[Fleet] add fleet-server version check for SSL secrets by juliaElastic · Pull Request #237464 · elastic/kibana

juliaElastic · 2025-10-03T12:02:15Z

Summary

Do not merge until elastic/fleet-server#4470 is done, otherwise secrets would be enabled in serverless without fleet-server support.

Closes #237404

Added a separate setting to check if fleet-server supports SSL secrets. Working on the assumption that elastic/fleet-server#4470 will be done in 9.3.

The check ensures that SSL secrets are only used if all fleet-servers are on the supported version or fleet-server is standalone (in serverless).

To verify:

As a baseline start kibana without fleet-servers on 9.3 (so version check will not be met)
Add a Fleet Server host and fill out all secret fields (SSL keys)
Verify that the keys are stored as plain text (except for ssl.es_key, which requires fleet-server 8.12)
Add an Agent Binary source, fill out the secret field
Verify that the ssl.key is stored as plain text
Enroll fleet-server version 9.3 (and remove older ones) or set kibana config xpack.fleet.internal.fleetServerStandalone: true
Edit the Fleet Server host and verify that the SSL keys are stored as secrets
Edit the Agent Binary source and verify that the SSL key is stored as secrets

Release note

Enable storing secrets in Fleet Server Host config if fleet-server is running at a minimum supported version.
The secret storage is going to be enabled if there are no Fleet Servers enrolled yet.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

See some risk examples
...

…te --fix'

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/streams --include-path /api/fleet --include-path /api/saved_objects/_import --include-path /api/saved_objects/_export --include-path /api/maintenance_window --include-path /api/agent_builder --update'

… src/core/server/integration_tests/ci_checks'

nchaulet · 2025-10-06T13:08:47Z

Does this mean that every new deployment first fleet server policies will not have ssl secrets, even if the user start a 9.3 as a first fleet server?

juliaElastic · 2025-10-06T13:16:08Z

Does this mean that every new deployment first fleet server policies will not have ssl secrets, even if the user start a 9.3 as a first fleet server?

Hm good point, the check requires a running fleet server on version 9.3 so fleet-server policies at first wouldn't store secrets. Should we change this to allow secrets if there are no running fleet-servers?
Though there is a chance that an older version of fleet-server will be enrolled in self-managed.

nchaulet · 2025-10-06T13:24:20Z

Hm good point, the check requires a running fleet server on version 9.3 so fleet-server policies at first wouldn't store secrets. Should we change this to allow secrets if there are no running fleet-servers?

In my opinion it will make sense, I think there are low odds a user want to add an older fleet server than the the stack version on a new cluster no? maybe worth having other people thoughts on that cc @kpollich

florent-leborgne

LGTM for docs

elasticmachine · 2025-10-06T16:32:41Z

Pinging @elastic/fleet (Team:Fleet)

kpollich · 2025-10-06T16:57:56Z

Hm good point, the check requires a running fleet server on version 9.3 so fleet-server policies at first wouldn't store secrets. Should we change this to allow secrets if there are no running fleet-servers?

I think at this point in time it makes sense to flip this behavior and start defaulting to secrets being enabled.

criamico · 2025-10-07T07:33:06Z

...ations/fleet/sections/settings/components/edit_output_flyout/output_form_secret_form_row.tsx

+  OUTPUT_SECRETS_MINIMUM_FLEET_SERVER_VERSION,
+} from '../../../../../../../common/constants';
+
+export type SecretType = 'output' | 'ssl';


I thought that the output secrets were supported since long time. What is the case for outputs that need the new version of fleet server?

that's true, we can probably leave the secret that ends up in the output in the previous version check

updated, had to refactor to handle the separate ssl and output secret enabled state in the fleet server host form
e378419

tested with a fleet-server 9.1.4 enrolled, and verifying that only the ES key is saved as a secret

after unenrolling that and enrolling a fleet-server 9.3.0-SNAPSHOT, update the fleet-server-host and verify that all 3 SSL keys are stored as secret

Thanks for this change!

