granny-devops 0.9.2__tar.gz → 0.9.3__tar.gz

{granny_devops-0.9.2 → granny_devops-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: granny-devops
-Version: 0.9.2
+Version: 0.9.3
 Summary: Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation
 Author-email: Martin Wieser <martin.wieser@pseekoo.com>
 License: MIT License
@@ -221,6 +221,7 @@ Common keys:
 | ClouDNS | `CLOUDNS_AUTH_ID`/`_PASSWORD` (or `_SUB_AUTH_ID`/`_SUB_AUTH_USER`) |
 | INWX | `INWX_USERNAME`, `INWX_PASSWORD`, `INWX_SHARED_SECRET` (only with 2FA) |
 | Docker Hub | `DOCKER_HUB_USER`, `DOCKER_HUB_TOKEN` |
+| Elasticsearch / Kibana | `ELASTICSEARCH_URL`, `ELASTICSEARCH_API_KEY` or `ELASTICSEARCH_USERNAME` + `ELASTICSEARCH_PASSWORD` |
 
 Set only the ones you need. Use `granny credentials status` to verify
 what's configured at any time.
@@ -297,6 +298,13 @@ granny authentik list providers
 granny authentik rotate-secret my-oauth-provider
 granny authentik add-user-to-group user@example.com     # defaults to dash_admins
 granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
+
+# Elasticsearch / Kibana users
+granny elk add-user user@example.com \
+  --email user@example.com \
+  --full-name "Example User" \
+  --role kibana_admin \
+  --generate-password
 ```
 
 ## Capability matrix
@@ -314,6 +322,7 @@ granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 | Cross-cloud inventory | GPU instances + reservations, credit balances, MTD spend + forecast (AWS, GCP, Azure) |
 | SSL automation | Bunny, Cloudflare, ACM |
 | SSO / IdP | Authentik (provider, application, group, and user operations) |
+| Observability admin | Elasticsearch / Kibana native-user management |
 
 ## As a library
 

{granny_devops-0.9.2 → granny_devops-0.9.3}/README.md

@@ -89,6 +89,7 @@ Common keys:
 | ClouDNS | `CLOUDNS_AUTH_ID`/`_PASSWORD` (or `_SUB_AUTH_ID`/`_SUB_AUTH_USER`) |
 | INWX | `INWX_USERNAME`, `INWX_PASSWORD`, `INWX_SHARED_SECRET` (only with 2FA) |
 | Docker Hub | `DOCKER_HUB_USER`, `DOCKER_HUB_TOKEN` |
+| Elasticsearch / Kibana | `ELASTICSEARCH_URL`, `ELASTICSEARCH_API_KEY` or `ELASTICSEARCH_USERNAME` + `ELASTICSEARCH_PASSWORD` |
 
 Set only the ones you need. Use `granny credentials status` to verify
 what's configured at any time.
@@ -165,6 +166,13 @@ granny authentik list providers
 granny authentik rotate-secret my-oauth-provider
 granny authentik add-user-to-group user@example.com     # defaults to dash_admins
 granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
+
+# Elasticsearch / Kibana users
+granny elk add-user user@example.com \
+  --email user@example.com \
+  --full-name "Example User" \
+  --role kibana_admin \
+  --generate-password
 ```
 
 ## Capability matrix
@@ -182,6 +190,7 @@ granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 | Cross-cloud inventory | GPU instances + reservations, credit balances, MTD spend + forecast (AWS, GCP, Azure) |
 | SSL automation | Bunny, Cloudflare, ACM |
 | SSO / IdP | Authentik (provider, application, group, and user operations) |
+| Observability admin | Elasticsearch / Kibana native-user management |
 
 ## As a library
 

{granny_devops-0.9.2 → granny_devops-0.9.3}/granny/__init__.py

@@ -1,6 +1,6 @@
 """Granny -- Cloud tools collection for AWS infrastructure and DevOps automation."""
 
