# Ensure setup files are accessible

sudo su - elasticadmin
chmod 777 /tmp/jdk-8u161-linux-x64.tar.gz
chmod 777 /tmp/elasticsearch_7.8.0.tar
chmod 777 /tmp/repository-azure-7.8.0.zip
chmod 777 /tmp/support-diagnostics-8.1.1.tar.gz

#
----------------------------------------------------------------------------------
# Update .bash_profile and .bashrc
sudo su - elastic
# custom prompt
export PS1='\u@\h:\w \$ '
#
----------------------------------------------------------------------------------

#
----------------------------------------------------------------------------------
# I. JAVA Install (JDK 1.8.0_161)
sudo su - elastic
mkdir -p /opt/app/java
gunzip /tmp/jdk-8u161-linux-x64.tar.gz
tar -C /opt/app/java -xf /tmp/jdk-8u161-linux-x64.tar
export JAVA_HOME=/opt/app/java/jdk1.8.0_161
export PATH=${PATH}:${JAVA_HOME}/bin
exit

sudo su - elastic
env|grep JAVA_HOME
env|grep PATH
which java

vi $HOME/.bash_profile
export JAVA_HOME=/opt/app/java/jdk1.8.0_161
export PATH=$PATH:$JAVA_HOME/bin

exit
#
----------------------------------------------------------------------------------

#
----------------------------------------------------------------------------------
# II. Elasticsearch Install (v7.8.0)
sudo su - elastic
mkdir -p /opt/app/elastic/7.8.0
tar -C /opt/app/elastic/7.8.0 -xf /tmp/elasticsearch_7.8.0.tar
mv -f /opt/app/elastic/7.8.0/elasticsearch_7.8.0/* /opt/app/elastic/7.8.0
rm -rf /opt/app/elastic/7.8.0/elasticsearch_7.8.0

vi $HOME/.bash_profile
export ES_HOME=/opt/app/elastic/7.8.0
export ES_PATH_CONF=${ES_HOME}/config
export ES_CLASSPATH=${ES_HOME}/lib
exit
sudo su - elastic
env|grep ES_HOME
env|grep ES_PATH_CONF
env|grep ES_CLASSPATH
mkdir -p /opt/app/elastic/7.8.0/certs

cp /opt/app/elastic/7.8.0/att_config_files/elasticsearch.yml
/opt/app/elastic/7.8.0/config
cp /opt/app/elastic/7.8.0/att_config_files/non_prod_license_exp_20200829.json
/opt/app/elastic/7.8.0/config
mv /opt/app/elastic/7.8.0/config/role_mapping.yml
/opt/app/elastic/7.8.0/config/role_mapping.yml_`date +'%Y%m%d'`
cp /opt/app/elastic/7.8.0/att_config_files/role_mapping.yml
/opt/app/elastic/7.8.0/config
cp /opt/app/elastic/7.8.0/att_config_files/jvm.options
/opt/app/elastic/7.8.0/config

# Create Elastic keystore

echo y | /opt/app/elastic/7.8.0/bin/elasticsearch-keystore create
test -f /opt/app/elastic/7.8.0/config/elasticsearch.keystore && echo "Elasticsearch
keystore created"

#
----------------------------------------------------------------------------------

#
***********************************************************************************
***************************************************************
### *** kj8351 07/14/2020 ***
### Retrieve credentials from Keyvault - elastcpockeyvault
### Not using AZ commands

### Script name - /home/elastic/update_elastic_keystore.sh

### (contents below)
#!/bin/bash

### *** START ***

# Login
login_status=`az login --identity`

# 1. Check if access to Coral Prod. subscription exists

coral_subscription_id=`echo $login_status | jq -r '.[] | select (.name=="ACC-PROD-
26959-ATT CORAL DESKTOP") | .id'`

# 2. Check if access to ICMGenAdapter subscription exists

icmgenadpt_subscription_id=`echo $login_status | jq -r '.[] | select (.name=="ACC-
PROD-20813-ATT CCTP ICM GEN ADAPTER FRAME") | .id'`

# If one/both are <NULL>, exit

if [ -z "$coral_subscription_id" ] || [ -z "$icmgenadpt_subscription_id" ]
then
echo "*** ERROR *** Insufficient access to Azure Coral, ICMGenAdapter
subscriptions. Exiting ***"
exit 0
fi

