Document edge cases around Fleet/Agent setups with Ingress #6853
Description
When using Elastic Agent with Fleet in a mixed setup behind an Ingress with public CA, there are a few non-obvious gotchas that should be documented:
Mixed setup
: some agents reside inside the cluster some agents outside and access Fleet server through the ingress
The agents inside the cluster will be unable to connect to Fleet server due to the Agents in the cluster being configured with with the self-signed certificate generated by ECK. The FLEET_URL for the agents will however after enrolment (where the value set from ECK is used) be changed to the URL of the Ingress and connection will go through the Ingress. However due the self-signed certificates form ECK replacing OS-level trust in the public CA this connection will not be successfully established.
A workaround is to set FLEET_CA to an empty string to allow the public CA to be trusted. This might however cause problems when enrolling.