Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kibana misconfiguration can cause Fleet errors. #7543

Open
naemono opened this issue Feb 8, 2024 · 0 comments
Open

Kibana misconfiguration can cause Fleet errors. #7543

naemono opened this issue Feb 8, 2024 · 0 comments
Labels
>bug Something isn't working discuss We need to figure this out v2.12.0

Comments

@naemono
Copy link
Contributor

naemono commented Feb 8, 2024

There appear to be Kibana settings that can cause the operator to fail to check Kibana's Fleet api which in turn causes errors which causes reconciliation delays or reconciliation failures for Elastic Agent Fleet.:

example

apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
spec:
  config:
    xpack.security.authc.providers:
      saml.saml1:
        order: 0
        realm: saml1

potentially related:

apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
spec:
  config:
    xpack.security.authc.http.schemes:
    - apikey
    - bearer
    - basic

The relevant error from the logs:

Reconciliation error: failed to request https://kibana-kb-http.namespace.svc:5601/api/fleet/setup, status is 401)

This seems to disable basic authentication provider, which ECK uses to query the Kibana api.

Potential changes to discuss:

  1. Maybe use another provider such as bearer/apikey, but what's stopping that from being disabled as well?
  2. Add validation which prevents Kibana from being configured in this manner.
@naemono naemono added >bug Something isn't working discuss We need to figure this out v2.12.0 labels Feb 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>bug Something isn't working discuss We need to figure this out v2.12.0
Projects
None yet
Development

No branches or pull requests

1 participant