[Feature]: Kibana — remove kibana_security (ES connection follows Elasticsearch; keep kibana_tls)

Open
#530 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
ansible, elasticsearch
Domain
devops, infrastructure

Research direction

Start by reviewing the shared masters and guard from #527 and the collection-wide insecure-auth guard in #526. Rename kibana-security.yml to kibana_manage_certificates.yml, move the kibana_system password fetch, and verify the ES connection follows elasticsearch_http_security while kibana_tls remains unchanged. Done means kibana_security is removed and the secured and insecure combinations are covered.

Written by the indexing model from the issue text.

Description

component:kibana

Unlike Beats/Logstash, Kibana's Elasticsearch connection has no independent auth/TLS choice — it is dictated by Elasticsearch, so Kibana does not get the *_authentication / *_tls split.

Background (why):

  • Kibana has no separate xpack.security.enabled in 8.x; it follows Elasticsearch — "you do not need to disable security features in those kibana.yml files" (Configure security in Kibana).
  • Kibana→ES authentication is therefore ES-dictated: xpack.security.enabled "must be enabled to use Elasticsearch's authentication, authorization and audit features" and is mandatory in 8 (Security settings). When ES security is on, Kibana must send its kibana_system credentials — it cannot connect anonymously. A kibana_authentication flag would be meaningless.
  • Kibana→ES TLS follows elasticsearch_http_security (Kibana must match ES's http/https) — not a Kibana-owned switch.
  • Kibana's only genuinely own switch is kibana_tls (the browser-facing server.ssl).

Change:

  • Remove kibana_security. The ES-connection block (https + CA + kibana_system credentials) renders whenever Kibana talks to a secured ES (i.e. it follows Elasticsearch), with the http/https scheme following elasticsearch_http_security.
  • Keep kibana_tls unchanged (server side).
  • Rename kibana-security.yml → kibana_manage_certificates.yml; move the kibana_system-password fetch out.
  • The insecure combo (ES security on + elasticsearch_http_security: false → kibana_system credentials over http) is covered by the collection-wide elasticstack_allow_insecure_auth guard (see #526).

Breaking → 2.0.0. Part of #526.

Depends on: #527 (the shared masters + guard must exist first).

Dominant language
Jinja
Stars
14
Forks
11
Avg merge
1d 47m
Merged PRs (30d)
6

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from NETWAYS/ansible-collection-elasticstack

All issues in NETWAYS/ansible-collection-elasticstack

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.