From ac500c9f6517c85d29a297dca460b5e427b24da8 Mon Sep 17 00:00:00 2001 From: oddly Date: Tue, 4 Aug 2026 09:16:08 +0200 Subject: [PATCH] fix(certs): make *_cert_will_expire_soon overridable from playbooks Closes #157. The five cert-renewal trigger flags (elasticsearch_cert_will_expire_soon, beats_cert_will_expire_soon, kibana_cert_will_expire_soon, logstash_cert_will_expire_soon, elasticstack_ca_will_expire_soon) lived in each role's vars/main.yml, which outranks play vars, so a playbook that did 'vars: elasticsearch_cert_will_expire_soon: true' saw its value silently reverted when the role re-imported vars/main.yml. Move each flag to the corresponding defaults/main.yml with an @var docblock explaining that it is normally flipped automatically by cert_check_expiry and only needs to be set from a playbook to force renewal without touching the buffer. Runtime mutation via set_fact still wins (set_fact produces a host fact, which beats a role default), so cert_check_expiry keeps working. --- roles/beats/defaults/main.yml | 8 ++++++++ roles/beats/vars/main.yml | 2 -- roles/elasticsearch/defaults/main.yml | 8 ++++++++ roles/elasticsearch/vars/main.yml | 3 --- roles/elasticstack/defaults/main.yml | 8 ++++++++ roles/elasticstack/vars/main.yml | 2 -- roles/kibana/defaults/main.yml | 8 ++++++++ roles/kibana/vars/main.yml | 3 --- roles/logstash/defaults/main.yml | 8 ++++++++ roles/logstash/vars/main.yml | 3 --- 10 files changed, 40 insertions(+), 13 deletions(-) diff --git a/roles/beats/defaults/main.yml b/roles/beats/defaults/main.yml index 73d1275f..cf0efb01 100644 --- a/roles/beats/defaults/main.yml +++ b/roles/beats/defaults/main.yml @@ -223,3 +223,11 @@ beats_tls_ca_content: "" # @var beats_tls_remote_src:description: Source location for external cert files. false = files on Ansible controller, true = files already on managed node beats_tls_remote_src: false + +# @var beats_cert_will_expire_soon:description: > +# Force renewal of the Beats client certificate on the next run. +# Normally flipped to true automatically by the cert_check_expiry task +# when the certificate is within `beats_cert_expiration_buffer` days of expiry; +# set to true from a playbook to force renewal regardless of buffer. +# @end +beats_cert_will_expire_soon: false diff --git a/roles/beats/vars/main.yml b/roles/beats/vars/main.yml index fa515fb3..ed97d539 100644 --- a/roles/beats/vars/main.yml +++ b/roles/beats/vars/main.yml @@ -1,3 +1 @@ --- -# Internal state — do not set manually -beats_cert_will_expire_soon: false diff --git a/roles/elasticsearch/defaults/main.yml b/roles/elasticsearch/defaults/main.yml index 3b3f3859..29dc3ff7 100644 --- a/roles/elasticsearch/defaults/main.yml +++ b/roles/elasticsearch/defaults/main.yml @@ -243,3 +243,11 @@ elasticsearch_logrotate_rotate: 32 elasticsearch_logrotate_size: 50M # @var elasticsearch_logrotate_maxage:description: Delete rotated files older than this many days elasticsearch_logrotate_maxage: 370 + +# @var elasticsearch_cert_will_expire_soon:description: > +# Force renewal of the Elasticsearch node certificate on the next run. +# Normally flipped to true automatically by the cert_check_expiry task +# when the certificate is within `elasticsearch_cert_expiration_buffer` days of expiry; +# set to true from a playbook to force renewal regardless of buffer. +# @end +elasticsearch_cert_will_expire_soon: false diff --git a/roles/elasticsearch/vars/main.yml b/roles/elasticsearch/vars/main.yml index 01b0b90a..af01504e 100644 --- a/roles/elasticsearch/vars/main.yml +++ b/roles/elasticsearch/vars/main.yml @@ -39,9 +39,6 @@ _elasticsearch_managed_keys: # Internal sentinel values — prevent handler errors on first