-__version__ = "0.9.2"
+__version__ = "0.9.3"
 __all__ = [
     "get_secret",
     "load_secrets_into_env",

granny_devops-0.9.3/granny/cli/elk.py

@@ -0,0 +1,192 @@
+"""``granny elk`` — manage Elasticsearch / Kibana users."""
+
+from __future__ import annotations
+
+import getpass
+import json
+import sys
+from typing import Any
+
+import click
+
+from granny.elk.client import (
+    ElasticsearchSecurityClient,
+    ElasticsearchSecurityError,
+    generate_password as generate_elk_password,
+)
+
+
+@click.group()
+def elk() -> None:
+    """Manage Elasticsearch / Kibana security objects."""
+
+
+def _client(
+    url: str | None,
+    admin_username: str | None,
+    admin_password: str | None,
+    api_key: str | None,
+    verify_tls: bool,
+) -> ElasticsearchSecurityClient:
+    try:
+        return ElasticsearchSecurityClient.from_environment(
+            base_url=url,
+            username=admin_username,
+            password=admin_password,
+            api_key=api_key,
+            verify_tls=verify_tls,
+        )
+    except ElasticsearchSecurityError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+_COMMON_OPTIONS = [
+    click.option("--url", default=None, help="Elasticsearch URL (env: ELASTICSEARCH_URL)."),
+    click.option(
+        "--admin-username",
+        default=None,
+        help="Admin username (env/vault: ELASTICSEARCH_USERNAME).",
+    ),
+    click.option(
+        "--admin-password",
+        default=None,
+        help="Admin password (env/vault: ELASTICSEARCH_PASSWORD).",
+    ),
+    click.option(
+        "--api-key",
+        default=None,
+        help="Elasticsearch API key (env/vault: ELASTICSEARCH_API_KEY).",
+    ),
+    click.option("--verify-tls/--no-verify-tls", default=True, show_default=True),
+]
+
+
+def common_options(func: Any) -> Any:
+    for option in reversed(_COMMON_OPTIONS):
+        func = option(func)
+    return func
+
+
+@elk.command("add-user")
+@click.argument("username")
+@click.option("--email", default=None, help="User email address.")
+@click.option("--full-name", default=None, help="User display name.")
+@click.option(
+    "--role",
+    "roles",
+    multiple=True,
+    required=True,
+    help="Elasticsearch role. Repeat for multiple roles, e.g. --role kibana_admin.",
+)
+@click.option("--password", default=None, help="Initial password. Prompts if omitted.")
+@click.option(
+    "--generate-password",
+    is_flag=True,
+    help="Generate and print a random initial password instead of prompting.",
+)
+@click.option("--disabled", is_flag=True, help="Create/update the user as disabled.")
+@click.option(
+    "--metadata",
+    default=None,
+    help="Optional JSON object for Elasticsearch user metadata.",
+)
+@click.option("--json", "as_json", is_flag=True, help="Emit JSON result.")
+@common_options
+def add_user_cmd(
+    username: str,
+    email: str | None,
+    full_name: str | None,
+    roles: tuple[str, ...],
+    password: str | None,
+    generate_password: bool,
+    disabled: bool,
+    metadata: str | None,
+    as_json: bool,
+    url: str | None,
+    admin_username: str | None,
+    admin_password: str | None,
+    api_key: str | None,
+    verify_tls: bool,
+) -> None:
+    """Create or update an Elasticsearch native user for Kibana/ELK access."""
+    if password and generate_password:
+        raise click.ClickException("Use either --password or --generate-password, not both")
+    generated_password: str | None = None
+    if generate_password:
+        generated_password = generate_elk_password()
+        password = generated_password
+    elif password is None:
+        password = getpass.getpass(f"Initial password for {username}: ")
+        confirm = getpass.getpass("Confirm password: ")
+        if password != confirm:
+            raise click.ClickException("Passwords do not match")
+
+    parsed_metadata: dict[str, Any] | None = None
+    if metadata:
+        try:
+            raw_metadata = json.loads(metadata)
+        except json.JSONDecodeError as exc:
+            raise click.ClickException(f"Invalid --metadata JSON: {exc}") from exc
+        if not isinstance(raw_metadata, dict):
+            raise click.ClickException("--metadata must be a JSON object")
+        parsed_metadata = raw_metadata
+
+    client = _client(url, admin_username, admin_password, api_key, verify_tls)
+    try:
+        existed_before = client.get_user(username) is not None
+        result = client.put_user(
+            username,
+            password=password,
+            roles=roles,
+            full_name=full_name,
+            email=email,
+            enabled=not disabled,
+            metadata=parsed_metadata,
+        )
+    except ElasticsearchSecurityError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+    out = {
+        "username": username,
+        "created": not existed_before,
+        "updated": existed_before,
+        "roles": list(roles),
+        "enabled": not disabled,
+        "result": result,
+    }
+    if generated_password is not None:
+        out["password"] = generated_password
+    if as_json:
+        click.echo(json.dumps(out, indent=2, default=str))
+        return
+    click.echo(f"{'Created' if not existed_before else 'Updated'} ELK user {username}")
+    click.echo(f"Roles: {', '.join(roles)}")
+    if generated_password is not None:
+        click.echo(f"Password: {generated_password}")
+
+@elk.command("get-user")
+@click.argument("username")
+@click.option("--json", "as_json", is_flag=True, help="Emit raw JSON result.")
+@common_options
+def get_user_cmd(
+    username: str,
+    as_json: bool,
+    url: str | None,
+    admin_username: str | None,
+    admin_password: str | None,
+    api_key: str | None,
+    verify_tls: bool,
+) -> None:
+    """Show an Elasticsearch native user."""
+    client = _client(url, admin_username, admin_password, api_key, verify_tls)
+    try:
+        user = client.get_user(username)
+    except ElasticsearchSecurityError as exc:
+        raise click.ClickException(str(exc)) from exc
+    if user is None:
+        click.echo(f"User {username!r} not found", err=True)
+        sys.exit(1)
+    if as_json:
+        click.echo(json.dumps(user, indent=2, default=str))
+        return
+    click.echo(f"{username} | roles={','.join(user.get('roles', []))} | enabled={user.get('enabled')}")

