elasticsearch-keystore.yml

---

- name: "Elasticsearch keystore: Create keystore"
  ansible.builtin.command: /usr/share/elasticsearch/bin/elasticsearch-keystore create
  args:
    creates: /etc/elasticsearch/elasticsearch.keystore

- name: "Elasticsearch keystore: Get current variables"
  ansible.builtin.command: /usr/share/elasticsearch/bin/elasticsearch-keystore list
  changed_when: false
  register: elasticsearch_keystore_current_items

- name: "Elasticsearch keystore: Include xpack.security.http.ssl variables"
  ansible.builtin.set_fact:
    # Combine data into the dictionary
    elasticsearch_keystore_vars: "{{ elasticsearch_keystore_vars | combine({'xpack.security.http.ssl.keystore.secure_password': elasticsearch_tls_key_passphrase, 'xpack.security.http.ssl.truststore.secure_password': elasticsearch_tls_key_passphrase}) }}"
  no_log: "{{ elasticstack_no_log }}"
  when: elasticsearch_http_security | default(false) | bool

- name: "Elasticsearch keystore: Include xpack.security.transport.ssl variables"
  ansible.builtin.set_fact:
    # Combine data into the dictionary
    elasticsearch_keystore_vars: "{{ elasticsearch_keystore_vars | combine({'xpack.security.transport.ssl.keystore.secure_password': elasticsearch_tls_key_passphrase, 'xpack.security.transport.ssl.truststore.secure_password': elasticsearch_tls_key_passphrase}) }}"
  no_log: "{{ elasticstack_no_log }}"
  when: elasticsearch_security | default(false) | bool

- name: Add/update elements to elasticsearch keystore
  ansible.builtin.include_tasks:
    elasticsearch-keystore-addupdate.yml
  no_log: "{{ elasticstack_no_log }}"
  loop: "{{ (elasticsearch_keystore_extra | dict2items) + (elasticsearch_keystore_vars | dict2items) }}"

- name: Purge keys from elasticsearch keystore
  ansible.builtin.command:
    argv:
      - /usr/share/elasticsearch/bin/elasticsearch-keystore
      - remove
      - "{{ item | quote }}"
  changed_when: true
  loop: "{{ elasticsearch_keystore_current_items.stdout_lines }}"
  when:
    - elasticsearch_keystore_purge
    - item not in elasticsearch_keystore_vars
    - item not in elasticsearch_keystore_extra
    - item not in elasticsearch_keystore_builtin