Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[docs] Add note on how to access generated Kibana encryptionKeys #8150

Merged
merged 13 commits into from
Oct 28, 2024

Conversation

kilfoyle
Copy link
Contributor

@kilfoyle kilfoyle commented Oct 22, 2024

This updates the Advanced configuration page with a tip about how to access the operator-generated encryption keys.

Closes: #8129


Screenshot 2024-10-24 at 9 44 53 AM

@kilfoyle kilfoyle added the >docs Documentation label Oct 22, 2024
@kilfoyle kilfoyle requested review from pebrc and stefnestor October 22, 2024 15:58
Copy link
Contributor

@stefnestor stefnestor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kilfoyle
Copy link
Contributor Author

@elasticmachine run docs-build

@stefnestor
Copy link
Contributor

I realized after testing that the ECK operator does not automatically set the decryptionKey for users, so added in addendums so if users are looking manually set these values but have previously used Kibana that they need to set the decryptionKey manually before rotating it.

@kilfoyle
Copy link
Contributor Author

Thanks @pebrc!

@kilfoyle kilfoyle requested a review from pebrc October 24, 2024 20:11
@kilfoyle kilfoyle requested a review from thbkrkr October 28, 2024 13:18

[source,shell,subs="attributes"]
----
kubectl get secret my-kibana-kb-config -o jsonpath '{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey
Copy link
Contributor

@thbkrkr thbkrkr Oct 28, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This command fails with error: template format specified but no template given. An = is important to assign the jsonpath.

Suggested change
kubectl get secret my-kibana-kb-config -o jsonpath '{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey
kubectl get secret my-kibana-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey

Now it works, I feel that it can be confusing because there are several encryptionKey.

> kubectl get secret test-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey
    encryptedSavedObjects:
        encryptionKey: K8MYAwOohLrviRp4tXlQqS7Gb7AWPe6DsRI9TUs0PoyHAdmpKDjupE8Q3ms4lwmQ
--
    reporting:
        encryptionKey: EcZHDgOz5BJqLdp26t6ittWg3tCJHkCIraciRUqDU2NncYbpO5DNJ4pt1Ayb5VEV
--
                        realm: oidc1
        encryptionKey: PIhbYdOg76JfzhnhzNpTz2JOasEj7oh1hpmZ47ZMEeTRR7Un1akRHVmA0pnDEBsw

I guess you don't want to provide an example using yq?

Then here is a proposal to continue using grep:

> kubectl get secret c14-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -A1 encryptedSavedObjects
    encryptedSavedObjects:
        encryptionKey: K8MYAwOohLrviRp4tXlQqS7Gb7AWPe6DsRI9TUs0PoyHAdmpKDjupE8Q3ms4lwmQ

Copy link
Contributor Author

@kilfoyle kilfoyle Oct 28, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @thbkrkr!
@stefnestor Please let me know if you like the proposal.

(I've added it in already but if you disagree, please let us know)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@thbkrkr I see that Stef will be offline for a couple of days, so I think it's safe to merge this. If she'd like anything changed I can open a new PR.

@thbkrkr thbkrkr changed the title [Docs] Add note on how to access generated encryptionKeys [docs] Add note on how to access generated Kibana encryptionKeys Oct 28, 2024
@thbkrkr thbkrkr merged commit 645f750 into elastic:main Oct 28, 2024
5 checks passed
thbkrkr pushed a commit that referenced this pull request Oct 28, 2024
This updates the Advanced configuration page with a tip about how to access
the operator-generated encryption keys.

---------
Co-authored-by: Stef Nestor <[email protected]>
Co-authored-by: Peter Brachwitz <[email protected]>
Co-authored-by: Thibault Richard <[email protected]>
thbkrkr added a commit that referenced this pull request Oct 28, 2024
…) (#8160)

This updates the Advanced configuration page with a tip about how to access
the operator-generated encryption keys.

---------
Co-authored-by: Stef Nestor <[email protected]>
Co-authored-by: Peter Brachwitz <[email protected]>
Co-authored-by: Thibault Richard <[email protected]>

Co-authored-by: David Kilfoyle <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

(Doc) How-to access operator generated Kibana encryptionKey
4 participants