-
Notifications
You must be signed in to change notification settings - Fork 716
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[docs] Add note on how to access generated Kibana encryptionKeys #8150
Conversation
Co-authored-by: Stef Nestor <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@elasticmachine run docs-build |
I realized after testing that the ECK operator does not automatically set the decryptionKey for users, so added in addendums so if users are looking manually set these values but have previously used Kibana that they need to set the decryptionKey manually before rotating it. |
Co-authored-by: Stef Nestor <[email protected]>
Co-authored-by: Stef Nestor <[email protected]>
Co-authored-by: Stef Nestor <[email protected]>
Co-authored-by: Peter Brachwitz <[email protected]>
Co-authored-by: Peter Brachwitz <[email protected]>
Co-authored-by: Peter Brachwitz <[email protected]>
Thanks @pebrc! |
Co-authored-by: Thibault Richard <[email protected]>
|
||
[source,shell,subs="attributes"] | ||
---- | ||
kubectl get secret my-kibana-kb-config -o jsonpath '{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This command fails with error: template format specified but no template given
. An =
is important to assign the jsonpath.
kubectl get secret my-kibana-kb-config -o jsonpath '{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey | |
kubectl get secret my-kibana-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey |
Now it works, I feel that it can be confusing because there are several encryptionKey
.
> kubectl get secret test-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey
encryptedSavedObjects:
encryptionKey: K8MYAwOohLrviRp4tXlQqS7Gb7AWPe6DsRI9TUs0PoyHAdmpKDjupE8Q3ms4lwmQ
--
reporting:
encryptionKey: EcZHDgOz5BJqLdp26t6ittWg3tCJHkCIraciRUqDU2NncYbpO5DNJ4pt1Ayb5VEV
--
realm: oidc1
encryptionKey: PIhbYdOg76JfzhnhzNpTz2JOasEj7oh1hpmZ47ZMEeTRR7Un1akRHVmA0pnDEBsw
I guess you don't want to provide an example using yq
?
Then here is a proposal to continue using grep
:
> kubectl get secret c14-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -A1 encryptedSavedObjects
encryptedSavedObjects:
encryptionKey: K8MYAwOohLrviRp4tXlQqS7Gb7AWPe6DsRI9TUs0PoyHAdmpKDjupE8Q3ms4lwmQ
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @thbkrkr!
@stefnestor Please let me know if you like the proposal.
(I've added it in already but if you disagree, please let us know)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@thbkrkr I see that Stef will be offline for a couple of days, so I think it's safe to merge this. If she'd like anything changed I can open a new PR.
Co-authored-by: Peter Brachwitz <[email protected]>
This updates the Advanced configuration page with a tip about how to access the operator-generated encryption keys. --------- Co-authored-by: Stef Nestor <[email protected]> Co-authored-by: Peter Brachwitz <[email protected]> Co-authored-by: Thibault Richard <[email protected]>
…) (#8160) This updates the Advanced configuration page with a tip about how to access the operator-generated encryption keys. --------- Co-authored-by: Stef Nestor <[email protected]> Co-authored-by: Peter Brachwitz <[email protected]> Co-authored-by: Thibault Richard <[email protected]> Co-authored-by: David Kilfoyle <[email protected]>
This updates the Advanced configuration page with a tip about how to access the operator-generated encryption keys.
Closes: #8129