Defined Type: elasticsearch::instance

Defined in:

manifests/instance.pp

Overview

This define allows you to create or remove an elasticsearch instance

Parameters:

• ensure (String) (defaults to: $elasticsearch::ensure) —

  Controls if the managed resources shall be ‘present` or `absent`. If set to `absent`, the managed software packages will be uninstalled, and any traces of the packages will be purged as well as possible, possibly including existing configuration files. System modifications (if any) will be reverted as well as possible (e.g. removal of created users, services, changed log settings, and so on). This is a destructive parameter and should be used with care.

• ca_certificate (String) (defaults to: undef) —

  Path to the trusted CA certificate to add to this node’s java keystore.

• certificate (String) (defaults to: undef) —

  Path to the certificate for this node signed by the CA listed in ca_certificate.

• config (Hash) (defaults to: undef) —

  Elasticsearch configuration hash.

• configdir (String) (defaults to: undef) —

  Path to directory containing the elasticsearch configuration. Use this setting if your packages deviate from the norm (/etc/elasticsearch).

• daily_rolling_date_pattern (String) (defaults to: $elasticsearch::daily_rolling_date_pattern) —

  File pattern for the file appender log when file_rolling_type is ‘dailyRollingFile`

• datadir (String) (defaults to: undef) —

  Allows you to set the data directory of Elasticsearch

• datadir_instance_directories (Boolean) (defaults to: $elasticsearch::datadir_instance_directories) —

  Control whether individual directories for instances will be created within each instance’s data directory.

• deprecation_logging (Boolean) (defaults to: false) —

  Wheter to enable deprecation logging. If enabled, deprecation logs will be saved to $clustercluster.name_deprecation.log in the elastic search log folder.

• deprecation_logging_level (String) (defaults to: 'DEBUG') —

  Default deprecation logging level for Elasticsearch.

• file_rolling_type (String) (defaults to: $elasticsearch::file_rolling_type) —

  Configuration for the file appender rotation. It can be ‘dailyRollingFile` or `rollingFile`. The first rotates by name, and the second one by size.

• init_defaults (Hash) (defaults to: undef) —

  Defaults file content in hash representation.

• init_defaults_file (String) (defaults to: undef) —

  Defaults file as puppet resource.

• init_template (String) (defaults to: $elasticsearch::init_template) —

  Service file as a template

• jvm_options (Array) (defaults to: $elasticsearch::jvm_options) —

  Array of options to set in jvm_options.

• keystore_password (String) (defaults to: undef) —

  Password to encrypt this node’s Java keystore.

• keystore_path (String) (defaults to: undef) —

  Custom path to the java keystore file. This parameter is optional.

• log4j2_ensure (String) (defaults to: $elasticsearch::log4j2_ensure) —

  State of the log4j2 logging configuration file.

• logdir (String) (defaults to: undef) —

  Log directory for this instance.

• logging_config (Hash) (defaults to: undef) —

  Hash representation of information you want in the logging.yml file.

• logging_file (String) (defaults to: undef) —

  Instead of a hash you can supply a puppet:// file source for the logging.yml file

• logging_level (String) (defaults to: $elasticsearch::default_logging_level) —

  Default logging level for Elasticsearch.

• logging_template (String) (defaults to: undef) —

  Use a custom logging template - just supply the reative path, ie $module_name/elasticsearch/logging.yml.erb

• logging_yml_ensure (String) (defaults to: $elasticsearch::logging_yml_ensure) —

  State of the logging.yml logging configuration file.

• private_key (String) (defaults to: undef) —

  Path to the key associated with this node’s certificate.

• purge_secrets (Boolean) (defaults to: $elasticsearch::purge_secrets) —

  Whether or not keys present in the keystore will be removed if they are not present in the specified secrets hash.

