Fleet Server install can fail when using relative paths for certificates #27677
Comments
|
Also applies on Windows. :) |
|
I faced the same issue today. Any solutions for this? |
|
@GeetikaGopi the install should succeed if you provide explicit paths for your certificate files. E.g: vs |
|
@GeetikaGopi It's possible you're seeing another issue related to certificates, but you'd need to investigate the various logs (e.g However, we don't use GitHub threads for troubleshooting. Could you please head over to our forums (https://discuss.elastic.co/) and share details about the install? |
|
@GeetikaGopi The first thing I notice is the first line in your log message, showing that Fleet is generating a self-signed cert. In my testing that means you're missing one of the required flags, but I don't see what you entered on the command line so I cant tell which |
|
This is actually not a Fleet Server issue, but an Elastic Agent one. Elastic Agent is the one that performs the installation and it should handle the relative paths correctly. Being that relative paths are used and that the Elastic Agent is copied into a system level directory at install time. What would you expect the Elastic Agent to do at this point? Should it copy the certificates into that directory? Should it just convert the relative paths into absolute paths and use those? Seems we need to come up with a preferred solution to the problem. Also I am going to transfer this to the beats repository as its on Elastic Agent to get this information correct. |
botelastic
bot
added
the
needs_team
botelastic
bot
removed
the
needs_team
|
Pinging @elastic/agent (Team:Agent) |
When you install just the agent, the install process copies the file from the relative path to the install directory. For example, if installing just an agent with something like |
|
Welp, @n0othing, I'm going to email you, cause it looks like the comment I just made is the cause of the issue we're working on. |
|
@scottdfedorov The files are not copied as of today. That is something we need to solve to fix this issue. We just need to come to a conclusion on how we want to solve it. I like the idea of copying all certificates files (if absolute path is not given) to the installation directory of Elastic Agent. Probably into |
|
The files are actually copied. In the screenshot below, the three selected files are all files that were added to the install directory when the agent was installed. I did not put them there, they were copied.
|
|
@scottdfedorov They are copied because the whole extracted directory is placed into the Lets say you used a relative path of |
|
It might be surprising for some users that certs are copied around. How will a user update the cert later on? I have the suspicion the user would update the original location. To keep the certificates where they were placed initially, could Elastic Agent convert the relative paths somehow and from there on only work with absolute paths? A more radical option would be to not support relative paths and show an error. This at least would for now remove the confusion / problems around it. |
|
@ruflin Yeah I was worried that the coping the files might be surprising. I think showing an error if a relative path is provided is the best solution and we should force absolute paths. That would make it consistent and easier to understand (no weird copy logic). |
7.14.0Attempting to install Fleet Server using relative certificate file paths results in the install failing, with no clear logging as to why:
The
/Library/Elastic/Agentdirectory gets removed after this failure so we're unable to review the logs to see what might have gone wrong.By adding an
--enrollment-tokento the install command, the install still fails, but the agent stays up allowing us to investigate the log directory:sudo ./elastic-agent install --url=https://127.0.0.1:8220 \ -f \ --fleet-server-es=https://127.0.0.1:9200 \ --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2MjkyMjE2MjU1NzU6UG81UVp6MFFTVTZFa1JtYk4tbWYxUQ \ --fleet-server-policy=2ab0ceb0-ff7c-11eb-8a64-5f3c299c93d0 \ --certificate-authorities=certs/ca.crt \ --fleet-server-es-ca=certs/ca.crt \ --fleet-server-cert=certs/fleet-server.crt \ --fleet-server-cert-key=certs/fleet-server.key \ + --enrollment-token=c1lrTFZYc0I3LUR3eWpNdnVfV0o6ay1yNDdKWjNTRTZKbi1sZkw3VF9Rdw=={"log.level":"info","service.name":"fleet-server","version":"7.14.0","commit":"82d6804","pid":17409,"ppid":17403,"exe":"/Library/Elastic/Agent/data/elastic-agent-e127fc/install/fleet-server-7.14.0-darwin-x86_64/fleet-server","args":["--agent-mode","-E","logging.level=info","-E","http.enabled=true","-E","http.host=unix:///Library/Elastic/Agent/data/tmp/default/fleet-server/fleet-server.sock","-E","logging.json=true","-E","logging.ecs=true","-E","logging.files.path=/Library/Elastic/Agent/data/elastic-agent-e127fc/logs/default","-E","logging.files.name=fleet-server-json.log","-E","logging.files.keepfiles=7","-E","logging.files.permission=0640","-E","logging.files.interval=1h","-E","path.data=/Library/Elastic/Agent/data/elastic-agent-e127fc/run/default/fleet-server--7.14.0"],"@timestamp":"2021-08-25T18:08:27.659Z","message":"boot"} {"log.level":"info","service.name":"fleet-server","@timestamp":"2021-08-25T18:08:27.661Z","message":"starting communication connection back to Elastic Agent"} {"log.level":"info","service.name":"fleet-server","@timestamp":"2021-08-25T18:08:27.661Z","message":"waiting for Elastic Agent to send initial configuration"} {"log.level":"error","service.name":"fleet-server","error.message":"1 error: open certs/ca.crt: no such file or directory reading <nil> accessing 'output.elasticsearch'","@timestamp":"2021-08-25T18:08:28.245Z","message":"Exiting"}The text was updated successfully, but these errors were encountered: