Use variable to manage the container related tasks

molecule/beats_default/converge.yml

@@ -8,6 +8,7 @@
   collections:
     - netways.elasticstack
   vars:
+    elasticstack_ci: true
     elasticstack_full_stack: false
     elasticsearch_jna_workaround: true
     elasticsearch_disable_systemcallfilterchecks: true

molecule/beats_extended/converge.yml

@@ -8,6 +8,7 @@
   collections:
     - netways.elasticstack
   vars:
+    elasticstack_ci: true
     beats_filebeat_log_inputs:
       messages:
         name: messages

molecule/elasticsearch_default/converge.yml

@@ -6,6 +6,7 @@
     - netways.elasticstack
   hosts: all
   vars:
+    elasticstack_ci: true
     #elasticsearch_security: true # needed for tests of > 7 releases
     elasticstack_full_stack: false
     elasticsearch_jna_workaround: true

molecule/elasticsearch_roles_calculation/converge.yml

@@ -6,6 +6,7 @@
     - netways.elasticstack
   hosts: all
   vars:
+    elasticstack_ci: true
     elasticsearch_jna_workaround: true
     elasticsearch_disable_systemcallfilterchecks: true
     elasticstack_release: "{{ lookup('env', 'ELASTIC_RELEASE') | int}}"

molecule/elasticstack_default/converge.yml

@@ -10,6 +10,7 @@
     - netways.elasticstack
   hosts: all
   vars:
+    elasticstack_ci: true
     elasticsearch_jna_workaround: true
     elasticsearch_disable_systemcallfilterchecks: true
     elasticsearch_monitoring_enabled: false

molecule/kibana_default/converge.yml

@@ -6,6 +6,7 @@
 - name: Converge
   hosts: all
   vars:
+    elasticstack_ci: true
     elasticstack_full_stack: false
     elasticstack_release: "{{ lookup('env', 'ELASTIC_RELEASE') | int}}"
     elasticstack_no_log: false

molecule/logstash_pinned_version/converge.yml

@@ -8,6 +8,7 @@
   collections:
     - netways.elasticstack
   vars:
+    elasticstack_ci: true
     logstash_manage_logging: true
     logstash_logging_console: false
     logstash_logging_slow_file: false

molecule/logstash_pipelines/converge.yml

@@ -9,6 +9,7 @@
   collections:
     - netways.elasticstack
   vars:
+    elasticstack_ci: true
     logstash_enable: true
     logstash_pipelines:
       - name: syslog

molecule/plugins/converge.yml

@@ -4,6 +4,7 @@
     - netways.elasticstack
   hosts: all
   vars:
+    elasticstack_ci: true
     elasticstack_full_stack: false
     elasticsearch_jna_workaround: true
     elasticsearch_disable_systemcallfilterchecks: true

molecule/repos_default/converge.yml

@@ -4,6 +4,7 @@
   collections:
     - netways.elasticstack
   vars:
+    elasticstack_ci: true
     elasticstack_rpm_workaround: true
     elasticstack_full_stack: false
     elasticstack_release: "{{ lookup('env', 'ELASTIC_RELEASE') | int}}"

molecule/repos_oss/converge.yml

@@ -6,6 +6,7 @@
   collections:
     - netways.elasticstack
   vars:
+    elasticstack_ci: true
     elasticstack_variant: oss
     elasticstack_rpm_workaround: true
     elasticstack_release: "{{ lookup('env', 'ELASTIC_RELEASE') | int}}"

roles/beats/tasks/main.yml

@@ -82,4 +82,4 @@
   ansible.builtin.command: >
     rm -rf /var/cache/*
   changed_when: false
-  when: ansible_virtualization_type == "container" or ansible_virtualization_type == "docker"
+  when: elasticstack_ci | bool

roles/elasticsearch/tasks/elasticsearch-security.yml

@@ -1,24 +1,24 @@
 ---
 
 - name: Ensure ca exists
   ansible.builtin.stat:
     path: "{{ elasticstack_ca_dir }}/elastic-stack-ca.p12"
   register: elasticstack_ca_exists
   when: inventory_hostname == elasticstack_ca_host
 
 - name: Get CA informations
   cert_info:
     path: "{{ elasticstack_ca_dir }}/elastic-stack-ca.p12"
     passphrase: "{{ elasticstack_ca_pass | default(omit, true) }}"
   register: elasticstack_ca_infos
   when: inventory_hostname == elasticstack_ca_host and elasticstack_ca_exists.stat.exists | bool
 
 - name: Set the ca expiration date in days
   ansible.builtin.set_fact:
     elasticstack_ca_expiration_days: "{{ ((elasticstack_ca_infos.not_valid_after | to_datetime()) - (ansible_date_time.date | to_datetime('%Y-%m-%d'))).days }}"
   when: inventory_hostname == elasticstack_ca_host and elasticstack_ca_infos.skipped is not defined
 
 - name: Set ca will expire soon to true
   ansible.builtin.set_fact:
     elasticstack_ca_will_expire_soon: true
   when: >
@@ -58,7 +58,7 @@
       register: elasticsearch_check_ca_path
 
     - name: Move the ca directory on elasticsearch ca host
       ansible.builtin.copy:
         src: "{{ elasticstack_ca_dir }}"
         dest: "{{ elasticstack_ca_dir }}_{{ ansible_date_time.iso8601_micro }}"
         mode: preserve
@@ -80,7 +80,7 @@
       become: false
 
     - name: Move temporary ca file on Ansible controller
       ansible.builtin.copy:
         src: "{{ lookup('config', 'DEFAULT_LOCAL_TMP') | dirname }}/ca.crt"
         dest: "{{ lookup('config', 'DEFAULT_LOCAL_TMP') | dirname }}/ca.crt_{{ ansible_date_time.iso8601_micro }}"
         mode: preserve
@@ -165,7 +165,7 @@
       register: elasticsearch_check_cert_file
 
     - name: Move cert file on elasticstack_ca_host
       ansible.builtin.copy:
         src: "{{ elasticstack_ca_dir }}/{{ ansible_hostname }}.p12"
         dest: "{{ elasticstack_ca_dir }}/{{ ansible_hostname }}.p12_{{ ansible_date_time.iso8601_micro }}"
         mode: preserve
@@ -193,7 +193,7 @@
       register: elasticsearch_check_temporary_cert
 
     - name: Move temporary cert on Ansible controller
       ansible.builtin.copy:
         src: "{{ lookup('config', 'DEFAULT_LOCAL_TMP') | dirname }}/{{ ansible_hostname }}.p12"
         dest: "{{ lookup('config', 'DEFAULT_LOCAL_TMP') | dirname }}/{{ ansible_hostname }}.p12_{{ ansible_date_time.iso8601_micro }}"
         mode: preserve
@@ -433,7 +433,7 @@
   retries: 5
   delay: 10
 
 - name: Fetch Elastic password # noqa: risky-shell-pipe
   ansible.builtin.shell: >
     if test -n "$(ps -p $$ | grep bash)"; then set -o pipefail; fi;
     grep "PASSWORD elastic" {{ elasticstack_initial_passwords }} |
@@ -461,7 +461,7 @@
   delay: 10
 
 - name: Work around low ressources on CI/CD nodes
-  when: ansible_virtualization_type == "container" or ansible_virtualization_type == "docker"
+  when: elasticstack_ci | bool
   block:
     # Free up some space to let elsticsearch allocate replica in GitHub Action
     - name: Remove cache

roles/elasticsearch/tasks/main.yml

@@ -239,7 +239,7 @@
   ansible.builtin.command: >
     rm -rf /var/cache/*
   changed_when: false
-  when: ansible_virtualization_type == "container" or ansible_virtualization_type == "docker"
+  when: elasticstack_ci | bool
 
 - name: Import Tasks elasticsearch-security.yml
   ansible.builtin.import_tasks: elasticsearch-security.yml
@@ -268,7 +268,7 @@
     - name: Check for cluster status without security
       ansible.builtin.uri:
 # kics-scan ignore-line
         url: "http://{{ elasticsearch_api_host }}:{{ elasticstack_elasticsearch_http_port }}/_cluster/health?pretty"
       register: elasticsearch_cluster_status
       ignore_errors: "{{ ansible_check_mode }}"
       until: elasticsearch_cluster_status.json.status == "green"

roles/elasticstack/README.md

@@ -62,5 +62,6 @@ The role runs automatically the first time any component role is applied to a ho
 | `elasticstack_no_log` | `bool` | `true` | — | Hide the output of tasks that could reveal passwords. Set to false for debugging. |
 | `elasticstack_manage_pip` | `bool` | `false` | — | Install pip on the target host. |
 | `elasticstack_force_pip` | `bool` | `false` | — | Force installation of the required Python modules via pip (useful when the distribution packages are too old). See PEP 668. |
+| `elasticstack_ci` | `bool` | `false` | — | Internal test flag. Set to true only by the collection's molecule scenarios to enable resource workarounds needed on constrained test runners (cache cleanup, relaxed Elasticsearch disk watermarks). Never set this on a real installation. |
 
 <!-- ANSIBLE DOCSMITH MAIN END -->

roles/elasticstack/defaults/main.yml

@@ -29,3 +29,6 @@ elasticstack_manage_pip: false
 
   # for debugging only
 elasticstack_no_log: true
+
+# Internal test flag: set to true by the molecule scenarios only, never on real installations
+elasticstack_ci: false

roles/elasticstack/meta/argument_specs.yml

@@ -191,3 +191,13 @@ argument_specs:
         description: >-
           Force installation of the required Python modules via pip (useful when
           the distribution packages are too old). See PEP 668.
+
+      # ----- Testing -----
+      elasticstack_ci:
+        type: bool
+        default: false
+        description: >-
+          Internal test flag. Set to true only by the collection's molecule
+          scenarios to enable resource workarounds needed on constrained test
+          runners (cache cleanup, relaxed Elasticsearch disk watermarks). Never
+          set this on a real installation.

roles/kibana/tasks/main.yml

@@ -144,4 +144,4 @@
   ansible.builtin.command: >
     rm -rf /var/cache/*
   changed_when: false
-  when: ansible_virtualization_type == "container" or ansible_virtualization_type == "docker"
+  when: elasticstack_ci | bool

roles/logstash/tasks/main.yml

@@ -317,4 +317,4 @@
   ansible.builtin.command: >
     rm -rf /var/cache/*
   changed_when: false
-  when: ansible_virtualization_type == "container" or ansible_virtualization_type == "docker"
+  when: elasticstack_ci | bool