Deprecate username/password in elastic-agent #29434

michel-laterman · 2021-12-15T00:43:08Z

What does this PR do?

Add deprecation logs when username/password is detected by the elastic-agent.

Checklist

My code follows the style guidelines of this project
~~I have commented my code, particularly in hard-to-understand areas~~
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
~~I have added tests that prove my fix is effective or that my feature works~~
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Relates fleet-server username/password feature must be deprecated in 7.16 / 7.17 fleet-server#977

elasticmachine · 2021-12-15T00:43:10Z

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

michel-laterman · 2021-12-15T00:45:35Z

x-pack/elastic-agent/_meta/config/common.p2.yml.tmpl

@@ -5,8 +5,11 @@ outputs:
  default:
    type: elasticsearch
    hosts: [127.0.0.1:9200]
-    username: elastic
-    password: changeme
+    api_key: "example-key"


I'm a bit confused if this attribute should be api_key or service_token.
the libbeat output config expects api_key, but some config from within the agent refers to it as service_token.

api_key is for the output, service_token is for what is passed to fleet-server. This is not the same thing, see other comments.

elasticmachine · 2021-12-15T02:22:38Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2021-12-21T17:16:47.761+0000
Duration: 102 min 43 sec
Commit: d18269e

Test stats 🧪

Test	Results
Failed	0
Passed	7069
Skipped	24
Total	7093

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

michalpristas

could you describe api_key and service_token and their usage?
i see some outputs gained token other ones api_key

ruflin · 2021-12-16T10:22:42Z

I retargeted this PR to 7.17. If we need it also in 7.16, lets make sure it is backported.

ruflin · 2021-12-16T10:23:58Z

x-pack/elastic-agent/CHANGELOG.next.asciidoc

@@ -150,3 +150,4 @@
 - Add diagnostics collect command to gather beat metadata, config, policy, and logs and bundle it into an archive. {pull}28461[28461]
 - Add `KIBANA_FLEET_SERVICE_TOKEN` to Elastic Agent container. {pull}28096[28096]
 - Allow pprof endpoints for elastic-agent or beats if enabled. {pull}28983[28983] {pull}29155[29155]
+- Mark username/password settings as deprecated. {pull}29434[29434]


username / password for fleet-server are deprecated. If we should deprecate username / password for Elastic Agent in a more general way for the output is another discussion.

ruflin · 2021-12-16T10:25:54Z

x-pack/elastic-agent/elastic-agent.yml

-    username: elastic
-    password: changeme
+    api_key: "example-key"
+    # Note that basic auth is deprecated and will be removed in 8.0


This does not apply to the general output. +1 on having the api_key here but username / password for the output part stay around AFAIK.

ah, much simpler then. i'll just log it there.

ruflin · 2021-12-16T10:26:28Z

x-pack/elastic-agent/_meta/config/common.p2.yml.tmpl

@@ -5,8 +5,11 @@ outputs:
  default:
    type: elasticsearch
    hosts: [127.0.0.1:9200]
-    username: elastic
-    password: changeme
+    api_key: "example-key"


api_key is for the output, service_token is for what is passed to fleet-server. This is not the same thing, see other comments.

x-pack/elastic-agent/_meta/config/elastic-agent.docker.yml.tmpl

michel-laterman · 2021-12-16T22:43:09Z

/test

x-pack/elastic-agent/elastic-agent.reference.yml

x-pack/elastic-agent/_meta/config/elastic-agent.docker.yml.tmpl

x-pack/elastic-agent/_meta/config/common.reference.p2.yml.tmpl

ruflin

Lets make sure we also follow up with docs to deprecate it also in the docs.

michalpristas

also please as a followup coordinate with cloud/or make sure they're aware of the upcoming change

ruflin

I think this also needs an update on

beats/x-pack/elastic-agent/pkg/agent/cmd/container.go

Line 96 in fcb7b81

    
             FLEET_SERVER_ELASTICSEARCH_USERNAME - elasticsearch username for Fleet Server [$ELASTICSEARCH_USERNAME]

Add a note that these are deprecated as this is what shows up in the help output.

michel-laterman · 2021-12-21T00:03:12Z

/test

ruflin

Change LGTM. Lets try to get CI pass and get it in.

