From fc608faf77a0c9b5be1b701508065912a26429f5 Mon Sep 17 00:00:00 2001 From: oddly Date: Sun, 7 Jun 2026 21:14:35 +0200 Subject: [PATCH] fix(elasticsearch): gate remaining tasks on check mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two paths in the elasticsearch role still attempted runtime operations under --check: The no-security cluster setup block hit the cluster health API with ignore_errors set to ansible_check_mode. The retry loop (30 × 10s) still ran, so a check-mode pass wasted up to five minutes waiting on an endpoint that cannot be reached without a running service. Moved the check-mode guard to the block-level when so the whole branch is skipped instead. The handler that restarts Kibana after an Elasticsearch certificate change had no check-mode guard, so it would attempt service restarts and HTTP probes against a Kibana that isn't necessarily up. Added the same not ansible_check_mode condition the other restart handlers in this file already use. Closes #25. --- roles/elasticsearch/handlers/main.yml | 1 + roles/elasticsearch/tasks/main.yml | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/elasticsearch/handlers/main.yml b/roles/elasticsearch/handlers/main.yml index d34a9be..94009e7 100644 --- a/roles/elasticsearch/handlers/main.yml +++ b/roles/elasticsearch/handlers/main.yml @@ -56,6 +56,7 @@ loop: "{{ groups[elasticstack_kibana_group_name] | default([]) }}" run_once: true when: + - not ansible_check_mode - elasticstack_full_stack | bool - "not 'renew_ca' in ansible_run_tags" - "not elasticstack_ca_will_expire_soon | bool" diff --git a/roles/elasticsearch/tasks/main.yml b/roles/elasticsearch/tasks/main.yml index 8339e91..d9401a8 100644 --- a/roles/elasticsearch/tasks/main.yml +++ b/roles/elasticsearch/tasks/main.yml @@ -558,14 +558,15 @@ # so the finding is a false positive - name: Handle cluster setup without security - when: not elasticsearch_security | bool + when: + - not elasticsearch_security | bool + - not ansible_check_mode block: - name: Check for cluster status without security ansible.builtin.uri: # kics-scan ignore-line url: "http://{{ elasticsearch_api_host }}:{{ elasticstack_elasticsearch_http_port }}/_cluster/health?pretty" register: elasticsearch_cluster_status - ignore_errors: "{{ ansible_check_mode }}" until: ((elasticsearch_cluster_status.json | default({})).status | default('')) in ['green', 'yellow'] retries: 30 delay: 10