Merge pull request #179 from dj-wasabi/add-molecule-tests-for-elasticsearch

Add molecule tests for Elasticsearch, Logstash, Kibana and Filebeat

.circleci/config.yml

@@ -1,3 +1,4 @@
+---
 version: 2
 jobs:
   test:

.travis.yml

@@ -1,3 +1,4 @@
+---
 language: python
 services: docker
 before_script:
@@ -6,3 +7,7 @@ before_script:
 script:
   - pipenv run test
   - pipenv run agent
+  - pipenv run elasticsearch
+  - pipenv run logstash
+  - pipenv run filebeat
+  - pipenv run kibana

Pipfile

@@ -16,3 +16,7 @@ python_version = "2.7"
 [scripts]
 test ="molecule test"
 agent ="molecule test -s wazuh-agent"
+elasticsearch ="molecule test -s elasticsearch"
+logstash ="molecule test -s logstash"
+filebeat ="molecule test -s filebeat"
+kibana ="molecule test -s kibana"

molecule/default/prepare.yml

@@ -24,3 +24,13 @@
         state: latest
       register: wazuh_manager_dependencies_packages_installed
       until: wazuh_manager_dependencies_packages_installed is succeeded
+
+    - name: "Install (RedHat) dependencies"
+      package:
+        name:
+          - initscripts
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+      when:
+        - ansible_os_family == 'RedHat'

molecule/elasticsearch/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/elasticsearch/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule[docker]'

molecule/elasticsearch/molecule.yml

@@ -0,0 +1,59 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+platforms:
+  - name: bionic
+    image: solita/ubuntu-systemd:bionic
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+    privileged: true
+    memory_reservation: 1024m
+  - name: xenial
+    image: solita/ubuntu-systemd:xenial
+    privileged: true
+    memory_reservation: 1024m
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+  - name: trusty
+    image: ubuntu:trusty
+    memory_reservation: 1024m
+    ulimits:
+      - nofile:262144:262144
+  - name: centos6
+    image: centos:6
+    privileged: true
+    memory_reservation: 1024m
+    ulimits:
+      - nofile:262144:262144
+  - name: centos7
+    image: milcom/centos7-systemd
+    memory_reservation: 1024m
+    privileged: true
+    ulimits:
+      - nofile:262144:262144
+provisioner:
+  name: ansible
+  playbooks:
+    docker:
+      create: ../default/create.yml
+      destroy: ../default/destroy.yml
+      prepare: ../default/prepare.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../../roles
+  lint:
+    name: ansible-lint
+    enabled: true
+  inventory:
+    group_vars:
+      all:
+        elasticsearch_jvm_xms: 512
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/elasticsearch/playbook.yml

@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: elastic-stack/ansible-elasticsearch
+      elasticsearch_network_host: 'localhost'

molecule/elasticsearch/tests/test_default.py

@@ -0,0 +1,20 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_elasticsearch_is_installed(host):
+    """Test if the elasticsearch package is installed."""
+    elasticsearch = host.package("elasticsearch")
+    assert elasticsearch.is_installed
+    assert elasticsearch.version.startswith('6.7.1')
+
+
+def test_elasticsearch_is_running(host):
+    """Test if the services are enabled and running."""
+    elasticsearch = host.service("elasticsearch")
+    assert elasticsearch.is_enabled
+    assert elasticsearch.is_running

molecule/filebeat/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/filebeat/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule[docker]'

molecule/filebeat/molecule.yml

@@ -0,0 +1,42 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+platforms:
+  - name: trusty
+    image: ubuntu:trusty
+  - name: bionic
+    image: solita/ubuntu-systemd:bionic
+    command: /sbin/init
+    privileged: true
+  - name: xenial
+    image: solita/ubuntu-systemd:xenial
+    privileged: true
+    command: /sbin/init
+  - name: centos6
+    image: geerlingguy/docker-centos6-ansible
+    privileged: true
+    command: /sbin/init
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  - name: centos7
+    image: milcom/centos7-systemd
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    docker:
+      create: ../default/create.yml
+      destroy: ../default/destroy.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../../roles
+  lint:
+    name: ansible-lint
+    enabled: true
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/filebeat/playbook.yml

