One job hidden inside elasticstack_full_stack: whether the collection acts as its own Certificate Authority — generating the CA with elasticsearch-certutil and distributing ca.crt + node/component certificates across the roles.
Add elasticstack_manage_ca (default true) to control exactly this. When false, the collection generates/distributes nothing and the user brings their own CA/certificates via the existing *_tls_* variables (externally-managed or cloud stack). Decouples "collection owns the PKI" from "collection deploys the components".
Breaking → 2.0.0. Part of #531.
One job hidden inside
elasticstack_full_stack: whether the collection acts as its own Certificate Authority — generating the CA withelasticsearch-certutiland distributingca.crt+ node/component certificates across the roles.Add
elasticstack_manage_ca(defaulttrue) to control exactly this. Whenfalse, the collection generates/distributes nothing and the user brings their own CA/certificates via the existing*_tls_*variables (externally-managed or cloud stack). Decouples "collection owns the PKI" from "collection deploys the components".Breaking → 2.0.0. Part of #531.