Skip to content

Add CA fingerprint to agents configuration in 8.x versions #1082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jan 9, 2023

Conversation

jsoriano
Copy link
Member

@jsoriano jsoriano commented Dec 21, 2022

Try again something like bb84977 for 8.x stacks.

Adding this setting was evaluated and discarded in #789 because it didn't help configuring SSL in agents started by elastic-package stack up, as it was not supported in all versions of the stack supported by elastic-package. More about this can be read in #789.

The option implemented then and being used now is to install the certificate in the Elastic Agent containers, in /etc/ssl. This works well for Agents managed by elastic-package, but is not enough for external Elastic Agents, where installing the CA in the system may be more cumbersome.

Try to add the fingerprint back, as it would be helpful in some testing scenarios using external Elastic Agents.

Fix #1083.

@jsoriano jsoriano self-assigned this Dec 21, 2022
@jsoriano jsoriano requested review from a team, agithomas and ishleenk17 December 21, 2022 18:26
@elasticmachine
Copy link
Collaborator

elasticmachine commented Dec 21, 2022

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-12-22T10:38:27.402+0000

  • Duration: 33 min 32 sec

Test stats 🧪

Test Results
Failed 0
Passed 867
Skipped 0
Total 867

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link
Collaborator

elasticmachine commented Dec 21, 2022

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (34/34) 💚
Files 67.188% (86/128) 👍
Classes 61.957% (114/184) 👍
Methods 48.446% (374/772) 👎 -0.126
Lines 31.838% (3400/10679) 👎 -0.029
Conditionals 100.0% (0/0) 💚

@jsoriano
Copy link
Member Author

Ah no, this setting cannot be set here, it would need to be set in the policies.
Not sure what we can do then from the elastic-package side for policies and agents configured manually.

@jsoriano jsoriano closed this Dec 21, 2022
@jsoriano jsoriano reopened this Dec 22, 2022
@jsoriano
Copy link
Member Author

Ah no, this setting cannot be set here, it would need to be set in the policies.

As @agithomas mentioned, this setting goes not in the policies, but in the output configuration. PR updated.

@agithomas
Copy link
Contributor

Yes, it works. Tested with 8.5.1 stack and agent version

image

Copy link
Contributor

@agithomas agithomas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works well.

Recommend to add the documentation in the elastic-package about how to add the agent

example:
sudo ./elastic-agent install --certificate-authorities=$ELASTIC_PACKAGE_CA_CERT --fleet-server-es-ca=$ELASTIC_PACKAGE_CA_CERT --url=https://fleet-server:8220 --enrollment-token=

@jsoriano jsoriano marked this pull request as ready for review December 26, 2022 19:14
@jsoriano jsoriano merged commit e5831f4 into elastic:main Jan 9, 2023
@jsoriano jsoriano deleted the add-ca-fingerprint branch January 9, 2023 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add CA fingerprint to agents configuration in 8.x versions
4 participants