# Access exists to both Coral Prod. AND ICMGenAdapter subscriptions

# Change to Coral Prod. subscription
az account set --subscription $coral_subscription_id

# get key1 value

coral_key1_value=`az storage account keys list -g "cctp-elk-prod" -n "esrepcoral" |
jq -r '.[] | select (.keyName == "key1") | .value'`
# Change to ICMGenAdapter Prod. subscription
az account set --subscription $icmgenadpt_subscription_id

# get key1 value

icmgenadpt_key1_value=`az storage account keys list -g "cctp-elk-prod" -n
"esrepicmgenadpt" | jq -r '.[] | select (.keyName == "key1") | .value'`

# Azure repository credentials (Coral, ICMGenAdpt)

echo "esrepcoral" | /opt/app/elastic/7.8.0/bin/elasticsearch-keystore add
azure.client.coral.account --silent
echo $coral_key1_value | /opt/app/elastic/7.8.0/bin/elasticsearch-keystore add
azure.client.coral.key --silent
echo "esrepicmgenadpt" | /opt/app/elastic/7.8.0/bin/elasticsearch-keystore add
azure.client.icmgenadpt.account --silent
echo $icmgenadpt_key1_value | /opt/app/elastic/7.8.0/bin/elasticsearch-keystore add
azure.client.icmgenadpt.key --silent

access_token=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-
version=2018-02-01&resource=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fvault.azure.net' -H Metadata:true | jq --
raw-output -r '.access_token')

# ATT LDAP credentials

att_ldap_bind_password=$(curl --silent
'https://elastcpockeyvault.vault.azure.net/secrets/ATT-LDAP-BIND-PASSWORD?api-
version=2016-10-01' -H "Authorization: Bearer $access_token" | jq --raw-output -r
'.value')
echo $att_ldap_bind_password | /opt/app/elastic/7.8.0/bin/elasticsearch-keystore
add xpack.security.authc.realms.active_directory.realm2.secure_bind_password --
silent

/opt/app/elastic/7.8.0/bin/elasticsearch-keystore list | grep

"xpack.security.authc.realms.active_directory.realm2.secure_bind_password" >
/dev/null && echo "Key - secure_bind_password created"

### *** END ***

#
***********************************************************************************
***************************************************************

#
----------------------------------------------------------------------------------
# Elasticsearch Install (v7.8.0) - AZURE REPOSITORY PLUGIN
cd /home/elastic
echo y | $ES_HOME/bin/elasticsearch-plugin install file:///tmp/repository-azure-
7.8.0.zip
/opt/app/elastic/7.8.0/bin/elasticsearch-plugin list -v

#
----------------------------------------------------------------------------------
### Config Changes
sed -i 's/\CHANGE_JVM_MIN_HEAP_SIZE/Xms8g/g'
/opt/app/elastic/7.8.0/config/jvm.options
sed -i 's/\CHANGE_JVM_MAX_HEAP_SIZE/Xmx8g/g'
/opt/app/elastic/7.8.0/config/jvm.options
sed -i 's/\CHANGE_ELASTIC_CLUSTER_NAME/elastic-att-poc/g'
/opt/app/elastic/7.8.0/config/elasticsearch.yml
machine_hostname=`echo $HOSTNAME`
sed -i "s/CHANGE_ELASTIC_HOSTNAME/$machine_hostname/g"
/opt/app/elastic/7.8.0/config/elasticsearch.yml

#
----------------------------------------------------------------------------------
# III. Elasticsearch Install (v7.8.0) - DATA & MASTER & INGEST NODE

sed -i 's/CHANGE_ELASTIC_IS_NODE_MASTER/true/g'
/opt/app/elastic/7.8.0/config/elasticsearch.yml
sed -i 's/CHANGE_ELASTIC_IS_NODE_DATA/true/g'
/opt/app/elastic/7.8.0/config/elasticsearch.yml
sed -i 's/CHANGE_ELASTIC_IS_NODE_INGEST/true/g'
/opt/app/elastic/7.8.0/config/elasticsearch.yml

#
----------------------------------------------------------------------------------
# IV. Elasticsearch Install (v7.8.0) - COORDINATING NODE

sed -i 's/CHANGE_ELASTIC_IS_NODE_MASTER/false/g'
/opt/app/elastic/7.8.0/config/elasticsearch.yml
sed -i 's/CHANGE_ELASTIC_IS_NODE_DATA/false/g'
/opt/app/elastic/7.8.0/config/elasticsearch.yml
sed -i 's/CHANGE_ELASTIC_IS_NODE_INGEST/false/g'
/opt/app/elastic/7.8.0/config/elasticsearch.yml