• rolling_file_max_backup_index (Integer) (defaults to: $elasticsearch::rolling_file_max_backup_index) —

  Max number of logs to store whern file_rolling_type is ‘rollingFile`

• rolling_file_max_file_size (String) (defaults to: $elasticsearch::rolling_file_max_file_size) —

  Max log file size when file_rolling_type is ‘rollingFile`

• secrets (Hash) (defaults to: undef) —

  Optional configuration hash of key/value pairs to store in the instance’s Elasticsearch keystore file. If unset, the keystore is left unmanaged.

• security_plugin (String) (defaults to: $elasticsearch::security_plugin) —

  Which security plugin will be used to manage users, roles, and certificates. Inherited from top-level Elasticsearch class.

• service_flags (String) (defaults to: undef) —

  Service flags used for the OpenBSD service configuration, defaults to undef.

• ssl (Boolean) (defaults to: false) —

  Whether to manage TLS certificates for Shield. Requires the ca_certificate, certificate, private_key and keystore_password parameters to be set.

• status (String) (defaults to: $elasticsearch::status) —

  To define the status of the service. If set to ‘enabled`, the service will be run and will be started at boot time. If set to `disabled`, the service is stopped and will not be started at boot time. If set to `running`, the service will be run but will not be started at boot time. You may use this to start a service on the first Puppet run instead of the system startup. If set to `unmanaged`, the service will not be started at boot time and Puppet does not care whether the service is running or not. For example, this may be useful if a cluster management software is used to decide when to start the service plus assuring it is running on the desired node.

• system_key (String) (defaults to: $elasticsearch::system_key) —

  Source for the Shield system key. Valid values are any that are supported for the file resource ‘source` parameter.

Author:

• Richard Pijnenburg <richard.pijnenburg@elasticsearch.com>

• Tyler Langlois <tyler.langlois@elastic.co>

# File 'manifests/instance.pp', line 133

define elasticsearch::instance (
  $ensure                        = $elasticsearch::ensure,
  $ca_certificate                = undef,
  $certificate                   = undef,
  $config                        = undef,
  $configdir                     = undef,
  $daily_rolling_date_pattern    = $elasticsearch::daily_rolling_date_pattern,
  $datadir                       = undef,
  $datadir_instance_directories  = $elasticsearch::datadir_instance_directories,
  $deprecation_logging           = false,
  $deprecation_logging_level     = 'DEBUG',
  $file_rolling_type             = $elasticsearch::file_rolling_type,
  $init_defaults                 = undef,
  $init_defaults_file            = undef,
  $init_template                 = $elasticsearch::init_template,
  $jvm_options                   = $elasticsearch::jvm_options,
  $keystore_password             = undef,
  $keystore_path                 = undef,
  $log4j2_ensure                 = $elasticsearch::log4j2_ensure,
  $logdir                        = undef,
  $logging_config                = undef,
  $logging_file                  = undef,
  $logging_level                 = $elasticsearch::default_logging_level,
  $logging_template              = undef,
  $logging_yml_ensure            = $elasticsearch::logging_yml_ensure,
  $private_key                   = undef,
  $purge_secrets                 = $elasticsearch::purge_secrets,
  $rolling_file_max_backup_index = $elasticsearch::rolling_file_max_backup_index,
  $rolling_file_max_file_size    = $elasticsearch::rolling_file_max_file_size,
  $secrets                       = undef,
  $security_plugin               = $elasticsearch::security_plugin,
  $service_flags                 = undef,
  $ssl                           = false,
  $status                        = $elasticsearch::status,
  $system_key                    = $elasticsearch::system_key,
) {

  require elasticsearch::params

  File {
    owner => $elasticsearch::elasticsearch_user,
    group => $elasticsearch::elasticsearch_group,
  }

  Exec {
    path => [ '/bin', '/usr/bin', '/usr/local/bin' ],
    cwd  => '/',
  }

