NETWAYS / NETWAYS/ansible-collection-elasticstack
[Feature]: Elasticsearch — support xpack.security.http.ssl.client_authentication (request client certs)
Nobody has claimed this yet.
- Dominant language
- Jinja
- Stars
- 14
- Forks
- 11
- Avg merge
- 1d 47m
- Merged PRs (30d)
- 6
Description
The server half of mutual TLS: by default Elasticsearch does not request a client certificate (security settings). Add support for xpack.security.http.ssl.client_authentication (optional / required) so ES requests and validates a client certificate on the HTTP layer.
Without this, any client certificate presented by Beats/Logstash/Kibana is ignored (which is exactly today's state). Requires HTTP TLS to be on (elasticsearch_http_security). Opt-in, default none (unchanged behaviour).
Foundation for the client-side children — they depend on this. Part of #536. 2.0.0.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Elasticsearch HTTP TLS configuration controlled by elasticsearch_http_security and trace how the security settings are rendered. Add support for xpack.security.http.ssl.client_authentication with optional and required values while preserving none as the default, then verify the generated configuration and HTTP TLS behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ansible, elasticsearch
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100