---
- name: "✅ Assert correct context"
ansible.builtin.assert:
that:
- application_id == 'svc-db-elasticsearch'
- database_consumer_id != 'svc-db-elasticsearch'
- name: "🔍 Resolve consumer index namespace + credentials"
ansible.builtin.set_fact:
elasticsearch_consumer_entity: "{{ database_consumer_id | get_entity_name }}"
elasticsearch_consumer_username: "{{ lookup('engine', 'elasticsearch', database_consumer_id, 'username') }}"
elasticsearch_consumer_password: "{{ database_password | default(lookup('engine', 'elasticsearch', database_consumer_id, 'password')) | string }}"
changed_when: false
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "⏳ ELASTICSEARCH | Wait for security API"
ansible.builtin.shell: >
{{ ELASTICSEARCH_EXEC_SHELL }}
'{{ 30 | curl }} -fS -u "elastic:$ELASTIC_PW"
"{{ ELASTICSEARCH_API_BASE }}/_security/_authenticate" >/dev/null'
register: es_security_ready
until: es_security_ready.rc == 0
retries: 30
delay: 5
changed_when: false
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "📁 Create role scoped to '{{ elasticsearch_consumer_entity }}-*' indices"
ansible.builtin.shell: >
{{ ELASTICSEARCH_EXEC_SHELL }}
'{{ 30 | curl }} -fS -u "elastic:$ELASTIC_PW"
-X PUT "{{ ELASTICSEARCH_API_BASE }}/_security/role/{{ elasticsearch_consumer_entity }}"
-H "Content-Type: application/json"
-d {{ {
"cluster": ["monitor"],
"indices": [
{
"names": [elasticsearch_consumer_entity ~ "-*"],
"privileges": ["all"],
}
],
} | to_json | quote }}'
register: es_role_result
until: es_role_result.rc == 0
retries: "{{ ELASTICSEARCH_RETRIES }}"
delay: "{{ ELASTICSEARCH_DELAY }}"
changed_when: es_role_result.stdout is search('\"created\"\\s*:\\s*true')
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🔨 Build elasticsearch user payload for {{ elasticsearch_consumer_username }}"
ansible.builtin.set_fact:
es_user_payload:
password: "{{ elasticsearch_consumer_password }}"
roles: ["{{ elasticsearch_consumer_entity }}"]
full_name: "{{ database_consumer_id }}"
changed_when: false
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "📁 Create user '{{ elasticsearch_consumer_username }}' bound to its index role"
ansible.builtin.shell: >
{{ ELASTICSEARCH_EXEC_SHELL }}
'{{ 30 | curl }} -fS -u "elastic:$ELASTIC_PW"
-X PUT "{{ ELASTICSEARCH_API_BASE }}/_security/user/{{ elasticsearch_consumer_username }}"
-H "Content-Type: application/json"
-d {{ es_user_payload | to_json | quote }}'
register: es_user_result
until: es_user_result.rc == 0
retries: "{{ ELASTICSEARCH_RETRIES }}"
delay: "{{ ELASTICSEARCH_DELAY }}"
changed_when: es_user_result.stdout is search('\"created\"\\s*:\\s*true')
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "✅ Ensure consumer index namespace exists: {{ elasticsearch_consumer_entity }}"
ansible.builtin.shell: >
{{ ELASTICSEARCH_EXEC_SHELL }}
'{{ 30 | curl }} -S -o /dev/null -w "%{http_code}" -u "elastic:$ELASTIC_PW"
-X PUT "{{ ELASTICSEARCH_API_BASE }}/{{ elasticsearch_consumer_entity }}-default"'
register: es_index_result
until: es_index_result.rc == 0 and es_index_result.stdout is search('20[0-9]|400')
retries: "{{ ELASTICSEARCH_RETRIES }}"
delay: "{{ ELASTICSEARCH_DELAY }}"
changed_when: es_index_result.stdout is search('200')
failed_when: >
es_index_result.rc != 0 or
es_index_result.stdout is not search('20[0-9]|400')
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