  # ensure
  if ! ($ensure in [ 'present', 'absent' ]) {
    fail("\"${ensure}\" is not a valid ensure parameter value")
  }

  if $ssl or ($system_key != undef) {
    if $security_plugin == undef or ! ($security_plugin in ['shield', 'x-pack']) {
      fail("\"${security_plugin}\" is not a valid security_plugin parameter value")
    }
  }

  $notify_service = $elasticsearch::restart_config_change ? {
    true  => Elasticsearch::Service[$name],
    false => undef,
  }

  # Instance config directory
  if ($configdir == undef) {
    $instance_configdir = "${elasticsearch::configdir}/${name}"
  } else {
    $instance_configdir = $configdir
  }

  if ($ensure == 'present') {

    # Configuration hash
    if ($config == undef) {
      $instance_config = {}
    } else {
      validate_hash($config)
      $instance_config = deep_implode($config)
    }

    if(has_key($instance_config, 'node.name')) {
      $instance_node_name = {}
    } else {
      $instance_node_name = { 'node.name' => "${::hostname}-${name}" }
    }

    # String or array for data dir(s)
    if ($datadir == undef) {
      validate_bool($datadir_instance_directories)
      if ($datadir_instance_directories) {
        if (is_array($elasticsearch::datadir)) {
          $instance_datadir = array_suffix($elasticsearch::datadir, "/${name}")
        } else {
          $instance_datadir = "${elasticsearch::datadir}/${name}"
        }
      } else {
        $instance_datadir = $elasticsearch::datadir
      }
    } else {
      $instance_datadir = $datadir
    }

    # Logging file or hash
    if ($logging_file != undef) {
      $logging_source = $logging_file
      $logging_content = undef
      $_log4j_content = undef
    } elsif ($elasticsearch::logging_file != undef) {
      $logging_source = $elasticsearch::logging_file
      $logging_content = undef
      $_log4j_content = undef
    } else {

      if(is_hash($elasticsearch::logging_config)) {
        $main_logging_config = deep_implode($elasticsearch::logging_config)
      } else {
        $main_logging_config = { }
      }

      if(is_hash($logging_config)) {
        $instance_logging_config = deep_implode($logging_config)
      } else {
        $instance_logging_config = { }
      }
      $logging_hash = merge(
        $elasticsearch::params::logging_defaults,
        $main_logging_config,
        $instance_logging_config
      )
      if ($logging_template != undef ) {
        $logging_content = template($logging_template)
        $_log4j_content = template($logging_template)
      } elsif ($elasticsearch::logging_template != undef) {
        $logging_content = template($elasticsearch::logging_template)
        $_log4j_content = template($elasticsearch::logging_template)
      } else {
        $logging_content = template("${module_name}/etc/elasticsearch/logging.yml.erb")
        $_log4j_content = template("${module_name}/etc/elasticsearch/log4j2.properties.erb")
      }
      $logging_source = undef
    }

    if ($elasticsearch::x_config != undef) {
      $main_config = deep_implode($elasticsearch::x_config)
    } else {
      $main_config = { }
    }

    $instance_datadir_config = { 'path.data' => $instance_datadir }

    if(is_array($instance_datadir)) {
      $dirs = join($instance_datadir, ' ')
    } else {
      $dirs = $instance_datadir
    }

    # Manage instance log directory
    if ($logdir == undef) {
      $instance_logdir = "${elasticsearch::logdir}/${name}"
    } else {
      $instance_logdir = $logdir
    }

    $instance_logdir_config = { 'path.logs' => $instance_logdir }

    validate_bool($ssl)
    if $ssl {
      validate_absolute_path($ca_certificate, $certificate, $private_key)
      validate_string($keystore_password)

      if ($keystore_path == undef) {
        $_keystore_path = "${instance_configdir}/${security_plugin}/${name}.ks"
      } else {
        validate_absolute_path($keystore_path)
        $_keystore_path = $keystore_path
      }

      if $security_plugin == 'shield' {
        $tls_config = {
          'shield.transport.ssl'         => true,
          'shield.http.ssl'              => true,
          'shield.ssl.keystore.path'     => $_keystore_path,
          'shield.ssl.keystore.password' => $keystore_password,
        }
      } elsif $security_plugin == 'x-pack' {
        $tls_config = {
          'xpack.security.transport.ssl.enabled' => true,
          'xpack.security.http.ssl.enabled'      => true,
          'xpack.ssl.keystore.path'              => $_keystore_path,
          'xpack.ssl.keystore.password'          => $keystore_password,
        }
      }

      # Trust CA Certificate
      java_ks { "elasticsearch_instance_${name}_keystore_ca":
        ensure       => 'latest',
        certificate  => $ca_certificate,
        target       => $_keystore_path,
        password     => $keystore_password,
        trustcacerts => true,
      }

      # Load node certificate and private key
      java_ks { "elasticsearch_instance_${name}_keystore_node":
        ensure      => 'latest',
        certificate => $certificate,
        private_key => $private_key,
        target      => $_keystore_path,
        password    => $keystore_password,
      }
    } else { $tls_config = {} }

    if $system_key != undef {
      validate_string($system_key)
    }

    exec { "mkdir_logdir_elasticsearch_${name}":
      command => "mkdir -p ${instance_logdir}",
      creates => $instance_logdir,
      require => Class['elasticsearch::package'],
      before  => File[$instance_logdir],
    }

    file { $instance_logdir:
      ensure  => 'directory',
      owner   => $elasticsearch::elasticsearch_user,
      group   => undef,
      mode    => '0755',
      require => Class['elasticsearch::package'],
      before  => Elasticsearch::Service[$name],
    }

    if ($datadir_instance_directories) {
      exec { "mkdir_datadir_elasticsearch_${name}":
        command => "mkdir -p ${dirs}",
        creates => $instance_datadir,
        require => Class['elasticsearch::package'],
        before  => Elasticsearch::Service[$name],
      }
      -> file { $instance_datadir:
        ensure  => 'directory',
        owner   => $elasticsearch::elasticsearch_user,
        group   => undef,
        mode    => '0755',
        require => Class['elasticsearch::package'],
        before  => Elasticsearch::Service[$name],
      }
    }

    exec { "mkdir_configdir_elasticsearch_${name}":
      command => "mkdir -p ${instance_configdir}",
      creates => $elasticsearch::configdir,
      require => Class['elasticsearch::package'],
      before  => Elasticsearch::Service[$name],
    }

    file { $instance_configdir:
      ensure  => 'directory',
      mode    => '0755',
      purge   => $elasticsearch::purge_configdir,
      force   => $elasticsearch::purge_configdir,
      require => [ Exec["mkdir_configdir_elasticsearch_${name}"], Class['elasticsearch::package'] ],
      before  => Elasticsearch::Service[$name],
    }

    validate_array($jvm_options)
    file { "${instance_configdir}/jvm.options":
      before  => Elasticsearch::Service[$name],
      content => template("${module_name}/etc/elasticsearch/jvm.options.erb"),
      group   => $elasticsearch::elasticsearch_group,
      notify  => $notify_service,
      owner   => $elasticsearch::elasticsearch_user,
    }

    file {
      "${instance_configdir}/logging.yml":
        ensure  => $logging_yml_ensure,
        content => $logging_content,
        source  => $logging_source,
        mode    => '0644',
        notify  => $notify_service,
        require => Class['elasticsearch::package'],
        before  => Elasticsearch::Service[$name];
      "${instance_configdir}/log4j2.properties":
        ensure  => $log4j2_ensure,
        content => $_log4j_content,
        source  => $logging_source,
        mode    => '0644',
        notify  => $notify_service,
        require => Class['elasticsearch::package'],
        before  => Elasticsearch::Service[$name];
    }

    file { "${instance_configdir}/scripts":
      ensure => 'link',
      target => "${elasticsearch::params::homedir}/scripts",
    }

    if $security_plugin != undef {
      file { "${instance_configdir}/${security_plugin}":
        ensure  => 'directory',
        mode    => '0755',
        source  => "${elasticsearch::configdir}/${security_plugin}",
        recurse => 'remote',
        owner   => 'root',
        group   => '0',
        before  => Elasticsearch::Service[$name],
        notify  => $notify_service,
      }
    }

    if $system_key != undef {
      file { "${instance_configdir}/${security_plugin}/system_key":
        ensure  => 'file',
        source  => $system_key,
        mode    => '0400',
        before  => Elasticsearch::Service[$name],
        require => File["${instance_configdir}/${security_plugin}"],
      }
    }

    # build up new config
    $instance_conf = merge(
      $main_config,
      $instance_node_name,
      $instance_datadir_config,
      $instance_logdir_config,
      $tls_config,
      $instance_config
    )

    # defaults file content
    # ensure user did not provide both init_defaults and init_defaults_file
    if (($init_defaults != undef) and ($init_defaults_file != undef)) {
      fail ('Only one of $init_defaults and $init_defaults_file should be defined')
    }

    if (is_hash($elasticsearch::init_defaults)) {
      $global_init_defaults = $elasticsearch::init_defaults
    } else {
      $global_init_defaults = { }
    }

    $instance_init_defaults_main = {
      'CONF_DIR'     => $instance_configdir,
      'ES_PATH_CONF' => $instance_configdir,
      'ES_HOME'      => $elasticsearch::params::homedir,
      'LOG_DIR'      => $instance_logdir,
    }

    if (is_hash($init_defaults)) {
      $instance_init_defaults = $init_defaults
    } else {
      $instance_init_defaults = { }
    }
    $init_defaults_new = merge(
      { 'DATA_DIR'  => $elasticsearch::params::datadir },
      { 'ES_JVM_OPTIONS' => "${instance_configdir}/jvm.options" },
      $global_init_defaults,
      $instance_init_defaults_main,
      $instance_init_defaults
    )

    $user = $elasticsearch::elasticsearch_user
    $group = $elasticsearch::elasticsearch_group

    datacat_fragment { "main_config_${name}":
      target => "${instance_configdir}/elasticsearch.yml",
      data   => $instance_conf,
    }

    datacat { "${instance_configdir}/elasticsearch.yml":
      template => "${module_name}/etc/elasticsearch/elasticsearch.yml.erb",
      notify   => $notify_service,
      require  => Class['elasticsearch::package'],
      owner    => $elasticsearch::elasticsearch_user,
      group    => $elasticsearch::elasticsearch_group,
      mode     => '0440',
    }

    if ($elasticsearch::secrets != undef or $secrets != undef) {
      if ($elasticsearch::secrets != undef) {
        $main_secrets = $elasticsearch::secrets
      } else {
        $main_secrets = {}
      }

      if ($secrets != undef) {
        $instance_secrets = $secrets
      } else {
        $instance_secrets = {}
      }

      validate_bool($purge_secrets)

      elasticsearch_keystore { $name :
        purge    => $purge_secrets,
        settings => merge($main_secrets, $instance_secrets),
        notify   => $notify_service,
      }
    }

    $require_service = Class['elasticsearch::package']
    $before_service  = undef

  } else {

    file { $instance_configdir:
      ensure  => 'absent',
      recurse => true,
      force   => true,
    }

    $require_service = undef
    $before_service  = File[$instance_configdir]

    $init_defaults_new = {}
  }

  elasticsearch::service { $name:
    ensure             => $ensure,
    status             => $status,
    service_flags      => $service_flags,
    init_defaults      => $init_defaults_new,
    init_defaults_file => $init_defaults_file,
    init_template      => $init_template,
    require            => $require_service,
    before             => $before_service,
  }

}