@@ -0,0 +1,5 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: wazuh/ansible-filebeat

molecule/filebeat/prepare.yml

@@ -0,0 +1,36 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: true
+  tasks:
+
+    - name: "Install Python packages for Trusty to solve trust issues"
+      package:
+        name:
+          - python-setuptools
+          - python-pip
+        state: latest
+      register: wazuh_manager_trusty_packages_installed
+      until: wazuh_manager_trusty_packages_installed is succeeded
+      when:
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version | int == 14
+
+    - name: "Install dependencies"
+      package:
+        name:
+          - curl
+          - net-tools
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+
+    - name: "Install (RedHat) dependencies"
+      package:
+        name:
+          - initscripts
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+      when:
+        - ansible_os_family == 'RedHat'

molecule/filebeat/tests/test_default.py

@@ -0,0 +1,19 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_logstash_is_installed(host):
+    """Test if the filebeat package is installed."""
+    filebeat = host.package("filebeat")
+    assert filebeat.is_installed
+
+
+def test_logstash_is_running(host):
+    """Test if the services are enabled and running."""
+    filebeat = host.service("filebeat")
+    assert filebeat.is_enabled
+    assert filebeat.is_running

molecule/kibana/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/kibana/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule[docker]'

molecule/kibana/molecule.yml

@@ -0,0 +1,59 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+platforms:
+  - name: bionic
+    image: solita/ubuntu-systemd:bionic
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+    privileged: true
+    memory_reservation: 1024m
+  - name: xenial
+    image: solita/ubuntu-systemd:xenial
+    privileged: true
+    memory_reservation: 1024m
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+  - name: trusty
+    image: ubuntu:trusty
+    memory_reservation: 1024m
+    ulimits:
+      - nofile:262144:262144
+  - name: centos6
+    image: centos:6
+    privileged: true
+    memory_reservation: 1024m
+    ulimits:
+      - nofile:262144:262144
+  - name: centos7
+    image: milcom/centos7-systemd
+    memory_reservation: 1024m
+    privileged: true
+    ulimits:
+      - nofile:262144:262144
+provisioner:
+  name: ansible
+  playbooks:
+    docker:
+      create: ../default/create.yml
+      destroy: ../default/destroy.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../../roles
+  lint:
+    name: ansible-lint
+    enabled: true
+  inventory:
+    group_vars:
+      all:
+        elasticsearch_jvm_xms: 256
+        kibana_plugin_install_ignore_error: true
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/kibana/playbook.yml

@@ -0,0 +1,5 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: elastic-stack/ansible-kibana

molecule/kibana/prepare.yml

@@ -0,0 +1,41 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: true
+  pre_tasks:
+
+    - name: "Install Python packages for Trusty to solve trust issues"
+      package:
+        name:
+          - python-setuptools
+          - python-pip
+        state: latest
+      register: wazuh_manager_trusty_packages_installed
+      until: wazuh_manager_trusty_packages_installed is succeeded
+      when:
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version | int == 14
+
+    - name: "Install dependencies"
+      package:
+        name:
+          - curl
+          - net-tools
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+
+    - name: "Install (RedHat) dependencies"
+      package:
+        name:
+          - initscripts
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+      when:
+        - ansible_os_family == 'RedHat'
+
+  roles:
+    - role: wazuh/ansible-wazuh-manager
+    - role: elastic-stack/ansible-elasticsearch
+      elasticsearch_network_host: 'localhost'

