Fix issue where --insecure didn't propogate to Fleet Server ES connection #27969

blakerouse · 2021-09-16T12:31:30Z

What does this PR do?

Propogates the --insecure flag to the Fleet Server process, so it can communicate with elasticsearch insecurely.

Why is it important?

Previously it was not possible to instruct Fleet Server to communicate insecurely with elasticsearch. Now if you are bootstrapping a Fleet Server and using --insecure it will also make communication with elasticsearch insecure.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
~~[ ] I have made corresponding changes to the documentation~~
~~[ ] I have made corresponding change to the default configuration files~~
~~[ ] I have added tests that prove my fix is effective or that my feature works~~
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Closes [Elastic-agent] --insecure flag doesn't work as expected #27956

…tion.

elasticmachine · 2021-09-16T12:32:35Z

Pinging @elastic/agent (Team:Agent)

elasticmachine · 2021-09-16T12:35:31Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2021-09-16T12:32:46.828+0000
Duration: 77 min 6 sec
Commit: b3168b9

Test stats 🧪

Test	Results
Failed	0
Passed	7044
Skipped	16
Total	7060

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	7044
Skipped	16
Total	7060

michel-laterman

lgtm

…tion (#27969) * Fix issue where --insecure didn't propogate to Fleet Server ES connection. * Add changelog. (cherry picked from commit cbbe8c2)

…tion (#27969) (#27977) * Fix issue where --insecure didn't propogate to Fleet Server ES connection. * Add changelog. (cherry picked from commit cbbe8c2) Co-authored-by: Blake Rouse <blake.rouse@elastic.co>

…tion (#27969) (#27979) * Fix issue where --insecure didn't propogate to Fleet Server ES connection. * Add changelog. (cherry picked from commit cbbe8c2) Co-authored-by: Blake Rouse <blake.rouse@elastic.co>

…tion (#27969) (#27978) * Fix issue where --insecure didn't propogate to Fleet Server ES connection. * Add changelog. (cherry picked from commit cbbe8c2) Co-authored-by: Blake Rouse <blake.rouse@elastic.co>

…S connection (elastic#27969)" This reverts commit cbbe8c2.

…S connection (#27969)" (#27997) This reverts commit cbbe8c2.

…S connection (#27969)" (#27997) This reverts commit cbbe8c2. (cherry picked from commit 88b29b5)

* upstream/master: (658 commits) Add complete k8s metadata through composable provider (elastic#27691) Revert "Fix issue where --insecure didn't propogate to Fleet Server ES connection (elastic#27969)" (elastic#27997) Remove deprecated kafka fields (elastic#27938) [Filebeat] Add Base64 encoded HMAC & UUID template functions to httpjson input (elastic#27873) Improve httpjson template function join (elastic#27996) Remove kubernetes.container.image alias (elastic#27898) [Elastic Agent] Golden files for program tests (elastic#27862) [Elastic Agent] Disable modules.d in metricbeat (elastic#27860) libbeat/common/seccomp: provide default policy for linux arm64 (elastic#27955) Fix logger statement in aws-s3 input (elastic#27982) Fix wrong merge (elastic#27976) Fix issue where --insecure didn't propogate to Fleet Server ES connection (elastic#27969) Forward-port 7.14.2 changelog to master (elastic#27975) [Filebeat] Removing duplicate modules (aliases) Observability (elastic#27919) Fix path in vagrant windows script (elastic#27966) [Filebeat] Removing duplicate modules (aliases) and Cyberark (elastic#27915) No changelog for 8.0.0-alpha2 (elastic#27961) Add write access to 'url.value' from 'request.transforms'. (elastic#27937) Docker: remove deprecated fields (elastic#27933) Filebeat: Make all filesets disabled in default configuration (elastic#27762) ...

…S connection (#27969)" (#27997) (#28004) This reverts commit cbbe8c2. (cherry picked from commit 88b29b5) Co-authored-by: Michal Pristas <michal.pristas@gmail.com>

…S connection (#27969)" (#27997) (#28003) This reverts commit cbbe8c2. (cherry picked from commit 88b29b5) Co-authored-by: Michal Pristas <michal.pristas@gmail.com>

…S connection (#27969)" (#27997) (#28002) This reverts commit cbbe8c2. (cherry picked from commit 88b29b5) Co-authored-by: Michal Pristas <michal.pristas@gmail.com>

…tion (elastic#27969) * Fix issue where --insecure didn't propogate to Fleet Server ES connection. * Add changelog.

…S connection (elastic#27969)" (elastic#27997) This reverts commit cbbe8c2.

dikshachauhan-qasource · 2021-11-15T08:02:15Z

Hi Eric

We have regressed this issue on 7.16 BC3 on Stack Environment in lieu of #27956 under merged PR at #27969. Following is our observation:

Pre-conditions:

Kibana is running and up.
CA certs are available.

Steps followed:

Downloaded Elastic agent and extracted it.
To make CA certs as expired, we manually updated machines time and date setting to Future date.
We ran the Fleet server install command with CA certs.

Observations: Agent installed successfully.

After waiting for few mins and resetting the time to current zone, we navigated back to Kibana and Observed agent was available with Last activity value as " in 2 years".

Further, No logs were available on UI side.

Please find further details in below screenshots:

Updated machine time to expire ca cert
On access Kibana agent showed yp last activity as "in 2years"
Integrations under agent policy:
No Logs recorded on UI
Data streams generated:
Discover tab records:

Build details:
BUILD 45816
COMMIT acaa761f4ce46680fd7cfbeba03a652c72dc786b
https://staging.elastic.co/7.16.0-8dc8b6a1/summary-7.16.0.html

Logs attached for reference:
logs-cacerts.zip

Kindly let us know if we are missing anything.