{granny_devops-0.9.2 → granny_devops-0.9.3}/granny/cli/main.py

@@ -100,6 +100,11 @@ def _register_commands() -> None:
         cli.add_command(authentik)
     except ImportError:
         pass
+    try:
+        from granny.cli.elk import elk
+        cli.add_command(elk)
+    except ImportError:
+        pass
 
 
 _register_commands()

{granny_devops-0.9.2 → granny_devops-0.9.3}/granny/credentials/secrets.py

@@ -172,6 +172,10 @@ SECRET_MAP: dict[str, str] = {
     # superuser-issued token (Authentik UI → Directory → Tokens). Falls back
     # to AK_TOKEN env var in granny.authentik.AuthentikClient.from_environment.
     "AUTHENTIK_API_TOKEN": "authentik-api-token",
+    # Elasticsearch / Kibana security API credentials for `granny elk …`.
+    "ELASTICSEARCH_API_KEY": "elasticsearch-api-key",
+    "ELASTICSEARCH_USERNAME": "elasticsearch-username",
+    "ELASTICSEARCH_PASSWORD": "elasticsearch-password",
 }
 
 # Module-level cache so vault is only contacted once per process

granny_devops-0.9.3/granny/elk/__init__.py

@@ -0,0 +1,5 @@
+"""Elasticsearch / Kibana user management helpers."""
+
+from granny.elk.client import ElasticsearchSecurityClient, ElasticsearchSecurityError
+
+__all__ = ["ElasticsearchSecurityClient", "ElasticsearchSecurityError"]