molecule/kibana/tests/test_default.py

@@ -0,0 +1,31 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_logstash_is_running(host):
+    """Test if the services are enabled and running."""
+    kibana = host.service("kibana")
+    assert kibana.is_enabled
+    assert kibana.is_running
+
+
+def test_port_kibana_is_open(host):
+    """Test if the port 5601 is open and listening to connections."""
+    host.socket("tcp://0.0.0.0:5601").is_listening
+
+
+def test_find_correct_elasticsearch_version(host):
+    """Test if we find the kibana/elasticsearch version in package.json"""
+    kibana = host.file("/usr/share/kibana/plugins/wazuh/package.json")
+    assert kibana.contains("6.7.1")
+
+
+def test_wazuh_plugin_installed(host):
+    """Make sure there is a plugin wazuh directory."""
+    kibana = host.file("/usr/share/kibana/plugins/wazuh/")
+
+    assert kibana.is_directory

molecule/logstash/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/logstash/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule[docker]'

molecule/logstash/molecule.yml

@@ -0,0 +1,56 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+platforms:
+  - name: bionic
+    image: solita/ubuntu-systemd:bionic
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+    privileged: true
+    memory_reservation: 1024m
+  - name: xenial
+    image: solita/ubuntu-systemd:xenial
+    privileged: true
+    memory_reservation: 1024m
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+  - name: centos6
+    image: geerlingguy/docker-centos6-ansible
+    privileged: true
+    memory_reservation: 1024m
+    command: /sbin/init
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    ulimits:
+      - nofile:262144:262144
+  - name: centos7
+    image: milcom/centos7-systemd
+    memory_reservation: 1024m
+    privileged: true
+    ulimits:
+      - nofile:262144:262144
+provisioner:
+  name: ansible
+  playbooks:
+    docker:
+      create: ../default/create.yml
+      destroy: ../default/destroy.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../../roles
+  lint:
+    name: ansible-lint
+    enabled: true
+  inventory:
+    group_vars:
+      all:
+        elasticsearch_jvm_xms: 256
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/logstash/playbook.yml

@@ -0,0 +1,5 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: elastic-stack/ansible-logstash

molecule/logstash/prepare.yml

@@ -0,0 +1,41 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: true
+  pre_tasks:
+
+    - name: "Install Python packages for Trusty to solve trust issues"
+      package:
+        name:
+          - python-setuptools
+          - python-pip
+        state: latest
+      register: wazuh_manager_trusty_packages_installed
+      until: wazuh_manager_trusty_packages_installed is succeeded
+      when:
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version | int == 14
+
+    - name: "Install dependencies"
+      package:
+        name:
+          - curl
+          - net-tools
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+
+    - name: "Install (RedHat) dependencies"
+      package:
+        name:
+          - initscripts
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+      when:
+        - ansible_os_family == 'RedHat'
+
+  roles:
+    - role: wazuh/ansible-wazuh-manager
+    - role: elastic-stack/ansible-elasticsearch
+      elasticsearch_network_host: 'localhost'

molecule/logstash/tests/test_default.py

@@ -0,0 +1,32 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_logstash_is_installed(host):
+    """Test if logstash is installed with correct version."""
+    logstash = host.package("logstash")
+    assert logstash.is_installed
+
+    distribution = host.system_info.distribution.lower()
+    if distribution == 'ubuntu':
+        assert logstash.version.startswith('1:6.7.1')
+    else:
+        assert logstash.version.startswith('6.7.1')
+
+
+def test_logstash_is_running(host):
+    """Test if the services are enabled and running."""
+    logstash = host.service("logstash")
+    assert logstash.is_enabled
+    assert logstash.is_running
+
+
+def test_find_correct_logentry(host):
+    """See if logstash is started and is connected to Elasticsearch."""
+    logfile = host.file("/var/log/logstash/logstash-plain.log")
+    assert logfile.contains("Successfully started Logstash API endpoint")
+    assert logfile.contains("Restored connection to ES instance")

roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml

@@ -1,13 +1,25 @@
 ---
 - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
   apt:
-    name: ['apt-transport-https', 'ca-certificates']
+    name:
+      - apt-transport-https
+      - ca-certificates
     state: present
+  register: elasticsearch_ca_packages_installed
+  until: elasticsearch_ca_packages_installed is succeeded
+
+- name: "Install Java Repo for Trusty"
+  apt_repository: repo='ppa:openjdk-r/ppa'
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
 
