Add shield support about ansible-elasticsearch

[gingerwizard]

The plan is to hold off shield support until we have an API in ES - due in later versions. I'd also rather we address this with templates. We also need to improve plugin management - see #59

[barryib]

I understand your point and I'm definitely agree to use an API. But is this API planned for the next ES release? Any date? Is this future API will also work for plugins management?

Btw, we actually need the shield support. So I'll create a separate (temporary) role for our business cases.

[barryib]

I submitted a PR for an ansible module to manage esusers while waiting for the api.

[babadofar]

I have worked with this ansible role which has support for shield https://github.com/makingwaves/ansible-elasticsearch
It has some logic to create users. For the roles and role mappings, it simply copies in files. There are too many settings in there to manage with the standard ansible variables. I really like the mapping functionality used for setting variables in elasticsearch.yml in the official elasticsearch role, should have used that.
Perhaps this can give you some inspiration:)

[gingerwizard]

@barryib @babadofar the shield API is now being targeted for version 2.3 - which will be very soon.
For this reason im considering adding shield support to the ansible role. We need to decide what this is likely to support and split it into multiple requests. Initially, i would propose (based on what the API supports) to add

1. management of the es_realm users i.e. adding, removing a user inc. the ability to manage the groups to which they belong
2. Management of the indices and clysters permissions for each role

We can later add support for SSL and other realms.

[barryib]

Hello @gingerwizard, I agree with that.

But so far, the first admin user should be created with esusers binary.

[barryib]

Hi, another update on this thread... Now the elasticsearch_esusers module became eslasticsearch_shield_user. The module supports the esusers and esnative (with the shield api) realm.

Here is the PR #2528 on the ansible-modules-extras repository.

Plus another module to manage the shield role PR #2529

PS: I'm actually using these in production.

[gingerwizard]

@barryib moving this to #124
as i think its a larger discussion on how to support xpack.