Thanks
QAS

EricDavisX · 2021-11-15T14:44:05Z

I spoke with Diksha and Michal and we are synced up on the best way to test this, the above isn't quite right. We'll post back and expect (and hope) the issue remains fixed as intended, and we can document steps to validate it moving forwards.

…tion (elastic#27969) (elastic#27978) * Fix issue where --insecure didn't propogate to Fleet Server ES connection. * Add changelog. (cherry picked from commit 576be96) Co-authored-by: Blake Rouse <blake.rouse@elastic.co>

…S connection (elastic#27969)" (elastic#27997) (elastic#28003) This reverts commit 576be96. (cherry picked from commit b5ffc57) Co-authored-by: Michal Pristas <michal.pristas@gmail.com>

Fix issue where --insecure didn't propogate to Fleet Server ES connec…

d534a4e

…tion.

blakerouse added Team:Elastic-Agent Label for the Agent team backport-v7.14.0 Automated backport with mergify backport-v7.15.0 Automated backport with mergify backport-v7.16.0 Automated backport with mergify labels Sep 16, 2021

blakerouse self-assigned this Sep 16, 2021

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Sep 16, 2021

Add changelog.

b3168b9

blakerouse marked this pull request as ready for review September 16, 2021 12:32

blakerouse mentioned this pull request Sep 16, 2021

[self-managed Fleet Server install] insecure flag not taking effect elastic/fleet-server#552

Closed

michel-laterman approved these changes Sep 16, 2021

View reviewed changes

blakerouse merged commit cbbe8c2 into elastic:master Sep 16, 2021

blakerouse deleted the agent-fs-insecure branch September 16, 2021 17:49

mergify bot mentioned this pull request Sep 16, 2021

[7.x](backport #27969) Fix issue where --insecure didn't propogate to Fleet Server ES connection #27977

Merged

mergify bot mentioned this pull request Sep 16, 2021

[7.14](backport #27969) Fix issue where --insecure didn't propogate to Fleet Server ES connection #27978

Merged

mergify bot mentioned this pull request Sep 16, 2021

[7.15](backport #27969) Fix issue where --insecure didn't propogate to Fleet Server ES connection #27979

Merged

michalpristas added a commit to michalpristas/beats that referenced this pull request Sep 20, 2021

Revert "Fix issue where --insecure didn't propogate to Fleet Server E…

f3c3e4a

…S connection (elastic#27969)" This reverts commit cbbe8c2.

michalpristas mentioned this pull request Sep 20, 2021

Revert "Fix issue where --insecure didn't propogate to Fleet Server E… #27997

Merged

6 tasks

michalpristas added a commit that referenced this pull request Sep 20, 2021

Revert "Fix issue where --insecure didn't propogate to Fleet Server E…

88b29b5

…S connection (#27969)" (#27997) This reverts commit cbbe8c2.

mergify bot pushed a commit that referenced this pull request Sep 20, 2021

Revert "Fix issue where --insecure didn't propogate to Fleet Server E…

8269f73

…S connection (#27969)" (#27997) This reverts commit cbbe8c2. (cherry picked from commit 88b29b5)

mergify bot pushed a commit that referenced this pull request Sep 20, 2021

Revert "Fix issue where --insecure didn't propogate to Fleet Server E…

58f1d4a

…S connection (#27969)" (#27997) This reverts commit cbbe8c2. (cherry picked from commit 88b29b5)

mergify bot pushed a commit that referenced this pull request Sep 20, 2021

Revert "Fix issue where --insecure didn't propogate to Fleet Server E…

904149d

…S connection (#27969)" (#27997) This reverts commit cbbe8c2. (cherry picked from commit 88b29b5)

Icedroid pushed a commit to Icedroid/beats that referenced this pull request Nov 1, 2021

Fix issue where --insecure didn't propogate to Fleet Server ES connec…

3130d3e

…tion (elastic#27969) * Fix issue where --insecure didn't propogate to Fleet Server ES connection. * Add changelog.

Icedroid pushed a commit to Icedroid/beats that referenced this pull request Nov 1, 2021

Revert "Fix issue where --insecure didn't propogate to Fleet Server E…

71fc5e2

…S connection (elastic#27969)" (elastic#27997) This reverts commit cbbe8c2.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix issue where --insecure didn't propogate to Fleet Server ES connection #27969

Fix issue where --insecure didn't propogate to Fleet Server ES connection #27969

blakerouse commented Sep 16, 2021 •

edited

Loading

elasticmachine commented Sep 16, 2021

elasticmachine commented Sep 16, 2021 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

Trends 🧪

Test stats 🧪

michel-laterman left a comment

dikshachauhan-qasource commented Nov 15, 2021

EricDavisX commented Nov 15, 2021

Fix issue where --insecure didn't propogate to Fleet Server ES connection #27969

Fix issue where --insecure didn't propogate to Fleet Server ES connection #27969

Conversation

blakerouse commented Sep 16, 2021 • edited Loading

What does this PR do?

Why is it important?

Checklist

Related issues

elasticmachine commented Sep 16, 2021

elasticmachine commented Sep 16, 2021 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

Trends 🧪

💚 Flaky test report

Test stats 🧪

michel-laterman left a comment

Choose a reason for hiding this comment

dikshachauhan-qasource commented Nov 15, 2021

EricDavisX commented Nov 15, 2021

blakerouse commented Sep 16, 2021 •

edited

Loading

elasticmachine commented Sep 16, 2021 •

edited by jenkins-beats-ci bot

Loading