You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Field and document security is subject to the following limitations:
2
+
3
+
### Document level security limitations
4
+
5
+
When a user’s role enables [document level security](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md) for a data stream or index:
6
+
7
+
* Document level security doesn’t affect global index statistics that relevancy scoring uses. This means that scores are computed without taking the role query into account. Documents that don’t match the role query are never returned.
8
+
* The `has_child` and `has_parent` queries aren’t supported as query parameters in the role definition. The `has_child` and `has_parent` queries can be used in the search API with document level security enabled.
9
+
*[Date math](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/rest-apis/common-options.md#date-math) expressions cannot contain `now` in [range queries with date fields](asciidocalypse://docs/elasticsearch/docs/reference/query-languages/query-dsl-range-query.md#ranges-on-dates).
10
+
* Any query that makes remote calls to fetch query data isn’t supported, including the following queries:
11
+
12
+
*`terms` query with terms lookup
13
+
*`geo_shape` query with indexed shapes
14
+
*`percolate` query
15
+
16
+
* If suggesters are specified and document level security is enabled, the specified suggesters are ignored.
17
+
* A search request cannot be profiled if document level security is enabled.
18
+
* The [terms enum API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-terms-enum) does not return terms if document level security is enabled.
19
+
* The [`multi_match`](asciidocalypse://docs/elasticsearch/docs/reference/query-languages/query-dsl-multi-match-query.md) query does not support specifying fields using wildcards.
20
+
21
+
:::{note}
22
+
While document-level security prevents users from viewing restricted documents, it’s still possible to write search requests that return aggregate information about the entire index. A user whose access is restricted to specific documents in an index could still learn about field names and terms that only exist in inaccessible documents, and count how many inaccessible documents contain a given term.
23
+
:::
24
+
25
+
### Field level security limitations
26
+
27
+
When a user’s role enables document or [field level security](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md) for a data stream or index:
28
+
29
+
* The user cannot perform write operations:
30
+
31
+
* The update API isn’t supported.
32
+
* Update requests included in bulk requests aren’t supported.
33
+
34
+
* The user cannot perform operations that effectively make contents accessible under another name, including actions from the following APIs:
35
+
36
+
*[Clone index API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-clone)
37
+
*[Shrink index API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-shrink)
38
+
*[Split index API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-split)
* The request cache is disabled for search requests if either of the following are true:
42
+
43
+
* The role query that defines document level security is [templated](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md#templating-role-query) using a [stored script](/explore-analyze/scripting/modules-scripting-using.md#script-stored-scripts).
44
+
* The target indices are a mix of local and remote indices.
Copy file name to clipboardExpand all lines: deploy-manage/api-keys/serverless-project-api-keys.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -70,7 +70,7 @@ For example, the following `role_descriptors` object defines a `books-read-only`
70
70
}
71
71
```
72
72
73
-
For the `role_descriptors` object schema, check out the [`/_security/api_key` endpoint](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/operation/operation-security-create-api-key) docs. For supported privileges, check [Security privileges](../users-roles/cluster-or-deployment-auth/elasticsearch-privileges.md#privileges-list-indices).
73
+
For the `role_descriptors` object schema, check out the [`/_security/api_key` endpoint](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/operation/operation-security-create-api-key) docs. For supported privileges, check [Security privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/elasticsearch-privileges.md#privileges-list-indices).
Copy file name to clipboardExpand all lines: deploy-manage/deploy/cloud-on-k8s.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -68,12 +68,14 @@ This section outlines the supported Kubernetes and Elastic Stack versions for EC
68
68
ECK is compatible with the following Kubernetes distributions and related technologies:
69
69
70
70
* Kubernetes 1.28-1.32
71
-
* OpenShift 4.12-4.17
71
+
* OpenShift 4.13-4.18
72
72
* Google Kubernetes Engine (GKE), Azure Kubernetes Service (AKS), and Amazon Elastic Kubernetes Service (EKS)
73
73
* Helm: 3.2.0+
74
74
75
75
ECK should work with all conformant **installers** listed in these [FAQs](https://github.com/cncf/k8s-conformance/blob/master/faq.md#what-is-a-distribution-hosted-platform-and-an-installer). Distributions include source patches and so may not work as-is with ECK.
76
76
77
+
Alpha, beta, and stable API versions follow the same [conventions used by Kubernetes](https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-versioning).
78
+
77
79
### Elastic Stack compatibility
78
80
79
81
ECK is compatible with the following Elastic Stack applications:
% Internal links rely on the following IDs being on this page (e.g. as a heading ID, paragraph ID, etc):
27
-
28
-
$$$air-gapped-install$$$
29
-
30
-
$$$k8s-container-registry-override$$$
31
-
32
-
$$$k8s-eck-diag-air-gapped$$$
33
-
34
-
% There are two concepts and areas to explore here:
35
-
% ECK installation on air-gapped. This has no complexity as it's all a matter of docker registry and docker images.
36
-
% Managing deployments on an ECK running on air-gapped is something not really covered in the official ECK book and partly covered in stack-docs
37
-
38
-
% In this doc we will focus on ECK operator installation in air gapped environments, and we will link to Manage Deployments -> Air gapped (doesn't exist yet) for the content and examples about the rest.
39
-
40
-
% from fleet air-gapped
41
-
% Kibana is able to reach the Elastic Package Registry to download package metadata and content.
42
-
% Elastic Agents are able to download binaries during upgrades from the Elastic Artifact Registry.
43
-
44
-
% what about Elasticsearch requirements for example for GeoIP database, etc?
45
-
46
-
Pending to determine what to do with this:
47
-
* Syncing container images for ECK and all other {{stack}} components over to a locally-accessible container repository.
48
-
* Modifying the ECK helm chart configuration so that ECK is aware that it is supposed to use your offline container repository instead of the public Elastic repository.
49
-
* Optionally, disabling ECK telemetry collection in the ECK helm chart. This configuration propagates to all other Elastic components, such as {{kib}}.
50
-
* Building your custom deployment container image for the {{artifact-registry}}.
51
-
* Building your custom deployment container image for the Elastic Endpoint Artifact Repository.
52
-
53
11
# Running in air-gapped environments [k8s-air-gapped]
54
12
55
-
The ECK operator can be run in an air-gapped environment without access to the open internet when it is configured not to pull container images from `docker.elastic.co`.
13
+
The ECK operator can be run in an air-gapped environment without access to the open internet when configured to avoid pulling container images from `docker.elastic.co`.
56
14
57
15
By default ECK does not require you to specify the container image for each Elastic Stack application you deploy.
@@ -113,49 +71,4 @@ For example, if your private registry is `my.registry` and all Elastic images ar
113
71
114
72
The [eck-diagnostics tool](../../../troubleshoot/deployments/cloud-on-k8s/run-eck-diagnostics.md) optionally runs diagnostics for Elastic Stack applications in a separate container that is deployed into the Kubernetes cluster.
115
73
116
-
In air-gapped environments with no access to the `docker.elastic.co` registry, you should copy the latest support-diagnostics container image to your internal image registry and then run the tool with the additional flag `--diagnostic-image <custom-support-diagnostics-image-name>`. To find out which support diagnostics container image matches your version of eck-diagnostics run the tool once without arguments and it will print the default image in use.
Setting up air-gapped Kubernetes or OpenShift installs of the {{stack}} has some unique concerns, but the general dependencies are the same as in the self-managed install case on a regular Linux machine.
The Elastic Kubernetes operator is an additional component in the Kubernetes OpenShift install that, essentially, does a lot of the work in installing, configuring, and updating deployments of the {{stack}}. For details, refer to the [{{eck}} install instructions](../../../deploy-manage/deploy/cloud-on-k8s/air-gapped-install.md).