granny_devops-0.9.3/granny/elk/client.py

@@ -0,0 +1,149 @@
+"""Thin wrapper around Elasticsearch's security user API."""
+
+from __future__ import annotations
+
+import os
+import secrets
+import string
+from typing import Any
+
+import requests
+
+from granny.credentials import get_secret
+
+
+class ElasticsearchSecurityError(RuntimeError):
+    """Raised on non-2xx responses from Elasticsearch security APIs."""
+
+    def __init__(self, status: int, body: str) -> None:
+        super().__init__(f"HTTP {status}: {body[:400]}")
+        self.status = status
+        self.body = body
+
+
+class ElasticsearchSecurityClient:
+    """Authenticated client for Elasticsearch native-user management."""
+
+    def __init__(
+        self,
+        base_url: str,
+        *,
+        username: str | None = None,
+        password: str | None = None,
+        api_key: str | None = None,
+        timeout: float = 30.0,
+        verify_tls: bool = True,
+    ) -> None:
+        self.base_url = base_url.rstrip("/")
+        self._timeout = timeout
+        self._session = requests.Session()
+        self._session.headers.update({"Accept": "application/json"})
+        self._session.verify = verify_tls
+        if api_key:
+            self._session.headers["Authorization"] = f"ApiKey {api_key}"
+        elif username and password:
+            self._session.auth = (username, password)
+        else:
+            raise ElasticsearchSecurityError(
+                0,
+                "Set ELASTICSEARCH_API_KEY or ELASTICSEARCH_USERNAME + "
+                "ELASTICSEARCH_PASSWORD.",
+            )
+
+    @classmethod
+    def from_environment(
+        cls,
+        *,
+        base_url: str | None = None,
+        username: str | None = None,
+        password: str | None = None,
+        api_key: str | None = None,
+        verify_tls: bool | None = None,
+    ) -> "ElasticsearchSecurityClient":
+        """Build a client from explicit arguments, env vars, and vault fallback."""
+        resolved_url = base_url or os.environ.get("ELASTICSEARCH_URL")
+        if not resolved_url:
+            raise ElasticsearchSecurityError(0, "ELASTICSEARCH_URL is not set")
+
+        resolved_api_key = api_key or get_secret("ELASTICSEARCH_API_KEY")
+        resolved_username = None
+        resolved_password = None
+        if not resolved_api_key:
+            resolved_username = username or get_secret("ELASTICSEARCH_USERNAME")
+            resolved_password = password or get_secret("ELASTICSEARCH_PASSWORD")
+        if verify_tls is None:
+            verify_tls = os.environ.get("ELASTICSEARCH_VERIFY_TLS", "true").lower() not in {
+                "0",
+                "false",
+                "no",
+            }
+        return cls(
+            resolved_url,
+            username=resolved_username,
+            password=resolved_password,
+            api_key=resolved_api_key,
+            verify_tls=verify_tls,
+        )
+
+    def request(self, method: str, path: str, *, body: Any = None) -> Any:
+        if not path.startswith("/"):
+            path = "/" + path
+        try:
+            resp = self._session.request(
+                method.upper(),
+                self.base_url + path,
+                json=body,
+                timeout=self._timeout,
+            )
+        except requests.RequestException as exc:
+            raise ElasticsearchSecurityError(0, str(exc)) from exc
+        if resp.status_code >= 400:
+            raise ElasticsearchSecurityError(resp.status_code, resp.text)
+        if not resp.content:
+            return None
+        try:
+            return resp.json()
+        except ValueError:
+            return resp.text
+
+    def get_user(self, username: str) -> dict[str, Any] | None:
+        try:
+            result = self.request("GET", f"/_security/user/{username}")
+        except ElasticsearchSecurityError as exc:
+            if exc.status == 404:
+                return None
+            raise
+        if isinstance(result, dict):
+            return result.get(username)
+        return None
+
+    def put_user(
+        self,
+        username: str,
+        *,
+        roles: list[str] | tuple[str, ...],
+        password: str | None = None,
+        full_name: str | None = None,
+        email: str | None = None,
+        enabled: bool = True,
+        metadata: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Create or update a native Elasticsearch user."""
+        body: dict[str, Any] = {
+            "roles": list(roles),
+            "enabled": enabled,
+            "metadata": metadata or {},
+        }
+        if password is not None:
+            body["password"] = password
+        if full_name is not None:
+            body["full_name"] = full_name
+        if email is not None:
+            body["email"] = email
+        return self.request("PUT", f"/_security/user/{username}", body=body)
+
+
+def generate_password(length: int = 24) -> str:
+    """Generate a Kibana-friendly random password."""
+    alphabet = string.ascii_letters + string.digits + "-_.!~"
+    return "".join(secrets.choice(alphabet) for _ in range(length))

{granny_devops-0.9.2 → granny_devops-0.9.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "granny-devops"
-version = "0.9.2"
+version = "0.9.3"
 description = "Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation"
 readme = "README.md"
 license = { file = "LICENSE" }