[Fleet] Add SSL options to fleet server hosts settings #208091

criamico · 2025-01-23T16:08:46Z

Fixes #207322

Summary

Show SSL options for fleet server host in Fleet server settings section and in add fleet server host flyout

Registered fleet server host as a encrypted save object and the new mappings added under ssl property, mirroring what's already existing for logstash and kafka outputs
The new options are displayed in the UI, both when adding a new fleet server host from the flyout and when editing an existing one.
The values are then added to the full agent policy
The values for ssh.key and ssh.es_key can additionally be saved as secrets but for now this option is not enabled until fleet server supports it - I used the feature flag enableSSLSecrets

Screenshots

Generated policy:

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

criamico · 2025-01-23T16:09:03Z

@elasticmachine merge upstream

criamico · 2025-01-27T09:20:14Z

@elasticmachine merge upstream

…apping'

…te --fix'

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

… src/core/server/integration_tests/ci_checks'

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

azasypkin · 2025-02-26T14:04:45Z

x-pack/platform/plugins/shared/fleet/server/saved_objects/index.ts

+          changes: [
+            {
+              type: 'mappings_addition',
+              addedMappings: {},


question: what does empty addedMappings mean?

This "empty migration" is needed as I'm using dynamic: false here. This way new mappings can be added without explicitly declaring them.

Ah, I see, thanks for clarifying!

azasypkin · 2025-02-26T14:09:23Z

x-pack/platform/plugins/shared/fleet/server/saved_objects/index.ts

+  encryptedSavedObjects.registerType({
+    type: FLEET_SERVER_HOST_SAVED_OBJECT_TYPE,
+    attributesToEncrypt: FLEET_SERVER_HOST_ENCRYPTED_FIELDS,
+    enforceRandomId: false,


question: does it mean you're making the ssl property, which was previously unencrypted, encrypted? Or am I missing something? If so, what about existing objects where ssl property is stored in non-encrypted form? How would that work right now?

The reason why I explicitly added this line is that our POST endpoint supports the creation of an explicit id by the user and having an UUID instead would be a major breaking change.

It'd be great if you could leave a comment in the code explaining this to help future readers.

azasypkin · 2025-02-26T14:13:22Z

x-pack/platform/plugins/shared/fleet/server/saved_objects/index.ts

@@ -1258,6 +1267,10 @@ export const OUTPUT_ENCRYPTED_FIELDS = new Set([
  { key: 'password', dangerouslyExposeValue: true },
 ]);

+export const FLEET_SERVER_HOST_ENCRYPTED_FIELDS = new Set([
+  { key: 'ssl', dangerouslyExposeValue: true },


question: Why do we need dangerouslyExposeValue: true? Do we have to expose this value to our users in unencrypted form? If so, is it a requirement?

If we decide to keep this property, it'd be helpful to include a code comment with justification.

Well I'am showing the content of the ssl property in the UI to allow the user to see/edit it. This was a request by product. I can add a comment to explain it for sure.

How do you retrieve this object? If you have a dedicated endpoint, wouldn't it be possible to use getDecryptedAsInternalUser internally to retrieve it (https://docs.elastic.dev/kibana-dev-docs/api/encryptedSavedObjects#if1e0a8f1-f453-11ef-ad72-4922219b4f76)?

What I'm trying to say is that dangerouslyExposeValue: true should be a last-resort solution for cases where you need to retrieve encrypted saved objects using standard SO APIs and are willing to accept the risk of these secrets being leaked accidentally, since ESO will never strip them down.

to allow the user to see/edit it

I see, thanks. That's interesting - usually, existing secrets are never revealed once entered or saved to reduce the risk of leakage (e.g., you typically can't see an API key or password after saving it, since there's no need to view the existing value if you're going to change it). But I guess I'm just missing context and if you have such a product requirement, then I guess that's fine.

I looked at the use ofgetDecryptedAsInternalUser but at the moment it's not really feasible as it would mean rewriting the service in a totally different way.

I know that this solution is not ideal, but it's a temporary one and in fact this PR is also adding secrets.ssl field that has the same capability and can store those values in a secure way by using secrets. The plan is to remove the use of the encrypted SO field once that's enabled. The only reason why is not already available is that we still need to add the secret reading capabilities to fleet server, but it is absolutely a temporary solution.
cc @kpollich

Great, thanks for looking into this and clarifying it for me. Having this as a temporary solution sounds reasonable to me.

criamico · 2025-02-27T16:08:56Z

@elasticmachine merge upstream

criamico · 2025-02-28T12:18:34Z

@elasticmachine merge upstream

azasypkin

LGTM from the AppEx Security side - temporarily using dangerouslyExposeValue: true for a new field sounds tolerable.

criamico · 2025-02-28T16:13:50Z

@elasticmachine merge upstream

criamico · 2025-03-03T09:54:29Z

@elasticmachine merge upstream

elasticmachine · 2025-03-03T11:45:38Z

💚 Build Succeeded

Buildkite Build
Commit: 4850923

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`fleet`	1200	1201	+1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`fleet`	1331	1332	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	1.7MB	1.7MB	+11.9KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`fleet`	85	86	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	156.8KB	156.9KB	+103.0B

Unknown metric groups

API count

id	before	after	diff
`fleet`	1458	1459	+1

History

💔 Build #280026 failed 9d12386
💔 Build #279945 failed 1c66d23
💔 Build #279761 failed 3435c9e
💔 Build #279747 failed 2f0cfc4
💚 Build #279495 succeeded 9d29a15

cc @criamico

kibanamachine · 2025-03-03T12:23:18Z

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13630799063

kibanamachine · 2025-03-03T12:29:20Z

💔 All backports failed

Status	Branch	Result
❌	8.18	Backport failed because of merge conflicts
❌	8.x	Backport failed because of merge conflicts
❌	9.0	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 208091

Questions ?

