Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Fleet] Add ES certificate authority fingerprint argument to Fleet Server install command #116620

Closed
1 of 2 tasks
joshdover opened this issue Oct 28, 2021 · 1 comment · Fixed by #120549
Closed
1 of 2 tasks

[Fleet] Add ES certificate authority fingerprint argument to Fleet Server install command #116620

joshdover opened this issue Oct 28, 2021 · 1 comment · Fixed by #120549
Assignees
@nchaulet
Labels
required-for-8.0 This work is required to be done before 8.0 lands, bc it relates to a breaking change or similar. Team:Fleet Team label for Observability Data Collection Fleet team v8.0.0
Projects
Security On by Default Implementation...

Comments

@joshdover
Copy link
Contributor

joshdover commented Oct 28, 2021 •
edited

In order to support the new 'security on by default' configuration, we need to ensure that Fleet Server and Elastic Agent will trust self-signed certificates generated by Elasticsearch 8.0. To do this, the Fleet UI should add a sha256 fingerprint of the Elasticsearch's certificate authority to the ./elastic-agent install commands provided to users in the UI.

The fingerprint should be retrieved from the Fleet Server policy's output's ca_trusted_fingerprint property which will be populated automatically during Kibana setup in #120120

Depends on

This should be populated as a --fleet-server-es-ca-trusted-fingerprint=<fingerprint> flag.
@botelastic botelastic bot added the needs-team Issues missing a team label label Oct 28, 2021
@joshdover joshdover mentioned this issue Oct 28, 2021
Closed
@joshdover joshdover added the Team:Fleet Team label for Observability Data Collection Fleet team label Oct 28, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/fleet (Team:Fleet)

@botelastic botelastic bot removed the needs-team Issues missing a team label label Oct 28, 2021
@joshdover joshdover changed the title [Fleet] Add ES certificate authority fingerprint argument to Fleet Server and Elastic Agent install commands [Fleet] Add ES certificate authority fingerprint argument to Fleet Server install command and standalone Agent yaml Nov 29, 2021
@joshdover joshdover changed the title [Fleet] Add ES certificate authority fingerprint argument to Fleet Server install command and standalone Agent yaml [Fleet] Add ES certificate authority fingerprint argument to Fleet Server install command Dec 2, 2021
@joshdover joshdover changed the title [Fleet] Add ES certificate authority fingerprint argument to Fleet Server install command [Fleet] Add ES certificate authority fingerprint arguement to Fleet Server install command Dec 2, 2021
@joshdover joshdover changed the title [Fleet] Add ES certificate authority fingerprint arguement to Fleet Server install command [Fleet] Add ES certificate authority fingerprint argument to Fleet Server install command Dec 2, 2021
@joshdover joshdover assigned nchaulet and unassigned joshdover Dec 2, 2021
@joshdover joshdover added the required-for-8.0 This work is required to be done before 8.0 lands, bc it relates to a breaking change or similar. label Dec 2, 2021
This was referenced Dec 6, 2021
Closed
Merged
Security On by Default Implementation Tracking automation moved this from Backlog/In design to Completed Dec 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nchaulet nchaulet

Labels
required-for-8.0 This work is required to be done before 8.0 lands, bc it relates to a breaking change or similar. Team:Fleet Team label for Observability Data Collection Fleet team v8.0.0
Projects
Security On by Default Implementation...
Completed
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Fleet] Configure ca trusted fingerprint for on prem users nchaulet/kibana
4 participants
@nchaulet @joshdover @jen-huang @elasticmachine