Defined Type: elasticsearch::role

Defined in:
manifests/role.pp

Overview

Manage shield/x-pack roles.

Examples:

create and manage the role ‘power_user’ mapped to an LDAP group.

elasticsearch::role { 'power_user':
  privileges => {
    'cluster' => 'monitor',
    'indices' => {
      '*' => 'all',
    },
  },
  mappings => [
    "cn=users,dc=example,dc=com",
  ],
}

Parameters:

  • ensure (String) (defaults to: 'present') —

    Whether the role should be present or not. Set to ‘absent’ to ensure a role is not present.

  • mappings (Array) (defaults to: []) —

    A list of optional mappings defined for this role.

  • privileges (Hash) (defaults to: {}) —

    A hash of permissions defined for the role. Valid privilege settings can be found in the Shield/x-pack documentation.

Author:

  • Tyler Langlois <tyler.langlois@elastic.co>



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'manifests/role.pp', line 29

define elasticsearch::role (
  $ensure     = 'present',
  $mappings   = [],
  $privileges = {},
) {
  validate_string($ensure)
  validate_array($mappings)
  validate_hash($privileges)
  validate_slength($name, 30, 1)
  if $elasticsearch::security_plugin == undef or ! ($elasticsearch::security_plugin in ['shield', 'x-pack']) {
    fail("\"${elasticsearch::security_plugin}\" is not a valid security_plugin parameter value")
  }

  if empty($privileges) or $ensure == 'absent' {
    $_role_ensure = 'absent'
  } else {
    $_role_ensure = $ensure
  }

  if empty($mappings) or $ensure == 'absent' {
    $_mapping_ensure = 'absent'
  } else {
    $_mapping_ensure = $ensure
  }

  elasticsearch_role { $name :
    ensure     => $_role_ensure,
    privileges => $privileges,
  }

  elasticsearch_role_mapping { $name :
    ensure   => $_mapping_ensure,
    mappings => $mappings,
  }
}