run. # These are overwritten by task register output; users must never set them. -# Internal state — do not set manually -elasticsearch_cert_will_expire_soon: false - _elasticsearch_freshstart: changed: false _elasticsearch_freshstart_security: diff --git a/roles/elasticstack/defaults/main.yml b/roles/elasticstack/defaults/main.yml index 5889811a..cd2db40e 100644 --- a/roles/elasticstack/defaults/main.yml +++ b/roles/elasticstack/defaults/main.yml @@ -73,3 +73,11 @@ elasticstack_security: true # @var elasticstack_no_log:description: Suppress sensitive output in Ansible logs. Set to false for debugging elasticstack_no_log: true + +# @var elasticstack_ca_will_expire_soon:description: > +# Force renewal of the CA certificate on the next run. +# Normally flipped to true automatically by the cert_check_expiry task +# when the certificate is within `elasticstack_ca_expiration_buffer` days of expiry; +# set to true from a playbook to force renewal regardless of buffer. +# @end +elasticstack_ca_will_expire_soon: false diff --git a/roles/elasticstack/vars/main.yml b/roles/elasticstack/vars/main.yml index 20998a99..ed97d539 100644 --- a/roles/elasticstack/vars/main.yml +++ b/roles/elasticstack/vars/main.yml @@ -1,3 +1 @@ --- -# Internal state — do not set manually -elasticstack_ca_will_expire_soon: false diff --git a/roles/kibana/defaults/main.yml b/roles/kibana/defaults/main.yml index bdb916de..f27e8068 100644 --- a/roles/kibana/defaults/main.yml +++ b/roles/kibana/defaults/main.yml @@ -119,3 +119,11 @@ kibana_sniff_on_connection_fault: false # xpack.reporting.enabled: false # @end kibana_extra_config: {} + +# @var kibana_cert_will_expire_soon:description: > +# Force renewal of the Kibana server certificate on the next run. +# Normally flipped to true automatically by the cert_check_expiry task +# when the certificate is within `kibana_cert_expiration_buffer` days of expiry; +# set to true from a playbook to force renewal regardless of buffer. +# @end +kibana_cert_will_expire_soon: false diff --git a/roles/kibana/vars/main.yml b/roles/kibana/vars/main.yml index 914722fe..cad325d0 100644 --- a/roles/kibana/vars/main.yml +++ b/roles/kibana/vars/main.yml @@ -1,7 +1,4 @@ --- -# Internal state — do not set manually -kibana_cert_will_expire_soon: false - # Internal sentinel values — prevent handler errors on first run. # These are overwritten by task register output; users must never set them. _kibana_freshstart: diff --git a/roles/logstash/defaults/main.yml b/roles/logstash/defaults/main.yml index 04752b09..3d9e567a 100644 --- a/roles/logstash/defaults/main.yml +++ b/roles/logstash/defaults/main.yml @@ -294,3 +294,11 @@ logstash_plugins: [] logstash_pipeline_unsafe_shutdown: false # @var logstash_skip_root_check:description: Skip the Logstash 9.x root user upgrade warning check logstash_skip_root_check: false + +# @var logstash_cert_will_expire_soon:description: > +# Force renewal of the Logstash client certificate on the next run. +# Normally flipped to true automatically by the cert_check_expiry task +# when the certificate is within `logstash_cert_expiration_buffer` days of expiry; +# set to true from a playbook to force renewal regardless of buffer. +# @end +logstash_cert_will_expire_soon: false diff --git a/roles/logstash/vars/main.yml b/roles/logstash/vars/main.yml index c5aa6191..2031f6a3 100644 --- a/roles/logstash/vars/main.yml +++ b/roles/logstash/vars/main.yml @@ -1,7 +1,4 @@ --- -# Internal state — do not set manually -logstash_cert_will_expire_soon: false - # Internal sentinel values — prevent handler errors on first run. # These are overwritten by task register output; users must never set them. _logstash_freshstart: