Rewrite snapshot documentation and add CSP specific setups #5969
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pebrc
changed the title
naemono
reviewed
Sep 7, 2022
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
|
|
||
| == Periodic snapshots with a CronJob | ||
| The AWS IAM roles for service accounts feature allows you to give Elasticsearch restricted access to a S3 bucket without having to expose and store AWS credentials directly in Elasticsearch. This requires you to run the ECK operator on Amazon's EKS offering and an https://www.elastic.co/guide/en/elasticsearch/reference/8.1/repository-s3.html#iam-kubernetes-service-accounts[Elasticsearch cluster running at least version 8.1]. |
There was a problem hiding this comment.
Isn't this feature really allowing ES to impersonate an AWS IAM role, and therefore restrict access to an S3 Bucket?
There was a problem hiding this comment.
Technically yes, but I wanted to highlight the use case for it from the Elastic Stack side
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
barkbay
reviewed
Sep 7, 2022
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
alaudazzi
approved these changes
Sep 13, 2022
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
docs/orchestrating-elastic-stack-applications/elasticsearch/snapshots.asciidoc
Outdated
Show resolved
Hide resolved
Co-authored-by: Arianna Laudazzi <46651782+alaudazzi@users.noreply.github.com> Co-authored-by: Michael Montgomery <mmontg1@gmail.com> Co-authored-by: Michael Morello <michael.morello@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This refactors the existing snapshot documentation a bit removing obsolete sections (e.g. the cron job bit)
Adding new sections illustrating how to configure snapshot repositories on GCP and AWS using the CSP-specific IAM/service account integration on offer.
Adding a section about S3-compatible object stores and how to establish trust via a custom JVM trust store.
Fixes #5230
Fixes #5652