Please refer to the Backport tool documentation

…212918) ## Summary Small follow up of #208091 The editor autocompletion added an incorrect import and so I'm removing it, plus a few comments that should have been removed. Co-authored-by: Elastic Machine <[email protected]>

criamico added 4 commits January 22, 2025 11:15

[Fleet] Add SSL options to fleet server hosts settings

853a544

Use EuiFieldText instead of textInput and fix preconfiguration

056188f

Add ssl fields to add fleet server flyout

2f417ca

Merge branch 'main' into 207322_fleetserver_ssl_options

4766db1

elasticmachine and others added 2 commits January 23, 2025 16:09

Merge branch 'main' into 207322_fleetserver_ssl_options

9e31a3b

Replace SSL placeholders in command box

54c0f2f

Merge branch 'main' into 207322_fleetserver_ssl_options

61a39a6

criamico self-assigned this Jan 27, 2025

criamico added v9.0.0 Team:Fleet Team label for Observability Data Collection Fleet team release_note:feature Makes this part of the condensed release notes labels Jan 27, 2025

kibanamachine added 3 commits January 27, 2025 09:38

[CI] Auto-commit changed files from 'node scripts/styled_components_m…

da0e6b4

…apping'

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

6c1624c

…te --fix'

criamico changed the title ~~207322 fleetserver ssl options~~ [Fleet] Add SSL options to fleet server hosts settings Jan 27, 2025

kibanamachine and others added 6 commits January 27, 2025 12:32

[CI] Auto-commit changed files from 'make api-docs'

1af9752

[CI] Auto-commit changed files from 'node scripts/jest_integration -u…

42f49d1

… src/core/server/integration_tests/ci_checks'

fix tests

af98bdd

fix put schema

7d983e9

criamico added backport:prev-minor Backport to (9.0) the previous minor version (i.e. one version back from main) v8.18.0 labels Jan 27, 2025

criamico marked this pull request as ready for review January 27, 2025 16:40

criamico requested review from a team as code owners January 27, 2025 16:40

kibanamachine added 2 commits February 26, 2025 10:03

[CI] Auto-commit changed files from 'make api-docs'

b1ef918

azasypkin reviewed Feb 26, 2025

View reviewed changes

criamico added 2 commits February 26, 2025 17:35

Add comments per code review

9d29a15

use encrypted client

2f0cfc4

elasticmachine and others added 2 commits February 27, 2025 16:08

Merge branch 'main' into 207322_fleetserver_ssl_options

3435c9e

fix tests

a5b3f31

Merge branch 'main' into 207322_fleetserver_ssl_options

1c66d23

azasypkin approved these changes Feb 28, 2025

View reviewed changes

Fix other tests

1641adf

elasticmachine and others added 2 commits February 28, 2025 16:13

Merge branch 'main' into 207322_fleetserver_ssl_options

9d12386

fix tests

99c19b5

Merge branch 'main' into 207322_fleetserver_ssl_options

4850923

criamico merged commit 151fa26 into elastic:main Mar 3, 2025
9 checks passed

kibanamachine added the v9.1.0 label Mar 3, 2025

criamico deleted the 207322_fleetserver_ssl_options branch March 3, 2025 12:23

criamico removed v9.0.0 backport:prev-minor Backport to (9.0) the previous minor version (i.e. one version back from main) v8.18.0 labels Mar 3, 2025

kibanamachine added backport:skip This commit does not require backporting labels Mar 3, 2025

criamico mentioned this pull request Mar 3, 2025

[Fleet] Remove wrong incorrect import from fleet server host service #212918

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Fleet] Add SSL options to fleet server hosts settings #208091

[Fleet] Add SSL options to fleet server hosts settings #208091

criamico commented Jan 23, 2025 •

edited by kibanamachine

Loading

criamico commented Jan 23, 2025

criamico commented Jan 27, 2025

azasypkin Feb 26, 2025

criamico Feb 26, 2025

azasypkin Feb 27, 2025

azasypkin Feb 26, 2025

azasypkin Feb 26, 2025

criamico Feb 26, 2025

azasypkin Feb 26, 2025 •

edited

Loading

criamico Feb 27, 2025

azasypkin Feb 28, 2025

criamico commented Feb 27, 2025

criamico commented Feb 28, 2025

azasypkin left a comment

criamico commented Feb 28, 2025

criamico commented Mar 3, 2025

elasticmachine commented Mar 3, 2025

API count

kibanamachine commented Mar 3, 2025

kibanamachine commented Mar 3, 2025

[Fleet] Add SSL options to fleet server hosts settings #208091

[Fleet] Add SSL options to fleet server hosts settings #208091

Conversation

criamico commented Jan 23, 2025 • edited by kibanamachine Loading

Summary

Checklist

criamico commented Jan 23, 2025

criamico commented Jan 27, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azasypkin Feb 26, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

criamico commented Feb 27, 2025

criamico commented Feb 28, 2025

azasypkin left a comment

Choose a reason for hiding this comment

criamico commented Feb 28, 2025

criamico commented Mar 3, 2025

elasticmachine commented Mar 3, 2025

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

History

kibanamachine commented Mar 3, 2025

kibanamachine commented Mar 3, 2025

💔 All backports failed

Manual backport

Questions ?

criamico commented Jan 23, 2025 •

edited by kibanamachine

Loading

azasypkin Feb 26, 2025 •

edited

Loading