fix(elasticsearch): skip bootstrap-only checks when joining existing cluster

roles/elasticsearch/tasks/elasticsearch-security.yml

@@ -648,7 +648,15 @@
   when: elasticsearch_http_security
 
 - name: elasticsearch-security | Runtime cluster setup (requires running Elasticsearch)
-  when: not ansible_check_mode
+  # Runtime cluster setup uses the bootstrap password to seed the elastic user,
+  # built-in user passwords, etc. on a fresh cluster. When joining an existing
+  # cluster (elasticsearch_cluster_set_up: true) those are already part of the
+  # replicated cluster state, the bootstrap password is no longer accepted,
+  # and this whole block fails with "Bootstrap password authentication failed
+  # and this is not the CA host". See issue #148.
+  when:
+    - not ansible_check_mode
+    - not elasticsearch_cluster_set_up | bool
   block:
     - name: elasticsearch-security | Check for API with bootstrap password
       ansible.builtin.uri:

roles/elasticsearch/tasks/main.yml

@@ -129,11 +129,17 @@
         elasticsearch_count_of_master_nodes: >-
           {{ ansible_play_hosts_all | intersect(groups['elasticsearch_role_master'] | default([])) | length }}
 
+    # The odd-master-count rule is required for a fresh-bootstrapped cluster
+    # to have a stable initial quorum. When joining an existing cluster
+    # (elasticsearch_cluster_set_up: true) the cluster already has its own
+    # master-eligible quorum independent of how many new nodes are added in
+    # this play, so the check is irrelevant and would block legitimate joins.
     - name: Check count of master nodes
       ansible.builtin.fail:
         msg: "There must be an odd count of master nodes. You have {{ elasticsearch_count_of_master_nodes }}"
       when:
         - elasticsearch_count_of_master_nodes | int % 2  == 0
+        - not elasticsearch_cluster_set_up | bool
 
     - name: End play in checks
       ansible.builtin.meta: end_host