Description

Elastic Agent attempts to download the PGP/GPG key to validate the binaries.
We had an unfortunate bug where the PGP/GPG key was downloaded even if it wasn't necessary.
The bug was particularly unfortunate for air-gapped environments.

For air-gapped environments we need provide instructions to explain how to use a functionality introduced in 8.10.4 which allow Elastic Agents to download the PGP/GPG key from the Fleet Server.
In particular, we need to explain how to customize the server.pgp.upstream_url in Fleet Serve settings in order to benefit from this new feature.

I've not tested using server.pgp.upstream_url and in particular I do not know the behavior when:

• The URL is HTTPS and the CA cert is not in the trusted certs of the EA running as Fleet Server (does Fleet Server use the proxy_url of the Source URI? or we're obliged to use the HTTP_PROXY/HTTPS_PROXY/NO_PROXY)?
• The URL is HTTP (Fleet Server will download it even if exposed via HTTP)?
• Elastic Agent will reuse the same CA cert used to connect to Fleet Server for control plane also to trust the Fleet Server PGP API download endpoint?

Resources

https://support.elastic.dev/knowledge/view/5b5df063 (focus on Option I)

Collaboration

TBD. The docs and product team will work together to determine the best path forward.

Point of contact.

Main contact: @jlind23 / @pierrehilbert to delegate to the engineers who worked on the feature

Stakeholders: @lucabelluccini