 - when: elasticsearch_install_java
   block:
     - name: Debian/Ubuntu | Install OpenJDK 1.8
       apt: name=openjdk-8-jre state=present cache_valid_time=3600
+      register: elasticsearch_jre_packages_installed
+      until: elasticsearch_jre_packages_installed is succeeded
       tags: install
 
 - name: Debian/Ubuntu | Add Elasticsearch GPG key.
@@ -27,4 +39,6 @@
     name: "elasticsearch={{ elastic_stack_version }}"
     state: present
     cache_valid_time: 3600
+  register: elasticsearch_main_packages_installed
+  until: elasticsearch_main_packages_installed is succeeded
   tags: install

roles/elastic-stack/ansible-elasticsearch/tasks/RMDebian.yml

@@ -3,3 +3,4 @@
   apt_repository:
     repo: deb https://artifacts.elastic.co/packages/5.x/apt stable main
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-elasticsearch/tasks/RMRedHat.yml

@@ -3,3 +3,4 @@
   yum_repository:
     name: elastic_repo
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-elasticsearch/tasks/RedHat.yml

@@ -4,6 +4,7 @@
     - name: RedHat/CentOS/Fedora | Install OpenJDK 1.8
       yum: name=java-1.8.0-openjdk state=present
       register: oracle_java_task_rpm_installed
+      until: oracle_java_task_rpm_installed is succeeded
       tags: install
 
 - name: RedHat/CentOS/Fedora | Install Elastic repo
@@ -13,8 +14,11 @@
     baseurl: https://artifacts.elastic.co/packages/6.x/yum
     gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     gpgcheck: true
+  changed_when: false
 
 - name: RedHat/CentOS/Fedora | Install Elasticsarch
   package: name=elasticsearch-{{ elastic_stack_version }} state=present
+  register: elasticsearch_main_packages_installed
+  until: elasticsearch_main_packages_installed is succeeded
   when: not elasticsearch_install_java or oracle_java_task_rpm_installed is defined
   tags: install

roles/elastic-stack/ansible-elasticsearch/tasks/main.yml

@@ -76,9 +76,9 @@
     - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
 
 - name: Ensure Elasticsearch started and enabled
-  ignore_errors: true
   service:
     name: elasticsearch
     enabled: true
@@ -96,6 +96,7 @@
     method: GET
     status_code: 200, 404
   register: wazuh_alerts_template_exits
+  until: wazuh_alerts_template_exits is succeeded
   tags: init
 
 - name: Installing Wazuh Alerts template
@@ -105,6 +106,8 @@
     status_code: 200
     body_format: json
     body: "{{ lookup('template','wazuh-elastic6-template-alerts.json.j2') }}"
+  register: installing_wazuh_template
+  until: installing_wazuh_template is succeeded
   when: wazuh_alerts_template_exits.status != 200
   tags: init
 

roles/elastic-stack/ansible-kibana/defaults/main.yml

@@ -4,4 +4,5 @@ elasticsearch_network_host: "127.0.0.1"
 kibana_server_host: "0.0.0.0"
 kibana_server_port: "5601"
 elastic_stack_version: 6.7.1
+kibana_plugin_install_ignore_error: false
 wazuh_version: 3.9.0

roles/elastic-stack/ansible-kibana/tasks/Debian.yml

@@ -1,8 +1,12 @@
 ---
 - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
   apt:
-    name: ['apt-transport-https', 'ca-certificates']
+    name:
+      - apt-transport-https
+      - ca-certificates
     state: present
+  register: kibana_installing_ca_package
+  until: kibana_installing_ca_package is succeeded
 
