[Fleet] Add ssl fields to agent binary source settings by criamico · Pull Request #213211 · elastic/kibana

criamico · 2025-03-05T09:28:10Z

closes #207324
follow up of #207322

Summary

Add ssl fields to agent binary source settings. The new fields allow users to set a TLS connection to the agent binary source uri.

The cert key will be stored either as an encrypted SO or a secret (latter option will be available once fleet server will have this functionality: Support new SSL secrets fields fleet-server#4470).
The secret field is only available when the feature flag enableSSLSecrets is enabled, otherwise the cert key is saved as an encrypted SO.

Screenshots

Generated policy:

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

criamico · 2025-03-05T09:28:29Z

@elasticmachine merge upstream

…te --fix'

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

… src/core/server/integration_tests/ci_checks'

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

criamico · 2025-03-06T16:48:54Z

@elasticmachine merge upstream

criamico · 2025-03-07T15:26:50Z

@elasticmachine merge upstream

elasticmachine · 2025-03-07T15:27:40Z

Pinging @elastic/fleet (Team:Fleet)

criamico · 2025-03-10T10:36:47Z

x-pack/platform/plugins/shared/fleet/server/saved_objects/index.ts

+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {},


explanation of this field can be found in a previous PR: https://github.com/elastic/kibana/pull/208091/files#r1971649339

criamico · 2025-03-10T10:38:16Z

x-pack/platform/plugins/shared/fleet/server/saved_objects/index.ts

  });
+  encryptedSavedObjects.registerType({
+    type: DOWNLOAD_SOURCE_SAVED_OBJECT_TYPE,
+    attributesToEncrypt: new Set([{ key: 'ssl', dangerouslyExposeValue: true }]),


Had a discussion about the attributes on this encrypted object in the previuos PR, it applies the same here : https://github.com/elastic/kibana/pull/208091/files#r1971664328

criamico · 2025-03-10T10:39:02Z

x-pack/platform/plugins/shared/fleet/server/saved_objects/index.ts

+    type: DOWNLOAD_SOURCE_SAVED_OBJECT_TYPE,
+    attributesToEncrypt: new Set([{ key: 'ssl', dangerouslyExposeValue: true }]),
+    // enforceRandomId allows to create an SO with an arbitrary id
+    enforceRandomId: false,


Explanation of the need for this parameter: https://github.com/elastic/kibana/pull/208091/files#r1948774730

criamico · 2025-03-10T14:26:30Z

@elasticmachine merge upstream

criamico · 2025-03-11T08:50:27Z

@elasticmachine merge upstream

criamico · 2025-03-11T10:02:05Z

@elasticmachine merge upstream

elasticmachine · 2025-03-11T10:02:08Z

There are no new commits on the base branch.

juliaElastic · 2025-03-11T13:57:52Z

x-pack/platform/plugins/shared/fleet/server/types/models/download_sources.ts

+    schema.object({
+      certificate_authorities: schema.maybe(schema.arrayOf(schema.string())),
+      certificate: schema.maybe(schema.string()),
+      key: schema.maybe(schema.string()),


should we allow null here?

Good question, I was going with the same basic schema as the other ssl.key values that I added recently. neither fleet server host nor outputs have it nullable, but maybe they should all be nullable instead?

I think it makes sense to keep their behavior aligned as they work the same way.

maybe we don't need it, tested locally and works fine when updating a plain text ssl.key to a secret

juliaElastic · 2025-03-11T13:58:08Z

x-pack/platform/plugins/shared/fleet/server/types/models/agent_policy.ts

+  verification_mode: schema.maybe(schema.string()),
+  certificate_authorities: schema.maybe(schema.arrayOf(schema.string())),
+  certificate: schema.maybe(schema.string()),
+  key: schema.maybe(schema.string()),


same here, should we allow null here?

juliaElastic · 2025-03-11T14:33:51Z

.../applications/fleet/sections/settings/components/download_source_flyout/ssl_form_section.tsx

+          label={i18n.translate(
+            'xpack.fleet.settings.editDownloadSourcesFlyout.sslCertificateAuthoritiesInputLabel',
+            {
+              defaultMessage: 'Server SSL certificate authorities (optional)',


do we need (optional) here, all fields seems optional?

I'm going to open a follow up PR to address some small UX changes across the whole feature. I think it can be addressed there.

juliaElastic

Tested locally, LGTM

elasticmachine · 2025-03-11T16:05:22Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: e82ca43

Failed CI Steps

Fleet Cypress Tests #1

Test Failures

[job] [logs] Fleet Cypress Tests #1 / View agents list Bulk actions should allow to bulk upgrade agents and cancel that upgrade

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`fleet`	1194	1195	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	1.7MB	1.7MB	+4.3KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`fleet`	86	87	+1

History

💔 Build #282584 failed b1ac933
💛 Build #282325 was flaky eddd508
💔 Build #282068 failed bcf18c1
💔 Build #281874 failed 34dc306
💔 Build #281857 failed 5e1f490

cc @criamico

## Summary Follow up of #208091, #213211 and #213211 Small UI enhancements to the SSL options introduced with the mentioned PRs - All the forms are now nested under an accordion to avoid taking too much space <details> <summary>Fleet server hosts</summary> <img width="804" alt="Screenshot 2025-03-12 at 11 38 01" src="https://github.com/user-attachments/assets/5835811a-6a22-470e-9e74-6dfc78761d8b" /> <img width="806" alt="Screenshot 2025-03-12 at 11 38 11" src="https://github.com/user-attachments/assets/865f02b0-ec36-489f-904c-97c91a29ffca" /> <img width="787" alt="Screenshot 2025-03-12 at 11 51 39" src="https://github.com/user-attachments/assets/494e20b7-a44b-45e9-aead-c7d51260da72" /> <img width="795" alt="Screenshot 2025-03-12 at 11 51 51" src="https://github.com/user-attachments/assets/ba0abb37-0142-4ae1-ab5f-f2af96602c7a" /> </details> <details> <summary>Agent Binary source</summary> <img width="801" alt="Screenshot 2025-03-12 at 11 39 38" src="https://github.com/user-attachments/assets/915b4ed9-d23d-4764-9805-aef5cce5798e" /> <img width="801" alt="Screenshot 2025-03-12 at 11 39 44" src="https://github.com/user-attachments/assets/ea0347fb-a1fa-4454-b296-a132dffe6611" /> </details> <details> <summary>ES Outputs</summary> <img width="801" alt="Screenshot 2025-03-12 at 11 38 30" src="https://github.com/user-attachments/assets/7ae7fdd4-f693-4d12-bb7e-79ddee2c6c3b" /> <img width="803" alt="Screenshot 2025-03-12 at 11 38 36" src="https://github.com/user-attachments/assets/179463c2-9cbb-4dec-8f80-44c08a53073d" /> </details> <details> <summary>Remote ES Outputs</summary> <img width="802" alt="Screenshot 2025-03-12 at 11 46 39" src="https://github.com/user-attachments/assets/b1f151a9-433a-4699-8aec-79f8174d069f" /> </details> <details> <summary>Logstash Outputs</summary> <img width="803" alt="Screenshot 2025-03-12 at 11 39 25" src="https://github.com/user-attachments/assets/1f4da34c-ba2a-47e8-a258-61d943e9af7a" /> </details> ### Checklist - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>

## Summary Follow up of elastic#208091, elastic#213211 and elastic#213211 Small UI enhancements to the SSL options introduced with the mentioned PRs - All the forms are now nested under an accordion to avoid taking too much space <details> <summary>Fleet server hosts</summary> <img width="804" alt="Screenshot 2025-03-12 at 11 38 01" src="https://github.com/user-attachments/assets/5835811a-6a22-470e-9e74-6dfc78761d8b" /> <img width="806" alt="Screenshot 2025-03-12 at 11 38 11" src="https://github.com/user-attachments/assets/865f02b0-ec36-489f-904c-97c91a29ffca" /> <img width="787" alt="Screenshot 2025-03-12 at 11 51 39" src="https://github.com/user-attachments/assets/494e20b7-a44b-45e9-aead-c7d51260da72" /> <img width="795" alt="Screenshot 2025-03-12 at 11 51 51" src="https://github.com/user-attachments/assets/ba0abb37-0142-4ae1-ab5f-f2af96602c7a" /> </details> <details> <summary>Agent Binary source</summary> <img width="801" alt="Screenshot 2025-03-12 at 11 39 38" src="https://github.com/user-attachments/assets/915b4ed9-d23d-4764-9805-aef5cce5798e" /> <img width="801" alt="Screenshot 2025-03-12 at 11 39 44" src="https://github.com/user-attachments/assets/ea0347fb-a1fa-4454-b296-a132dffe6611" /> </details> <details> <summary>ES Outputs</summary> <img width="801" alt="Screenshot 2025-03-12 at 11 38 30" src="https://github.com/user-attachments/assets/7ae7fdd4-f693-4d12-bb7e-79ddee2c6c3b" /> <img width="803" alt="Screenshot 2025-03-12 at 11 38 36" src="https://github.com/user-attachments/assets/179463c2-9cbb-4dec-8f80-44c08a53073d" /> </details> <details> <summary>Remote ES Outputs</summary> <img width="802" alt="Screenshot 2025-03-12 at 11 46 39" src="https://github.com/user-attachments/assets/b1f151a9-433a-4699-8aec-79f8174d069f" /> </details> <details> <summary>Logstash Outputs</summary> <img width="803" alt="Screenshot 2025-03-12 at 11 39 25" src="https://github.com/user-attachments/assets/1f4da34c-ba2a-47e8-a258-61d943e9af7a" /> </details> ### Checklist - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>

closes elastic#207324 follow up of elastic#207322 ## Summary Add ssl fields to agent binary source settings. The new fields allow users to set a TLS connection to the agent binary source uri. - The cert key will be stored either as an encrypted SO or a secret (latter option will be available once fleet server will have this functionality: elastic/fleet-server#4470). - The secret field is only available when the feature flag `enableSSLSecrets` is enabled, otherwise the cert key is saved as an encrypted SO. <details> <summary>Screenshots</summary> <img width="809" alt="Screenshot 2025-03-11 at 14 53 44" src="https://github.com/user-attachments/assets/e93a04cf-c699-4e13-8cb6-870986197f92" /> <img width="804" alt="Screenshot 2025-03-11 at 14 53 34" src="https://github.com/user-attachments/assets/c2c13c8f-e65c-4843-a538-d317e1359bf0" /> Generated policy: <img width="797" alt="Screenshot 2025-03-06 at 17 43 02" src="https://github.com/user-attachments/assets/12411fea-9a8b-4ee9-aa7c-123c6aefea4a" /> </details> ### Checklist - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary Follow up of elastic#208091, elastic#213211 and elastic#213211 Small UI enhancements to the SSL options introduced with the mentioned PRs - All the forms are now nested under an accordion to avoid taking too much space <details> <summary>Fleet server hosts</summary> <img width="804" alt="Screenshot 2025-03-12 at 11 38 01" src="https://github.com/user-attachments/assets/5835811a-6a22-470e-9e74-6dfc78761d8b" /> <img width="806" alt="Screenshot 2025-03-12 at 11 38 11" src="https://github.com/user-attachments/assets/865f02b0-ec36-489f-904c-97c91a29ffca" /> <img width="787" alt="Screenshot 2025-03-12 at 11 51 39" src="https://github.com/user-attachments/assets/494e20b7-a44b-45e9-aead-c7d51260da72" /> <img width="795" alt="Screenshot 2025-03-12 at 11 51 51" src="https://github.com/user-attachments/assets/ba0abb37-0142-4ae1-ab5f-f2af96602c7a" /> </details> <details> <summary>Agent Binary source</summary> <img width="801" alt="Screenshot 2025-03-12 at 11 39 38" src="https://github.com/user-attachments/assets/915b4ed9-d23d-4764-9805-aef5cce5798e" /> <img width="801" alt="Screenshot 2025-03-12 at 11 39 44" src="https://github.com/user-attachments/assets/ea0347fb-a1fa-4454-b296-a132dffe6611" /> </details> <details> <summary>ES Outputs</summary> <img width="801" alt="Screenshot 2025-03-12 at 11 38 30" src="https://github.com/user-attachments/assets/7ae7fdd4-f693-4d12-bb7e-79ddee2c6c3b" /> <img width="803" alt="Screenshot 2025-03-12 at 11 38 36" src="https://github.com/user-attachments/assets/179463c2-9cbb-4dec-8f80-44c08a53073d" /> </details> <details> <summary>Remote ES Outputs</summary> <img width="802" alt="Screenshot 2025-03-12 at 11 46 39" src="https://github.com/user-attachments/assets/b1f151a9-433a-4699-8aec-79f8174d069f" /> </details> <details> <summary>Logstash Outputs</summary> <img width="803" alt="Screenshot 2025-03-12 at 11 39 25" src="https://github.com/user-attachments/assets/1f4da34c-ba2a-47e8-a258-61d943e9af7a" /> </details> ### Checklist - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>

jeramysoucy · 2025-08-13T19:40:56Z

Just commenting to leave a trail on use of dangerouslyExposeValue. This is a temporary implementation.
See comment #208091 (comment)