#
----------------------------------------------------------------------------------
# Install Support Diagnostic Utility
sudo su - elastic
mkdir -p /opt/app/elastic/7.8.0/diagnostic
gunzip /tmp/support-diagnostics-8.1.1.tar.gz
tar -C /opt/app/elastic/7.8.0/diagnostic -xf /tmp/support-diagnostics-8.1.1.tar
test -f /opt/app/elastic/7.8.0/diagnostic/support-diagnostics-8.1.1/scripts/
diagnostics.sh && echo "Diagnostic installed successfully"

#
----------------------------------------------------------------------------------
# Install Elasticsearch service
exit
whoami | grep elasticadmin && echo "Logged in as elasticadmin"
sudo su - root
cp /opt/app/elastic/7.8.0/att_config_files/elasticsearch.service
/etc/systemd/system/elasticsearch.service
test -f /etc/systemd/system/elasticsearch.service && echo "Elasticsearch service
created"
/bin/systemctl daemon-reload
/bin/systemctl status elasticsearch -l
/bin/systemctl enable elasticsearch
/bin/systemctl status elasticsearch -l

# *** Start Elasticsearch

/bin/systemctl start elasticsearch
/bin/systemctl status elasticsearch -l | grep "Active: active (running) "
lsof -i:9200
lsof -i:9300
cat /opt/app/elasticsearch/7.8.0/elasticsearch.pid | grep -E "^[0-9]+"

# *** Stop Kibana

/bin/systemctl stop elasticsearch
/bin/systemctl status elasticsearch -l | grep "Active: active (stopped) "
ps -ef | grep elasticsearch | grep -v grep

exit
#
----------------------------------------------------------------------------------

# *** Note - if needed to disable

/bin/systemctl disable elasticsearch
ps -ef | grep elasticsearch | grep -v grep
/usr/sbin/chkconfig elasticsearch off
#
----------------------------------------------------------------------------------

#
-----------------------------------------------------------------------------------
------------------------------------------
### POST INSTALL CONFIGURATION TASKS
### Note - Once all 3 data nodes and 1 coordinating node are installed and all 4
servers have the Elasticsearch service running
#
-----------------------------------------------------------------------------------
------------------------------------------
# Setup passwords for system users - elastic, apm_system, kibana_system,
logstash_system, beats_system, remote_monitoring_user
# Right now, for this cluster I have used the "interactive" method and entered the
passwords through the command line
# However, we will automate this through keyvault secrets and run the command
/opt/app/elasticsearch/7.8.0/bin/elasticsearch-setup-passwords in batch mode
/opt/app/elasticsearch/7.8.0/bin/elasticsearch-setup-passwords interactive -u
"https://elastic-eastus2-poc-node1-vm-01.az.3pc.att.com:9200"
elastic, apm_system, kibana_system, logstash_system, beats_system,
remote_monitoring_user: Same password - OurPraiseForAHigherPower786!@

# Validate Cluster health

curl -u elastic:<PASSWORD> 'https://elastic-eastus2-poc-coordinatingnode-vm-
01.az.3pc.att.com:9200/_cluster/health?pretty'
curl -u elastic:<PASSWORD> 'https://elastic-eastus2-poc-node1-vm-
01.az.3pc.att.com:9200/_cat/health?v'
curl -u elastic:<PASSWORD> 'https://elastic-eastus2-poc-node1-vm-
01.az.3pc.att.com:9200/_cat/nodes?
v&h=ip,heap.percent,ram.percent,cpu,load_1m,load_5m,load_15m,node.role,master,name,
nodeId,diskAvail'

# Install XPack License

cd $ES_HOME/config
test -f $ES_HOME/config/non_prod_license_exp_20200829.json && echo "License file
exists"
curl -XPUT 'https://elastic-eastus2-poc-node1-vm-01.az.3pc.att.com:9200/_license?
acknowledge=true' --insecure --user elastic:<PASSWORD> -H 'Content-Type:
application/json' -d @non_prod_license_exp_20200829.json

#
-----------------------------------------------------------------------------------
---------------------------------------------------