 - name: Debian/Ubuntu | Add Elasticsearch GPG key
   apt_key:
@@ -15,10 +19,13 @@
     state: present
     filename: 'elastic_repo'
     update_cache: true
+  changed_when: false
 
 - name: Debian/Ubuntu | Install Kibana
   apt:
     name: "kibana={{ elastic_stack_version }}"
     state: present
     cache_valid_time: 3600
+  register: installing_kibana_package
+  until: installing_kibana_package is succeeded
   tags: install

roles/elastic-stack/ansible-kibana/tasks/RMDebian.yml

@@ -3,3 +3,4 @@
   apt_repository:
     repo: deb https://artifacts.elastic.co/packages/5.x/apt stable main
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-kibana/tasks/RMRedHat.yml

@@ -3,3 +3,4 @@
   yum_repository:
     name: elastic_repo
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-kibana/tasks/RedHat.yml

@@ -6,7 +6,10 @@
     baseurl: https://artifacts.elastic.co/packages/6.x/yum
     gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     gpgcheck: true
+  changed_when: false
 
 - name: RedHat/CentOS/Fedora | Install Kibana
   package: name=kibana-{{ elastic_stack_version }} state=present
+  register: installing_kibana_package
+  until: installing_kibana_package is succeeded
   tags: install

roles/elastic-stack/ansible-kibana/tasks/main.yml

@@ -17,6 +17,7 @@
     - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
 
 - name: Kibana configuration
   template:
@@ -29,8 +30,11 @@
   tags: configure
 
 - name: Checking Wazuh-APP version
-  shell: "grep -c -E 'version.*{{ elastic_stack_version }}' /usr/share/kibana/plugins/wazuh/package.json | xargs echo"
+  shell: |
+    set -o pipefail
+    grep -c -E 'version.*{{ elastic_stack_version }}' /usr/share/kibana/plugins/wazuh/package.json | xargs echo
   args:
+    executable: /bin/bash
     removes: /usr/share/kibana/plugins/wazuh/package.json
   register: wazuh_app_verify
   changed_when: false
@@ -51,9 +55,13 @@
   environment:
     NODE_OPTIONS: "--max-old-space-size=3072"
   args:
+    executable: /bin/bash
     creates: /usr/share/kibana/plugins/wazuh/package.json
   notify: restart kibana
-  tags: install
+  ignore_errors: "{{ kibana_plugin_install_ignore_error }}"
+  tags:
+    - install
+    - skip_ansible_lint
 
 - name: Ensure Kibana started and enabled
   service:

roles/elastic-stack/ansible-kibana/templates/kibana.yml.j2

@@ -19,7 +19,7 @@ server.host: {{ kibana_server_host }}
 #server.name: "your-hostname"
 
 # The URL of the Elasticsearch instance to use for all your queries.
-elasticsearch.url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"
+elasticsearch.hosts: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"
 
 # When this setting's value is true Kibana uses the hostname specified in the server.host
 # setting. When the value of this setting is false, Kibana uses the hostname of the host

roles/elastic-stack/ansible-logstash/tasks/Debian.yml

@@ -1,7 +1,9 @@
 ---
 - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
   apt:
-    name: ['apt-transport-https', 'ca-certificates']
+    name:
+      - apt-transport-https
+      - ca-certificates
     state: present
 
 - when: logstash_install_java
@@ -20,6 +22,7 @@
     repo: 'deb https://artifacts.elastic.co/packages/6.x/apt stable main'
     state: present
     filename: 'elastic_repo'
+  changed_when: false
 
 - name: Debian/Ubuntu | Install Logstash
   apt:
@@ -31,7 +34,8 @@
 - name: Debian/Ubuntu | Checking if wazuh-manager is installed
   command: dpkg -l wazuh-manager
   register: wazuh_manager_check_deb
-  when: logstash_input_beats == false
+  when: not logstash_input_beats
+  changed_when: false
   args:
     warn: false
 