[Fleet] Add ssl fields to agent binary source settings

12b0d8c

criamico added the Team:Fleet Team label for Observability Data Collection Fleet team label Mar 5, 2025

criamico self-assigned this Mar 5, 2025

elasticmachine and others added 10 commits March 5, 2025 10:28

Merge branch 'main' into 207324_ssl_binary_source

4fe0c61

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

f3d4458

…te --fix'

Increase test coverage on secrets functions

8ba53c3

[CI] Auto-commit changed files from 'make api-docs'

a818c1c

[CI] Auto-commit changed files from 'node scripts/jest_integration -u…

29b60de

… src/core/server/integration_tests/ci_checks'

Fix tests and improve types

7ebdfbd

[CI] Auto-commit changed files from 'make api-docs'

5e588b8

More tests for full agent policy

a9fc6e0

criamico added v9.1.0 release_note:feature Makes this part of the condensed release notes backport:skip This PR does not require backporting labels Mar 6, 2025

elasticmachine and others added 3 commits March 6, 2025 17:48

Merge branch 'main' into 207324_ssl_binary_source

b93845e

fix logic when both key and secrets key are present; more tests

529b42a

Add integration tests

0e5ab14

Merge branch 'main' into 207324_ssl_binary_source

508a1aa

criamico marked this pull request as ready for review March 7, 2025 15:27

criamico requested review from a team as code owners March 7, 2025 15:27

criamico added 2 commits March 7, 2025 16:46

remove console log in test

5e1f490

Fix linter

34dc306

Merge branch 'main' into 207324_ssl_binary_source

bcf18c1

criamico commented Mar 10, 2025

View reviewed changes

Reorder integration tests

bd41cd6

elasticmachine and others added 2 commits March 10, 2025 15:26

Merge branch 'main' into 207324_ssl_binary_source

d3508ba

Add warning callout

eddd508

SiddharthMantri self-requested a review March 10, 2025 16:05

Merge branch 'main' into 207324_ssl_binary_source

b1ac933

afharo approved these changes Mar 11, 2025

View reviewed changes

Group ssl fields under euiPanel

e82ca43

juliaElastic reviewed Mar 11, 2025

View reviewed changes

juliaElastic approved these changes Mar 11, 2025

View reviewed changes

criamico merged commit 382630e into elastic:main Mar 12, 2025
9 checks passed

criamico deleted the 207324_ssl_binary_source branch March 12, 2025 08:50

This was referenced Mar 12, 2025

[Fleet] Tweak new SSL settings #214060

Merged

[Fleet] Make proxy certificate key a secret #208748

Open

juliaElastic mentioned this pull request Apr 23, 2025

[Fleet] save and read custom asset errors #218816

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Fleet] Add ssl fields to agent binary source settings#213211

[Fleet] Add ssl fields to agent binary source settings#213211
criamico merged 23 commits intoelastic:mainfrom
criamico:207324_ssl_binary_source

criamico commented Mar 5, 2025 •

edited

Loading

criamico commented Mar 5, 2025

criamico commented Mar 6, 2025

criamico commented Mar 7, 2025

elasticmachine commented Mar 7, 2025

criamico Mar 10, 2025

criamico Mar 10, 2025

criamico Mar 10, 2025

criamico commented Mar 10, 2025

criamico commented Mar 11, 2025

criamico commented Mar 11, 2025

elasticmachine commented Mar 11, 2025

juliaElastic Mar 11, 2025

criamico Mar 11, 2025 •

edited

Loading

juliaElastic Mar 11, 2025

juliaElastic Mar 11, 2025

juliaElastic Mar 11, 2025

criamico Mar 11, 2025

juliaElastic left a comment

elasticmachine commented Mar 11, 2025

Uh oh!

jeramysoucy commented Aug 13, 2025

Labels

6 participants

Conversation

criamico commented Mar 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

criamico commented Mar 5, 2025

criamico commented Mar 6, 2025

criamico commented Mar 7, 2025

elasticmachine commented Mar 7, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

criamico commented Mar 10, 2025

criamico commented Mar 11, 2025

criamico commented Mar 11, 2025

elasticmachine commented Mar 11, 2025

Choose a reason for hiding this comment

criamico Mar 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

juliaElastic left a comment

Choose a reason for hiding this comment

elasticmachine commented Mar 11, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

Public APIs missing exports

History

Uh oh!

jeramysoucy commented Aug 13, 2025

Labels

6 participants

criamico commented Mar 5, 2025 •

edited

Loading

criamico Mar 11, 2025 •

edited

Loading