使用 ansible 为 Elasticcluster 生成 TLS 证书

Question

在使用 elasticsearch-certutil 工具为 Elastic 集群生成 tls 证书时，我得到：

unable to read from standard input; is standard input open and a tty attached?

我知道安装插件或生成密码工具可以使用 force 和 batch 标志，但是这个没有。

ansible 任务（部分）：

- name: Create certificates p12
  shell: |
    cd /usr/share/elasticsearch && \
    ./bin/elasticsearch-certutil ca -s --out elastic-stack-ca.p12 --pass {{ ca_password }} && \
    ./bin/elasticsearch-certutil cert -s --ca elastic-stack-ca.p12 --ca-pass {{ ca_password }} --out elastic-certificates.p12 --pass {{ cert_password }} && \
    cp elastic-certificates.p12 /etc/elasticsearch && \
    chmod 660 /etc/elasticsearch/elastic-certificates.p12

Answer 1

- name: Generate a certificate of authority
  args:
    chdir: '{{ elasticsearch_path_etc }}'
  become: yes
  command: "{{ elastic_home }}/bin/elasticsearch-certutil ca --out {{ elasticsearch_path_etc }}/elastic-stack-ca.p12 --pass '{{ elasticsearch_tls_cert_pass }}'"
- name: Generate a certificate and private key for a node
  args:
    chdir: '{{ elasticsearch_path_etc }}'
  become: yes
  command: "{{ elastic_home }}/bin/elasticsearch-certutil cert --ca {{ elasticsearch_path_etc }}/elastic-stack-ca.p12 --ca-pass '{{ elasticsearch_tls_cert_pass }}' --out {{ elasticsearch_path_etc }}/elastic-certificates.p12 --pass '{{ elasticsearch_tls_cert_ca_pass }}'"
- name: Change cert permissions
  file:
    path: "{{ elasticsearch_path_etc }}/elastic-certificates.p12"
    owner: root
    group: elasticsearch
    mode: '0666'

我简单地分成 3 个部分，效果很好

使用 ansible 为 Elasticcluster 生成 TLS 证书

Generate TLS certs for Elasticcluster with ansible

tty

elasticsearch

ansible