make host variable and remove logstash_password_hash variables

Author: christoph2497

docs/role-logstash.md

@@ -73,10 +73,6 @@ Aside from `logstash.yml` we can manage Logstashs pipelines.
 * *logstash_user*: Name of the user to connect to Elasticsearch (Default: `logstash_writer`)
 * *logstash_user_email*: email-address that is linked with the logstash_user (Default: `""`)
 * *logstash_user_fullname*: fullname that is linked with the logstash_user (Default: `Internal Logstash User`)
-* *logstash_password_hash*: Generate and use a hash from your `logstash_password` (default: `true`)
-* *logstash_password_hash_algorithm*: Password hashing algorithms. Value must be same as `xpack.security.authc.password_hashing.algorithm` (default: `bcrypt`)
-* *logstash_password_salt_length*: base64 encoded Salt character lenght. This value must be integer and must be compatible to the selected password hashing algorithms (default: `22`)
-* *logstash_password_hash_salt_seed*: A seed to generate random but idempotent salt on the elasticstack ca host. The salt will be used to create idempotent logstash hashed user password (default: `SeedChangeMe`)
 * *logstash_user_password*: Password of Elasticsearch user. It must be at least 6 characters long (default: `password`)
 * *logstash_role_cluster_privileges*: Cluster privileges the role has access to (default: `"manage_index_templates", "monitor", "manage_ilm"`)
 * *logstash_role_indicies_names*: Indices the role has access to (default: `"ecs-logstash*", "logstash*", "logs*"`)

roles/logstash/defaults/main.yml

@@ -60,16 +60,11 @@ logstash_role_indicies_privileges:
   - create_index
   - manage
   - manage_ilm
-logstash_password_hash: true
-logstash_password_hash_algorithm: bcrypt
-logstash_password_salt_length: 22
 logstash_role_name: logstash_writer
 logstash_user: logstash_writer
 logstash_user_password: password
 logstash_user_email: ""
 logstash_user_fullname: "Internal Logstash User"
-logstash_password_hash_salt_length: 22
-logstash_password_hash_salt_seed: SeedChangeMe
 logstash_reset_writer_role: true
 
 logstash_tls_key_passphrase: LogstashChangeMe

roles/logstash/tasks/logstash-security.yml

@@ -350,11 +350,6 @@
     msg: logstash user password must be at least 6 characters long.
   when: logstash_user_password | length < 6
 
-- name: Set password hash salt as a fact
-  ansible.builtin.set_fact:
-    logstash_password_hash_salt: "{{ lookup('password', '/dev/null', chars=['ascii_lowercase', 'digits'], length=logstash_password_hash_salt_length, seed=logstash_password_hash_salt_seed) }}"
-  when: logstash_password_hash | bool and inventory_hostname == elasticstack_ca
-
 - name: Fetch Elastic password # noqa: risky-shell-pipe
   ansible.builtin.shell: >
     if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
@@ -368,16 +363,6 @@
     - configuration
     - logstash_configuration
 
-- name: Set elasticsearch security-api base url for elasticsearch > 7
-  ansible.builtin.set_fact:
-    security_api_base_url: "https://{{ hostvars[elasticstack_ca].ansible_default_ipv4.address }}:{{ elasticstack_elasticsearch_http_port }}/_security/"
-  when: elasticstack_release | int > 7
-
-- name: Set elasticsearch security-api base url for elasticsearch < 8
-  ansible.builtin.set_fact:
-    security_api_base_url: "https://{{ hostvars[elasticstack_ca].ansible_default_ipv4.address }}:{{ elasticstack_elasticsearch_http_port }}/_xpack/security/"
-  when: elasticstack_release | int < 8
-
 - name: Create logstash role {{ logstash_role_name }}
   netways.elasticstack.elasticsearch_role:
     name: "{{ logstash_role_name }}"
@@ -386,7 +371,7 @@
       - names: "{{ logstash_role_indicies_names }}"
         privileges: "{{ logstash_role_indicies_privileges }}"
     state: present
-    host: https://localhost:9200
+    host: "https://{{ hostvars[elasticstack_ca].ansible_default_ipv4.address }}:{{ elasticstack_elasticsearch_http_port }}"
     auth_user: elastic
     auth_pass: "{{ logstash_elasticstack_password.stdout }}"
     verify_certs: false
@@ -402,7 +387,7 @@
       - "{{ logstash_role_name }}"
     enabled: true
     state: present
-    host: https://localhost:9200
+    host: "https://{{ hostvars[elasticstack_ca].ansible_default_ipv4.address }}:{{ elasticstack_elasticsearch_http_port }}"
     auth_user: elastic
     auth_pass: "{{ logstash_elasticstack_password.stdout }}"
     verify_certs: false