[Bug]: elasticsearch_http_security: false leaves every client role talking https to an http endpoint

Component

The Elasticsearch URLs in the kibana, beats and logstash roles.

What happens

elasticsearch_http_security (declared in the elasticsearch role, default true) turns off HTTP TLS while security stays on:

elasticsearch_http_security:
  type: bool
  default: true
  description: Enable TLS on the HTTP layer (xpack.security.http.ssl).
               Only effective when elasticsearch_security is enabled.

Set to false, elasticsearch.yml.j2:76-80 leaves out the http.ssl block. Elasticsearch keeps xpack.security.enabled: true, credentials are still required, and the REST API listens on plain http.

No role outside the elasticsearch role knows that variable. Every other place that builds an Elasticsearch URL picks its scheme from the local *_security flag instead, which is a different question:

So elasticsearch_security: true together with elasticsearch_http_security: false leaves every client role talking https to an http endpoint. The two module calls have no http form at all, and even with one they would still fail, because api.py builds an SSLContext unconditionally, see #549.

The combination is set in none of the 11 molecule scenarios, so it has never been exercised.

How to reproduce

Run the stack with elasticsearch_security: true and elasticsearch_http_security: false.

What we want

• the scheme of every Elasticsearch URL follows elasticsearch_http_security, not the local *_security flag
• logstash.yml.j2:21 and the two module calls in logstash-security.yml get an http form
• a molecule scenario covers elasticsearch_http_security: false

#530 already states the target for kibana, "Kibana→ES TLS follows elasticsearch_http_security (Kibana must match ES's http/https)", and #526 puts the credentials-over-http case behind the elasticstack_allow_insecure_auth guard. What is missing there is logstash and beats, and the two module calls.

The api.py half is #549. Fixing that one without this one is possible, the other way round is not.

Part of #526.

Start with the Elasticsearch URL construction in roles/kibana/templates/kibana.yml.j2, roles/beats/templates/{filebeat,auditbeat,metricbeat}.yml.j2, and roles/logstash/templates/logstash.yml.j2, then inspect the two module calls in roles/logstash/tasks/logstash-security.yml. Run the relevant Molecule scenarios and add coverage for elasticsearch_security: true with elasticsearch_http_security: false; done means every client uses the Elasticsearch HTTP scheme and Logstash has HTTP forms for the listed calls.