Enable ca/cert management

[afeefghannam89]

• Enable renew CA
• Enable renew Elasticsearch cert
• Enable renew Logstash cert
• Enable renew Kibana cert
• Enable renew beats cert
• Check CA and Certs validity date and renew them
• Let Logstash write data on disk
• Prevent Logstash to stick by Elasticsearch dead connection
• Make sure certificate handling is idempotent and reacts to changes Make sure certificate handling is idempotent and reacts to changes #35
• Make Kibana use its certificate and not share the on from elasticsearch kibana uses the same certificate from elasticsearch #56
• Let Kibana start after reboot Kibana does not start after reboot #57 Optionally enable Kibana #69
• Allow to use persisted queues per pipeline Allow to use persisted queues per pipeline #60
• Restart the available beat service when create or renew certificates Restart the available beat service when create or renew certificates #83

[widhalmt]

I love how you work with tags everywhere and how you use tags for one-shot runs like when renewing certificates.

I'm not 100% sure if renewing client certificates wouldn't make sense as a variable. This way you could just enable it and have them replaced as soon as they close in on the end of their validity.

Most comments are things I'm wondering and I'm not really sure if there needs to be a change. Please don't read them as a request for an actual change. It's more of a "did you have time to test"?

The only real changes I see are that handlers are missing (we talked about that offline) and the per queue setting (with global default) of queue type and size.

[afeefghannam89]

I love how you work with tags everywhere and how you use tags for one-shot runs like when renewing certificates.

I'm not 100% sure if renewing client certificates wouldn't make sense as a variable. This way you could just enable it and have them replaced as soon as they close in on the end of their validity.

Most comments are things I'm wondering and I'm not really sure if there needs to be a change. Please don't read them as a request for an actual change. It's more of a "did you have time to test"?

The only real changes I see are that handlers are missing (we talked about that offline) and the per queue setting (with global default) of queue type and size.

Thanks :) I like tags more than variable, because they are more flexible by management of changes, the user should not change any variable value when he would like to run a snippet of Ansible code. The variable will come later when we check the validity of certificate. This variable will be set to the conditions of certificate renew tasks. So the user does not have to manipulate any variable value, this will enforce automatism Principe

[widhalmt]

Wow, that was a big one to review. :-)

The only real change I can request is the missing "newline" character. The rest is more "I'm not sure, can you give me information about it". So I guess, it's very close to being finished.

The "boolean" for the queue type was just an idea. I guess, it's not worth editing everything again just for that.

[widhalmt]

Please merge main into this branch. It should help with fixing some problems.

[widhalmt]

I fixed some lint so checks can go through. I'm right now testing this on a local system.

[widhalmt]

Changing the Logstash certificate works for me. But only for the elasticsearch output, not for monitoring Since xpack.monitoring was deprecated with Elastic Stack 7 anyway, I'll add a condition so that it will be removed from 8 setups.

[widhalmt]

I just found one typo and 2 missing prefixes for variable names. Everything else looks not just good but excellent to me!