…tion_tests/ci_checks

elasticmachine · 2025-12-08T09:32:42Z

💚 Build Succeeded

Buildkite Build
Commit: 4112d5d

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	2.1MB	2.1MB	+248.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	178.8KB	179.0KB	+176.0B

History

💛 Build #369071 was flaky 188e834
💚 Build #362241 succeeded 02c4eee
💔 Build #361943 failed 90ff3fb
💔 Build #361868 failed b55846e
💔 Build #360252 failed 1cf47cd
💔 Build #360072 failed 7aa2fc1

cc @juliaElastic

## Summary Do not merge until elastic/fleet-server#4470 is done, otherwise secrets would be enabled in serverless without fleet-server support. Closes elastic#237404 Added a separate setting to check if fleet-server supports SSL secrets. Working on the assumption that elastic/fleet-server#4470 will be done in 9.3. The check ensures that SSL secrets are only used if all fleet-servers are on the supported version or fleet-server is standalone (in serverless). To verify: - As a baseline start kibana without fleet-servers on 9.3 (so version check will not be met) - Add a Fleet Server host and fill out all secret fields (SSL keys) - Verify that the keys are stored as plain text (except for `ssl.es_key`, which requires fleet-server 8.12) - Add an Agent Binary source, fill out the secret field - Verify that the `ssl.key` is stored as plain text - Enroll fleet-server version 9.3 (and remove older ones) or set kibana config `xpack.fleet.internal.fleetServerStandalone: true` - Edit the Fleet Server host and verify that the SSL keys are stored as secrets - Edit the Agent Binary source and verify that the SSL key is stored as secrets <img width="509" height="835" alt="image" src="https://github.com/user-attachments/assets/f80e79b1-4e07-459a-b2c6-75d36e6fe6f3" /> <img width="716" height="483" alt="image" src="https://github.com/user-attachments/assets/51d68b24-1b82-4236-80c6-6bf4589f9aa2" /> <img width="506" height="828" alt="image" src="https://github.com/user-attachments/assets/e2fdc0d9-9e8f-49c4-b993-7afb67663f30" /> <img width="711" height="348" alt="image" src="https://github.com/user-attachments/assets/1348ad7a-dea4-4bf2-ab04-d1a1ad01f421" /> <img width="713" height="468" alt="image" src="https://github.com/user-attachments/assets/32a7b447-fc11-41ce-b594-a39128673a81" /> <img width="705" height="375" alt="image" src="https://github.com/user-attachments/assets/0b658f57-c492-468f-a9b7-325d9134fafa" /> ## Release note Enable storing secrets in Fleet Server Host config if fleet-server is running at a minimum supported version. The secret storage is going to be enabled if there are no Fleet Servers enrolled yet. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

add fleet-server version check for ssl secrets

569dd57

juliaElastic self-assigned this Oct 3, 2025

juliaElastic added release_note:skip Skip the PR/issue when compiling release notes backport:version Backport to applied version labels v9.2.0 v9.1.6 labels Oct 3, 2025

kibanamachine and others added 6 commits October 3, 2025 12:18

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

b91735b

…te --fix'

[CI] Auto-commit changed files from 'make api-docs'

5cadfbe

[CI] Auto-commit changed files from 'node scripts/jest_integration -u…

d6c3d23

… src/core/server/integration_tests/ci_checks'

update tests

643fdba

Merge branch 'main' into ssl-secret-storage

91a0d0a

juliaElastic marked this pull request as ready for review October 6, 2025 11:58

juliaElastic requested review from a team as code owners October 6, 2025 11:58

florent-leborgne approved these changes Oct 6, 2025

View reviewed changes

botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Oct 6, 2025

kc13greiner self-requested a review October 6, 2025 21:57

criamico reviewed Oct 7, 2025

View reviewed changes

juliaElastic added 2 commits October 7, 2025 10:01

enable secrets if there are no fleet-servers

7528ba4

separate output and ssl secrets in fleet server host form

e378419

juliaElastic added release_note:fix and removed release_note:skip Skip the PR/issue when compiling release notes labels Oct 7, 2025

juliaElastic added 5 commits October 23, 2025 09:39

Merge branch 'main' into ssl-secret-storage

7c62085

Merge branch 'main' into ssl-secret-storage

4e57cfa

Merge branch 'main' into ssl-secret-storage

635901d

Merge branch 'main' into ssl-secret-storage

7b3ca52

Merge branch 'main' into ssl-secret-storage

232b2a2

juliaElastic mentioned this pull request Oct 31, 2025

Support new SSL secrets fields elastic/fleet-server#4470

Closed

juliaElastic and others added 6 commits November 3, 2025 16:18

Merge branch 'main' into ssl-secret-storage

9775ac6

Merge branch 'main' into ssl-secret-storage

5f4f9d8

Update check_registered_types.test.ts

c7a7652

Changes from node scripts/jest_integration -u src/core/server/integra…

f65bdcb

…tion_tests/ci_checks

Merge branch 'main' into ssl-secret-storage

7aa2fc1

Merge branch 'main' into ssl-secret-storage

1cf47cd

juliaElastic added v9.3.0 and removed v9.2.0 v9.1.6 labels Nov 17, 2025

juliaElastic and others added 10 commits November 17, 2025 14:08

Merge branch 'main' into ssl-secret-storage

b55846e

Merge branch 'main' into ssl-secret-storage

ae6dedf

Changes from node scripts/jest_integration -u src/core/server/integra…

90ff3fb

…tion_tests/ci_checks

add SettingsSchemaV6

7eaf854

add test fixture

cf31fb4

Changes from node scripts/jest_integration -u src/core/server/integra…

02c4eee

…tion_tests/ci_checks

Merge branch 'main' into ssl-secret-storage

4fa6f42

Merge branch 'main' into ssl-secret-storage

3084ac8

Merge branch 'main' into ssl-secret-storage

188e834

Merge branch 'main' into ssl-secret-storage

4112d5d

juliaElastic merged commit 827ae4c into elastic:main Dec 8, 2025
12 checks passed

kibanamachine added backport:skip This PR does not require backporting and removed backport:version Backport to applied version labels labels Dec 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Fleet] add fleet-server version check for SSL secrets#237464

[Fleet] add fleet-server version check for SSL secrets#237464
juliaElastic merged 44 commits intoelastic:mainfrom
juliaElastic:ssl-secret-storage

juliaElastic commented Oct 3, 2025 •

edited

Loading

nchaulet commented Oct 6, 2025

juliaElastic commented Oct 6, 2025

nchaulet commented Oct 6, 2025

florent-leborgne left a comment

elasticmachine commented Oct 6, 2025

kpollich commented Oct 6, 2025

criamico Oct 7, 2025

juliaElastic Oct 7, 2025

juliaElastic Oct 7, 2025 •

edited

Loading

criamico Oct 7, 2025

elasticmachine commented Dec 8, 2025

Uh oh!

Labels

9 participants

Conversation

juliaElastic commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release note

Checklist

Identify risks

nchaulet commented Oct 6, 2025

juliaElastic commented Oct 6, 2025

nchaulet commented Oct 6, 2025

florent-leborgne left a comment

Choose a reason for hiding this comment

elasticmachine commented Oct 6, 2025

kpollich commented Oct 6, 2025

criamico Oct 7, 2025

Choose a reason for hiding this comment

juliaElastic Oct 7, 2025

Choose a reason for hiding this comment

juliaElastic Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

criamico Oct 7, 2025

Choose a reason for hiding this comment

elasticmachine commented Dec 8, 2025

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

History

Uh oh!

Labels

9 participants

juliaElastic commented Oct 3, 2025 •

edited

Loading

juliaElastic Oct 7, 2025 •

edited

Loading