The handler "Restart kibana if available for elasticsearch certificates" (elasticsearch/handlers/main.yml) iterates the Kibana inventory group and delegates the restart per host — but restart_kibana.yml runs package_facts on the Elasticsearch host (no delegate_to) and then guards the restart with 'kibana' in ansible_facts.packages. So it checks the ES host's packages, not the Kibana host's. Effect: in a split deployment (Kibana on its own host) it never restarts the remote Kibana; it only fires when Kibana is co-located on the ES host.
Two fixes:
- Correct the host mismatch (gather/check package facts on the Kibana host being restarted, or drop the check and rely on the group).
- Drop the
elasticstack_full_stack gate. It is redundant: the handler already guards on groups[elasticstack_kibana_group_name] | default([]) | length > 0, so with no Kibana group it is a no-op — in both full-stack and standalone. Removing it is therefore not breaking.
Also worth questioning: whether a Kibana restart is needed at all on an ES certificate change — with an unchanged CA, Kibana keeps trusting ES via the CA and reconnects on its own.
Bug fix → 1.0.0. Part of #531 (removes the full_stack meaning "(D) cross-host handler").
The handler "Restart kibana if available for elasticsearch certificates" (
elasticsearch/handlers/main.yml) iterates the Kibana inventory group and delegates the restart per host — butrestart_kibana.ymlrunspackage_factson the Elasticsearch host (nodelegate_to) and then guards the restart with'kibana' in ansible_facts.packages. So it checks the ES host's packages, not the Kibana host's. Effect: in a split deployment (Kibana on its own host) it never restarts the remote Kibana; it only fires when Kibana is co-located on the ES host.Two fixes:
elasticstack_full_stackgate. It is redundant: the handler already guards ongroups[elasticstack_kibana_group_name] | default([]) | length > 0, so with no Kibana group it is a no-op — in both full-stack and standalone. Removing it is therefore not breaking.Also worth questioning: whether a Kibana restart is needed at all on an ES certificate change — with an unchanged CA, Kibana keeps trusting ES via the CA and reconnects on its own.
Bug fix → 1.0.0. Part of #531 (removes the full_stack meaning "(D) cross-host handler").