@@ -41,5 +45,5 @@
     groups: ossec
     append: true
   when:
-    - logstash_input_beats == false
+    - not logstash_input_beats
     - wazuh_manager_check_deb.rc == 0

roles/elastic-stack/ansible-logstash/tasks/RMDebian.yml

@@ -3,3 +3,4 @@
   apt_repository:
     repo: deb https://artifacts.elastic.co/packages/5.x/apt stable main
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-logstash/tasks/RMRedHat.yml

@@ -3,3 +3,4 @@
   yum_repository:
     name: elastic_repo
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-logstash/tasks/RedHat.yml

@@ -13,6 +13,7 @@
     baseurl: https://artifacts.elastic.co/packages/6.x/yum
     gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     gpgcheck: true
+  changed_when: false
 
 - name: RedHat/CentOS/Fedora | Install Logstash
   package: name=logstash-{{ elastic_stack_version }} state=present
@@ -22,7 +23,8 @@
 - name: RedHat/CentOS/Fedora | Checking if wazuh-manager is installed
   command: rpm -q wazuh-manager
   register: wazuh_manager_check_rpm
-  when: logstash_input_beats == false
+  when: not logstash_input_beats
+  changed_when: false
   args:
     warn: false
 
@@ -32,12 +34,14 @@
     groups: ossec
     append: true
   when:
-    - logstash_input_beats == false
+    - not logstash_input_beats
     - wazuh_manager_check_rpm.rc == 0
 
 - name: Amazon Linux change startup group
   shell: sed -i 's/.*LS_GROUP=logstash.*/LS_GROUP=ossec/' /etc/logstash/startup.options
+  tags:
+    - skip_ansible_lint
   when:
-    - logstash_input_beats == false
+    - not logstash_input_beats
     - wazuh_manager_check_rpm.rc == 0
     - ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA"

roles/elastic-stack/ansible-logstash/tasks/main.yml

@@ -15,10 +15,23 @@
     - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
 
 - name: Amazon Linux create service
   shell: /usr/share/logstash/bin/system-install /etc/logstash/startup.options
   when: ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA"
+  args:
+    creates: /etc/default/logstash
+  tags:
+    - skip_ansible_lint
+
+- name: Amazon Linux create service
+  shell: /usr/share/logstash/bin/system-install /etc/logstash/startup.options
+  when: ansible_distribution == "CentOS" and ansible_distribution_major_version == "6"
+  args:
+    creates: /etc/default/logstash
+  tags:
+    - skip_ansible_lint
 
 - name: Ensure Logstash started and enabled
   service:

roles/wazuh/ansible-filebeat/tasks/Debian.yml

@@ -1,9 +1,12 @@
 ---
 - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
   apt:
-    name: ['apt-transport-https', 'ca-certificates']
+    name:
+      - apt-transport-https
+      - ca-certificates
     state: present
-
+  register: filebeat_ca_packages_install
+  until: filebeat_ca_packages_install is succeeded
 
 - name: Debian/Ubuntu | Add Elasticsearch apt key.
   apt_key:
@@ -15,3 +18,4 @@
     repo: 'deb https://artifacts.elastic.co/packages/6.x/apt stable main'
     state: present
     update_cache: true
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/RMDebian.yml

@@ -3,3 +3,4 @@
   apt_repository:
     repo: deb https://artifacts.elastic.co/packages/5.x/apt stable main
     state: absent
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/RMRedHat.yml

@@ -3,3 +3,4 @@
   yum_repository:
     name: elastic_repo
     state: absent
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/RedHat.yml

@@ -6,3 +6,4 @@
     baseurl: https://artifacts.elastic.co/packages/6.x/yum
     gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     gpgcheck: true
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/main.yml

@@ -7,6 +7,8 @@
 
 - name: Install Filebeat.
   package: name=filebeat state=present
+  register: filebeat_installing_package
+  until: filebeat_installing_package is succeeded
   tags:
     - install
 
@@ -20,6 +22,7 @@
     - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
 
 - name: Ensure Filebeat is started and enabled at boot.
   service: