elastic / elastic/fleet-server

[Helm] Support deploying a Fleet Server Elastic Agent

Open
#4,233 14 comments 1 reaction 1 assignee Claimed by @swiatekm View on GitHub
enhancement Team:Elastic-Agent-Control-Plane
Dominant language
Go
Stars
113
Forks
117
Avg merge
1d 16h
Merged PRs (30d)
112

Description

We should support the installation of a Fleet Server on Kubernetes with the helm chart.
Deploying a Fleet Server agent is slightly different than deploying a normal Fleet Managed Elastic Agent.

It requires:
- `FLEET_SERVER_ENABLE` set to true.
- A policy ID of the policy prepared in Kibana including Fleet Server integration, for `FLEET_SERVER_POLICY_ID` env var.
- A Service Token (and not an enrollment token), for `FLEET_SERVER_SERVICE_TOKEN`
- Elasticsearch URL, for `FLEET_SERVER_ELASTICSEARCH_HOST `
- The CA certificate of Elasticsearch, as a file pointed by `ELASTICSEARCH_CA` environment variable, or the **SHA fingerprint of the CA** through `FLEET_SERVER_ELASTICSEARCH_CA_TRUSTED_FINGERPRINT` env var (both options are in theory possible).
- A certificate and key for the HTTP endpoint (if not provided the Fleet Server generates a self-signed cert, which is called `quick start mode` in the documentation, but we should clearly support providing the cert and key as it's the requirement for production).

^^ From the previous items we don't expect the helm chart to take care of everything, probably the Policy ID and Service Token should be prepared in advance by the user and provided through `values.yaml`. Same for the Elasticsearch URL and the CA cert of Elasticsearch.

This type of Agent would NOT require any interaction with Kubernetes API, so I would suggest to NOT add any RBAC resources (probably neither a serviceAccount) --> `automountServiceAccountToken: false` should be the way to go here.

We have recently added a doc about installing Fleet Server on Kubernetes (without the chart of course :) ) that could be used as a reference of the needed resources (a Deployment + 2 secrets would be enough).

About the certificate + key we need to decide how to implement it, as there are multiple options:
- Request the user to provide the cert + key for the fleet server in a separate secret (this is probably the easiest).
- Offer some kind of automation or integration with something like cert manager.

Note that the previous item about cert + key will also appear as soon as we implement the support of mutual TLS authentication for the normal Elastic Agents.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.