129
-
130
-
The main requirements are:
131
-
132
-
* Syncing container images for ECK and all other {{stack}} components over to a locally-accessible container repository.
133
-
* Modifying the ECK helm chart configuration so that ECK is aware that it is supposed to use your offline container repository instead of the public Elastic repository.
134
-
* Optionally, disabling ECK telemetry collection in the ECK helm chart. This configuration propagates to all other Elastic components, such as {{kib}}.
135
-
* Building your custom deployment container image for the {{artifact-registry}}.
136
-
* Building your custom deployment container image for the Elastic Endpoint Artifact Repository.
The container image can be downloaded from the official Elastic Docker repository, as described in the {{fleet}} and {{elastic-agent}} [air-gapped environments](asciidocalypse://docs/docs-content/docs/reference/ingestion-tools/fleet/air-gapped.md) documentation.
142
-
143
-
This container would, ideally, run as a Kubernetes deployment. Refer to [Appendix C - EPR Kubernetes Deployment](../../../deploy-manage/deploy/self-managed/air-gapped-install.md#air-gapped-epr-kubernetes-example) for examples.
A custom container would need to be created following similar instructions to setting up a web server in the [self-managed install case](../../../deploy-manage/deploy/self-managed/air-gapped-install.md#air-gapped-elastic-artifact-registry). For example, a container file using an NGINX base image could be used to run a build similar to the example described in [Appendix B - {{artifact-registry}}](../../../deploy-manage/deploy/self-managed/air-gapped-install.md#air-gapped-elastic-artifact-registry-example).
Just like the {{artifact-registry}}. A custom container needs to be created following similar instructions to setting up a web server for the [self-managed install case](../../../deploy-manage/deploy/self-managed/air-gapped-install.md#air-gapped-elastic-artifact-registry).
154
-
155
-
156
-
#### 2.5. Ironbank Secure Images for Elastic [air-gapped-k8s-os-ironbank-secure-images]
157
-
158
-
Besides the public [Elastic container repository](https://www.docker.elastic.co), most {{stack}} container images are also available in Platform One’s [Iron Bank](https://ironbank.dso.mil/repomap?vendorFilters=Elastic&page=1&sort=1).
159
-
160
-
161
-
74
+
In air-gapped environments with no access to the `docker.elastic.co` registry, you should copy the latest support-diagnostics container image to your internal image registry and then run the tool with the additional flag `--diagnostic-image <custom-support-diagnostics-image-name>`. To find out which support diagnostics container image matches your version of eck-diagnostics, run the tool once without arguments and it will print the default image in use.
: AutoOps is currently limited to {{es}} (not {{kib}}, Logstash and Beats).
21
21
22
22
$$$faq-autoops-supported-versions$$$What versions of Elasticsearch are supported for Elastic Cloud Hosted?
23
-
: AutoOps is currently available for {{es}} versions 7.17 and above.
23
+
: AutoOps supports {es} versions according to the [supported Elastic Stack versions](https://www.elastic.co/support/eol).
24
24
25
25
$$$faq-autoops-license$$$How is AutoOps currently licensed?
26
26
: AutoOps current feature set is available to Elastic Cloud Hosted customers at all subscription tiers. For more information please refer to the [subscription page](https://www.elastic.co/subscriptions/cloud).
% Please leave the AutoOps banner in the final content of this page
64
+
65
+
:::{important}
66
+
If you’re using Elastic Cloud Hosted, then you can use AutoOps to monitor your cluster. AutoOps significantly simplifies cluster management with performance recommendations, resource utilization visibility, real-time issue detection and resolution paths. For more information, refer to [Monitor with AutoOps](/deploy-manage/monitor/autoops.md).
67
+
:::
68
+
69
+
63
70
**This page is a work in progress.** The documentation team is working to combine content pulled from the following pages:
0 commit comments