* Deprecate username/password in elastic-agent * Appy deprecation only to fleet-server * Review feedback * Add deprecation notes in container help output (cherry picked from commit 1810b78)

* Deprecate username/password in elastic-agent * Appy deprecation only to fleet-server * Review feedback * Add deprecation notes in container help output (cherry picked from commit 1810b78) Co-authored-by: Michel Laterman <82832767+michel-laterman@users.noreply.github.com>

Deprecate username/password in elastic-agent

43d5d99

michel-laterman added release-note:deprecation The content should be included in the deprecation section v7.16.0 Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team labels Dec 15, 2021

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Dec 15, 2021

michel-laterman commented Dec 15, 2021

View reviewed changes

michalpristas reviewed Dec 16, 2021

View reviewed changes

ruflin changed the base branch from 7.16 to 7.17 December 16, 2021 10:22

ruflin reviewed Dec 16, 2021

View reviewed changes

michel-laterman mentioned this pull request Dec 16, 2021

Deprecate username/password when connecting to es elastic/fleet-server#995

Merged

michel-laterman added the backport-v7.16.0 Automated backport with mergify label Dec 16, 2021

Appy deprecation only to fleet-server

45e74c8

michel-laterman commented Dec 16, 2021

View reviewed changes

x-pack/elastic-agent/_meta/config/elastic-agent.docker.yml.tmpl Show resolved Hide resolved

ruflin reviewed Dec 17, 2021

View reviewed changes

michalpristas reviewed Dec 17, 2021

View reviewed changes

Review feedback

a65b066

ruflin reviewed Dec 20, 2021

View reviewed changes

Add deprecation notes in container help output

33ea36b

michel-laterman mentioned this pull request Dec 20, 2021

Add deprecation notices for username/passwords for env vars elastic/observability-docs#1409

Merged

ruflin approved these changes Dec 21, 2021

View reviewed changes

Merge remote-tracking branch 'origin/7.17' into agent-deprecate-password

d18269e

michel-laterman merged commit 1810b78 into elastic:7.17 Dec 23, 2021

michel-laterman deleted the agent-deprecate-password branch December 23, 2021 17:22

mergify bot mentioned this pull request Dec 23, 2021

[7.16](backport #29434) Deprecate username/password in elastic-agent #29598

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate username/password in elastic-agent #29434

Deprecate username/password in elastic-agent #29434

michel-laterman commented Dec 15, 2021 •

edited

elasticmachine commented Dec 15, 2021

michel-laterman Dec 15, 2021

ruflin Dec 16, 2021

elasticmachine commented Dec 15, 2021 •

edited by jenkins-beats-ci bot

Build stats

Test stats 🧪

michalpristas left a comment

ruflin commented Dec 16, 2021

ruflin Dec 16, 2021

ruflin Dec 16, 2021

michel-laterman Dec 16, 2021

ruflin Dec 16, 2021

michel-laterman commented Dec 16, 2021

ruflin left a comment

michalpristas left a comment •

edited

ruflin left a comment

michel-laterman commented Dec 21, 2021

ruflin left a comment

Deprecate username/password in elastic-agent #29434

Deprecate username/password in elastic-agent #29434

Conversation

michel-laterman commented Dec 15, 2021 • edited

What does this PR do?

Checklist

Related issues

elasticmachine commented Dec 15, 2021

michel-laterman Dec 15, 2021

Choose a reason for hiding this comment

ruflin Dec 16, 2021

Choose a reason for hiding this comment

elasticmachine commented Dec 15, 2021 • edited by jenkins-beats-ci bot

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

michalpristas left a comment

Choose a reason for hiding this comment

ruflin commented Dec 16, 2021

ruflin Dec 16, 2021

Choose a reason for hiding this comment

ruflin Dec 16, 2021

Choose a reason for hiding this comment

michel-laterman Dec 16, 2021

Choose a reason for hiding this comment

ruflin Dec 16, 2021

Choose a reason for hiding this comment

michel-laterman commented Dec 16, 2021

ruflin left a comment

Choose a reason for hiding this comment

michalpristas left a comment • edited

Choose a reason for hiding this comment

ruflin left a comment

Choose a reason for hiding this comment

michel-laterman commented Dec 21, 2021

ruflin left a comment

Choose a reason for hiding this comment

michel-laterman commented Dec 15, 2021 •

edited

elasticmachine commented Dec 15, 2021 •

edited by jenkins-beats-ci bot

michalpristas left a comment •

edited