From 3f6226297b5fbfb4c34c2e81e0f47384bc2112dd Mon Sep 17 00:00:00 2001
From: Jose M <jm.garcia@wazuh.com>
Date: Tue, 2 Jul 2019 19:09:01 +0200
Subject: [PATCH] Add  copy of certificates and folder permissions fix to
 Kibana.

---
 .../ansible-kibana/tasks/main.yml             | 63 +++++++++++++++++--
 1 file changed, 58 insertions(+), 5 deletions(-)

diff --git a/roles/elastic-stack/ansible-kibana/tasks/main.yml b/roles/elastic-stack/ansible-kibana/tasks/main.yml
index 43e369c8..d82d9176 100644
--- a/roles/elastic-stack/ansible-kibana/tasks/main.yml
+++ b/roles/elastic-stack/ansible-kibana/tasks/main.yml
@@ -5,11 +5,6 @@
 - import_tasks: Debian.yml
   when: ansible_os_family == 'Debian'
 
-- name: Make sure Elasticsearch is running before proceeding.
-  wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=300
-  tags: configure
-  ignore_errors: true
-
 - name: Reload systemd
   systemd: daemon_reload=true
   ignore_errors: true
@@ -18,6 +13,64 @@
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
 
+- name: Check if certificate exists locally
+  stat:
+    path: "{{node_certs_destination}}/{{ kibana_node_name }}.crt"
+  register: certificate_file_exists
+  when:
+    - kibana_xpack_security 
+
+- name: Copy key & certificate files in generator node (locally)
+  synchronize:
+    src: "{{node_certs_source}}/{{kibana_node_name}}/"
+    dest: "{{node_certs_destination}}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  when: 
+    - node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Copy ca certificate file in generator node (locally)
+  synchronize:
+    src: "{{node_certs_source}}/ca/"
+    dest: "{{node_certs_destination}}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  when: 
+    - node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+  
+- name: Importing key & certificate files from generator node
+  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/{{kibana_node_name}}/ {{node_certs_destination}}/"
+  when:
+    - not node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Importing ca certificate file from generator node 
+  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/ca/ {{node_certs_destination}}/"
+  when:
+    - not node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  register: check_certs_permissions
+  tags: xpack-security
+
+- name: Ensuring certificates folder owner
+  shell: "chown -R kibana: {{node_certs_destination}}/"
+  when:
+    - check_certs_permissions is defined
+  tags: xpack-security
+
+- name: Ensuring certificates folder owner
+  shell: "chmod -R 770 {{node_certs_destination}}/"
+  when:
+    - check_certs_permissions is defined
+  tags: xpack-security
+
 - name: Kibana configuration
   template:
     src: kibana.yml.j2