initial commit for shield. users and roles only

manifests/init.pp

@@ -182,6 +182,11 @@
 #   package upgrades.
 #   Defaults to: true
 #
+# [*shield_users_merge*]
+#   Enable Hiera's merging function for shield users
+#   Defaults to: false
+#
+#
 # The default values for the parameters are set in elasticsearch::params. Have
 # a look at the corresponding <tt>params.pp</tt> manifest file if you need more
 # technical information about them.
@@ -246,7 +251,8 @@
   $instances             = undef,
   $instances_hiera_merge = false,
   $plugins               = undef,
-  $plugins_hiera_merge   = false
+  $plugins_hiera_merge   = false,
+  $shield_users_merge = false,
 ) inherits elasticsearch::params {
 
   anchor {'elasticsearch::begin': }
@@ -359,6 +365,16 @@
     create_resources('elasticsearch::plugin', $x_plugins)
   }
 
+  # Hiera support for esusers
+  validate_bool($shield_users_merge)
+
+  if $shield_users_merge == true {
+    $esusers = hiera_hash('elasticsearch::esusers', $::elasticsearch::esusers)
+    if $esusers {
+      validate_hash($esusers)
+      create_resources('elasticsearch::shield::esuser', $esusers)
+    }
+  }
 
   if $java_install == true {
     # Install java

manifests/shield/esuser.pp

@@ -0,0 +1,31 @@
+#
+# == Class: elasticsearch::shield::esuser
+#
+#  Class to manage creating users in elasticsearch via the shield plugin
+#
+# == Parameters
+#
+#  [*username*]
+#    String to use for a username
+#
+#  [*password*]
+#    String to use for a password
+#
+define elasticsearch::shield::esuser($username, $password, $roles=$title) {
+  if $username == undef {
+    fail('user must be specified')
+  }
+  validate_string($username)
+  if $password == undef {
+    fail('password must be specified')
+  }
+  validate_slength($password, 4192, 6)
+
+  # TODO: what happens if we add roles - this route we only set role on useradd
+  exec { "useradd shield::esuser::${username}":
+    user    => $::elasticsearch::elasticsearch_user,
+    path    => [ '/usr/bin', '/usr/share/elasticsearch/bin/shield' ],
+    command => "esusers useradd ${username} -p \"${password}\" -r ${roles} &> /dev/null",
+    unless  => "esusers list ${username} &> /dev/null",
+  }
+}