From 798f30b7ab9fbbfde7fb8d082d0dde81f36020e8 Mon Sep 17 00:00:00 2001 From: oddly Date: Tue, 4 Aug 2026 11:14:36 +0200 Subject: [PATCH] fix(kibana): set pipefail on the readiness probe MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #173. ansible-lint is right that the journalctl | grep pipe in the Kibana readiness probe should honour \$pipefail — without it, a broken journalctl still lets grep see an empty pipe and exit 1, so we'd fall through to the HTTP check on a machine where journalctl is truly broken. In practice we already had \`|| true\` on the curl call to guard against that, but the linter is enforcing the general rule and the fix is a one-liner. --- roles/kibana/tasks/main.yml | 1 + roles/kibana/tasks/restart_and_verify_kibana.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/roles/kibana/tasks/main.yml b/roles/kibana/tasks/main.yml index 4bcde49..8653700 100644 --- a/roles/kibana/tasks/main.yml +++ b/roles/kibana/tasks/main.yml @@ -150,6 +150,7 @@ # 1 transient — still starting up, keep retrying # 2 permanent — service dead or a fatal log line already surfaced cmd: | + set -o pipefail if ! systemctl is-active --quiet kibana; then exit 2 fi diff --git a/roles/kibana/tasks/restart_and_verify_kibana.yml b/roles/kibana/tasks/restart_and_verify_kibana.yml index f8cedb9..5e22cbb 100644 --- a/roles/kibana/tasks/restart_and_verify_kibana.yml +++ b/roles/kibana/tasks/restart_and_verify_kibana.yml @@ -29,6 +29,7 @@ # 2 permanent — service died or a fatal log line already surfaced, # no point in waiting the remaining retries cmd: | + set -o pipefail if ! systemctl is-active --quiet kibana; then exit 2 fi