我试图在远程主机上执行elastic提供的cert util，但是，它抱怨playbook的结构，但是，我有一个类似的playbook，工作正常，我没有看到区别。我觉得我需要第二双眼睛。
我尝试过对剧本顶部的各种修改，比如添加
名称：安装证书
但是，它抱怨-name。我来自一个盐的背景和新的ansible，所以，我觉得我错过了一些类型的结构。

hosts: elasticnodes
  become: true

  vars:
    elasticsearch_path_home: "/usr/share/elasticsearch"
    elasticsearch_path_etc: "/etc/elasticsearch"
    elasticsearch_tls_cert_ca_pass: "plop99"
    elasticsearch_tls_cert_pass: "plop99"
    elasticsearch_tls_cert_dir: "certs"
    elasticsearch_user: "elasticsearch"
    elasticsearch_user_group: "elasticsearch"

  tasks:

    - name: Create a certificate directory
      file:
        owner: root
        group: '{{ elasticsearch_user_group }}'
        mode: u=rwx,g+rx,o-rwx
        path: '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'
        state: directory
      when: elasticsearch_tls_cert_dir is defined

    - name: Check a certificate of authority
      stat:
        path: "{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}/elastic-stack-ca.p12"
        register: elastic_stack_ca_file

    - name: Generate a certificate of authority
      args:
        chdir: '{{ elasticsearch_path_etc }}'
        become: yes
        command: "'{{ elasticsearch_path_home }}'/bin/elasticsearch-certutil ca --out '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-stack-ca.p12 --pass '{{ elasticsearch_tls_cert_pass }}'"
      when: not elastic_stack_ca_file.stat.exists

    - name: Check a certificate and private key for a node
      stat:
        path: "{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}/elastic-certificates.p12"
        register: elastic_certificates_file

    - name: Generate a certificate and private key for a node
      args:
        chdir: '{{ elasticsearch_path_etc }}'
        become: yes
        command: "'{{ elasticsearch_path_home }}'/bin/elasticsearch-certutil cert --ca '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-stack-ca.p12 --ca-pass '{{ elasticsearch_tls_cert_pass }}' --out '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-certificates.p12 --pass '{{ elasticsearch_tls_cert_ca_pass }}'"
      when: elastic_stack_ca_file.stat.exists and not elastic_certificates_file.stat.exists

这就产生了一个误差

ERROR! A playbook must be a list of plays, got a <class 'ansible.parsing.yaml.objects.AnsibleMapping'> instead

The error appears to be in '/root/elastic/ansible/playbooks/cert_setup.yml': line 2, column 3, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:

  hosts: elasticnodes
  ^ here

不过，像这样的剧本效果不错。

# modify the /etc/sysctl.conf file

- name: Configure sysctl.conf and /etc/hosts
  hosts: elasticnodes
  become: true

  vars:
    fqdn: "domain.com"

  tasks:
    - name: Configure sysctl
      sysctl:
        name: "{{ item.name }}"
        value: "{{ item.value }}"
        state: present
        reload: yes
        sysctl_set: yes
      with_items:
         - { name: vm.swappiness, value: 1 }

# modify the /etc/hosts file work in progress

    - name: Build hosts file
      lineinfile:
        dest: /etc/hosts
        regexp: '.*{{ item }}$'
        line: '{{ hostvars[item].ansible_default_ipv4.address }} {{item}}.{{fqdn}} {{item}}'
        state: present
      with_items: '{{ groups["etc_hosts"] }}'

    - name: Update Host Names
      hostname:
        name: "{{ inventory_hostname }}"

# start firewall

    - name: Enable firewalld
      service:
        name: firewalld
        state: started
        enabled: yes

# restart firewall

    - name: Restart firewalld
      service:
        name: firewalld
        state: restarted
        enabled: yes

# Update firewall rules

    - name: Update Firewall Settings
      ansible.posix.firewalld:
        zone: public
        permanent: yes
        immediate: yes
        state: enabled
        port: 9200/tcp

# Update firewall rules

    - name: Update Firewall Settings
      ansible.posix.firewalld:
        zone: public
        permanent: yes
        immediate: yes
        state: enabled
        port: 9300/tcp

我不太确定我错过了什么，感觉很明显。