Skip to content

Enable SSL in the Elastic Stack#789

Merged
jsoriano merged 39 commits intoelastic:mainfrom
jsoriano:stack-enable-ssl
Jun 28, 2022
Merged

Enable SSL in the Elastic Stack#789
jsoriano merged 39 commits intoelastic:mainfrom
jsoriano:stack-enable-ssl

Conversation

@jsoriano
Copy link
Copy Markdown
Member

@jsoriano jsoriano commented Apr 12, 2022 •
edited
Loading

Enable SSL in the Elastic Stack to ensure that everything works with recommended security settings.

Tasks:

  • Create self-signed certificates
    • Use a common self-signed root CA?
    • Create a pair of key/cert per service
  • Enable SSL in elasticsearch
  • Enable SSL in package-registry
  • Enable SSL in kibana
  • Enable SSL in fleet-server
  • Reduce use of insecure flags by configuring clients with proper CAs
  • Ingestion to ES works (with hack)
  • Check that elastic-package test works
    • Check with oldest supported stack version (7.14).
  • Fix stack in 7.x
    • Templatize kibana config to use xpack.fleet.agents.elasticsearch.ca_sha256. This is not what I want to do, see comment.
  • Configure Kubernetes agent
  • Configure custom agent (introduced in Add config option to deploy custom elastic-agents as test services #786).
  • Additional testing:
  • Reorganize/reuse certpool builders
  • Investigate problems with unexpectedly re-generated profile (and certificates). Seems solved at least since 64693ec.
  • Integrate cert files better with the profile
  • Keep support for non-SSL deployments? No.
  • Print endpoints when elastic-package stack up completes. Print kibana and elasticsearch information on boot-up #861

Fixes #654

@jsoriano jsoriano self-assigned this Apr 12, 2022
@jsoriano jsoriano mentioned this pull request Apr 12, 2022
Closed
@elasticmachine
Copy link
Copy Markdown
Collaborator

elasticmachine commented Apr 12, 2022 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-06-23T09:01:40.904+0000

  • Duration: 36 min 5 sec

Test stats 🧪

Test Results
Failed 0
Passed 747
Skipped 0
Total 747

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@jsoriano jsoriano force-pushed the stack-enable-ssl branch 3 times, most recently from c72dd7c to 7c912c1 Compare April 20, 2022 17:17
jsoriano
jsoriano commented Apr 20, 2022
View reviewed changes
@jsoriano jsoriano force-pushed the stack-enable-ssl branch 2 times, most recently from 62be326 to 55021bd Compare April 21, 2022 19:30
@v1v
Copy link
Copy Markdown
Member

v1v commented Apr 26, 2022

/test

@elasticmachine
Copy link
Copy Markdown
Collaborator

elasticmachine commented Apr 26, 2022 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (31/31) 💚
Files 66.372% (75/113) 👍 0.3
Classes 61.392% (97/158) 👍 0.246
Methods 49.686% (316/636) 👍 0.56
Lines 33.345% (2847/8538) 👍 0.289
Conditionals 100.0% (0/0) 💚

@jsoriano jsoriano mentioned this pull request May 31, 2022
Closed
This was referenced Jun 14, 2022
Merged
Merged
@jsoriano jsoriano mentioned this pull request Jun 22, 2022
Merged
@jsoriano jsoriano marked this pull request as ready for review June 23, 2022 14:31
@jsoriano jsoriano requested a review from a team June 23, 2022 14:31
@jsoriano
Copy link
Copy Markdown
Member Author

jsoriano commented Jun 23, 2022

Opening for review.

Additional testing on Windows would be nice, @ManojS-shetty has agreed to give it a try 🙂 Thanks!

mtojek
mtojek reviewed Jun 24, 2022
View reviewed changes
Copy link
Copy Markdown
Contributor

@mtojek mtojek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comments

@mtojek mtojek self-requested a review June 24, 2022 10:46
mtojek
mtojek approved these changes Jun 24, 2022
View reviewed changes
Copy link
Copy Markdown
Contributor

@mtojek mtojek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

@ManojS-shetty
Copy link
Copy Markdown

ManojS-shetty commented Jun 24, 2022

Opening for review.

Additional testing on Windows would be nice, @ManojS-shetty has agreed to give it a try 🙂 Thanks!

@jsoriano Followed the below steps to test this on windows virtual machine:

  • Generated the binary for elastic-package from the PR.
  • Tried the command elastic-package stack up -d
  • After few minutes i was able to hit the URL (https://localhost:5601)
  • But i observed kibana container was going into unhealthy state.
  • Below is the screenshot from the windows virtual machine.

Screenshot 2022-06-24 at 5 34 45 PM

@jsoriano
Copy link
Copy Markdown
Member Author

jsoriano commented Jun 24, 2022

But i observed kibana container was going into unhealthy state.

This looks like #856, let's confirm offline with logs.

@ManojS-shetty ManojS-shetty self-requested a review June 27, 2022 10:54
@jsoriano
Copy link
Copy Markdown
Member Author

jsoriano commented Jun 27, 2022

After looking to Manoj's logs, I couldn't find a reason why it was failing, it didn't seem related to #856, more testing is going to be needed.

@jsoriano
Copy link
Copy Markdown
Member Author

jsoriano commented Jun 27, 2022

I did some manual testing on Windows and I found issues related to CRLF, see #869. After following the instructions added in this PR, elastic-package stack worked well for me with SSL.

@ManojS-shetty
Copy link
Copy Markdown

ManojS-shetty commented Jun 28, 2022 •
edited
Loading

After following the steps in #869 . Able to run the elastic-package stack without any difficulty in windows development platform.

LGTM!

Thank you @jsoriano

@jsoriano jsoriano merged commit 3b2d1e9 into elastic:main Jun 28, 2022
@jsoriano jsoriano deleted the stack-enable-ssl branch June 28, 2022 11:35
@mrodm mrodm mentioned this pull request Jun 30, 2022
Closed
@eyalkraft eyalkraft mentioned this pull request Jul 13, 2022
Closed
@jsoriano jsoriano mentioned this pull request Dec 21, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers

@mtojek mtojek mtojek approved these changes

@ManojS-shetty ManojS-shetty ManojS-shetty approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@jsoriano jsoriano

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Enable SSL mode in the Elastic stack

6 participants

@jsoriano @elasticmachine @v1v @belimawr @mtojek @ManojS-shetty