swappiness
-  sysctl:
-    name: vm.swappiness
-    value: "{{ swapness }}"
-    state: present
-
-- name: Set virtual max area
-  sysctl:
-    name: vm.max_map_count
-    value: "{{ vm_max_count }}"
+# Download elasticsearch key
+- name: Import a key from a file
+  rpm_key:
     state: present
-
-# Download elasticsearch
-- name: Download rpm.
-  get_url:
-    url: https://artifacts.elastic.co/downloads/{{ esurl }}.rpm
-    dest: /tmp/elasticsearch-{{ elasticsearch_version }}.rpm
+    key: https://artifacts.elastic.co/GPG-KEY-elasticsearch
 
 # enable openfile limit without restart
 - name: Enable open file witout restart
   shell: "ulimit -n 4096"
   changed_when: true
 
+# Download elasticsearch repo
+- name: Add multiple repositories into the same file (1/2)
+  yum_repository:
+    name: elasticsearch
+    description: "Elasticsearch repository for {{ major_revision }}.x packages"
+    baseurl: "https://artifacts.elastic.co/packages/{{ major_revision }}.x/yum"
+    gpgcheck: true
+    gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
+    enabled: false
+
 # Install rpm file elasticsearch
 - name: Install elasticsearch
-  yum: name=/tmp/elasticsearch-{{ elasticsearch_version }}.rpm state=present
+  yum:
+    name: "elasticsearch-{{ elasticsearch_version }}"
+    state: present
+    enablerepo: elasticsearch
   notify:
     - restart elasticsearch
 
@@ -49,6 +44,5 @@
   notify:
     - restart elasticsearch
 
-# Enable elaticsearch
-- name: Enable elasticsearch
-  systemd: name=elasticsearch enabled=yes
+- name: Reload systemd before restarting elasticsearch
+  meta: flush_handlers

tasks/main.yml

@@ -1,7 +1,11 @@
 ---
 # tasks file for logstash
 
+- name: Include OS Specific setup tasks
+  include_tasks: prerequisite.yml
+
 - name: Include OS Specific setup tasks
   include_tasks: es-{{ ansible_os_family }}.yml
 
-- include_tasks: config.yml
+- name: Configuring elasticsearch
+  include_tasks: config.yml

tasks/prerequisite.yml

@@ -0,0 +1,18 @@
+---
+# install libselinux-python on centos7
+- name: Install net-tools
+  yum: name=net-tools
+  when:
+    - "ansible_os_family == 'RedHat'"
+
+- name: Set vm.swappiness
+  sysctl:
+    name: vm.swappiness
+    value: "{{ swapness }}"
+    state: present
+
+- name: Set virtual max area
+  sysctl:
+    name: vm.max_map_count
+    value: "{{ vm_max_count }}"
+    state: present

templates/elasticsearch.yml.j2

@@ -85,5 +85,33 @@ http.port: {{ http_port }}
 #
 # Require explicit names when deleting indices:
 #
-action.destructive_requires_name: true
-xpack.monitoring.collection.enabled: true
+
+#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
+
+xpack.security.enabled: false
+
+xpack.security.enrollment.enabled: true
+
+# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
+xpack.security.http.ssl:
+  enabled: true
+  keystore.path: certs/http.p12
+
+# Enable encryption and mutual authentication between cluster nodes
+xpack.security.transport.ssl:
+  enabled: true
+  verification_mode: certificate
+  keystore.path: certs/transport.p12
+  truststore.path: certs/transport.p12
+# Create a new cluster with the current node only
+# Additional nodes can still join the cluster later
+cluster.initial_master_nodes: ["ip-10-0-5-248"]
+
+# Allow HTTP API connections from anywhere
+# Connections are encrypted and require user authentication
+http.host: 0.0.0.0
+
+# Allow other nodes to join the cluster from anywhere
+# Connections are encrypted and mutually authenticated
+#transport.host: 0.0.0.0
+#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

templates/jvm.options.j2

@@ -33,9 +33,7 @@
 ################################################################
 
 ## GC configuration
--XX:+UseConcMarkSweepGC
--XX:CMSInitiatingOccupancyFraction=75
--XX:+UseCMSInitiatingOccupancyOnly
+-XX:+UseG1GC
 
 ## optimizations
 
@@ -85,22 +83,5 @@
 # specify an alternative path for JVM fatal error logs
 -XX:ErrorFile={{ log_path }}/hs_err_pid%p.log
 
-## JDK 8 GC logging
-
-8:-XX:+PrintGCDetails
-8:-XX:+PrintGCDateStamps
-8:-XX:+PrintTenuringDistribution
-8:-XX:+PrintGCApplicationStoppedTime
-8:-Xloggc:{{ log_path }}/gc.log
-8:-XX:+UseGCLogFileRotation
-8:-XX:NumberOfGCLogFiles=32
-8:-XX:GCLogFileSize=64m
-
-# JDK 9+ GC logging
-9-:-Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m
-# due to internationalization enhancements in JDK 9 Elasticsearch need to set the provider to COMPAT otherwise
-# time/date parsing will break in an incompatible way for some date patterns and locals
-9-:-Djava.locale.providers=COMPAT
-
-# temporary workaround for C2 bug with JDK 10 on hardware with AVX-512
-10-:-XX:UseAVX=2
+## GC logging
+-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,level,pid,tags:filecount=32,filesize=64m

tests/inventory

@@ -0,0 +1,6 @@
+[wazuh]
+wazuh ansible_host=3.17.132.203
+
+[wazuh:vars]
+ansible_ssh_user=ubuntu
+ansible_ssh_private_key_file= /home/varghese/Downloads/himanshiohio.pem

tests/test.yml

@@ -0,0 +1,7 @@
+---
+- name: wazuh
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+   - {role: elasticsearch}

vars/main.yml

@@ -1,9 +1,20 @@
 ---
-elasticsearch_version: "6.8.22"
+major_revision: 8
+elasticsearch_version: 8.10.2
 cluster_name: es-standalone
 
-# es_jvm_dump: /var/lib/elasticsearch/heap
-# data_path: /var/lib/elasticsearch
-# log_path: /var/log/elasticsearch
+es_jvm_dump: /var/lib/elasticsearch/heap
+data_path: /var/lib/elasticsearch
+log_path: /var/log/elasticsearch
+esIP: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
+http_port: 9200
+tcp_port: 9300
 
-# esIP: "0.0.0.0"
+min_heap: "{{ ansible_memtotal_mb // 2 }}m"
+max_heap: "{{ ansible_memtotal_mb // 2 }}m"
+
+m_lock: "true"
+nofile_limit: "65536"
+nproc_limit: "4096"
+swapness: "1"
+vm_max_count: "2621444"