-
Notifications
You must be signed in to change notification settings - Fork 717
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[docs] Add note on how to access generated Kibana encryptionKeys #8150
Conversation
Co-authored-by: Stef Nestor <26751266+stefnestor@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@elasticmachine run docs-build |
I realized after testing that the ECK operator does not automatically set the decryptionKey for users, so added in addendums so if users are looking manually set these values but have previously used Kibana that they need to set the decryptionKey manually before rotating it. |
Co-authored-by: Stef Nestor <26751266+stefnestor@users.noreply.github.com>
Co-authored-by: Stef Nestor <26751266+stefnestor@users.noreply.github.com>
Co-authored-by: Stef Nestor <26751266+stefnestor@users.noreply.github.com>
Co-authored-by: Peter Brachwitz <peter.brachwitz@gmail.com>
Co-authored-by: Peter Brachwitz <peter.brachwitz@gmail.com>
Co-authored-by: Peter Brachwitz <peter.brachwitz@gmail.com>
Thanks @pebrc! |
Co-authored-by: Thibault Richard <thbkrkr@users.noreply.github.com>
|
||
[source,shell,subs="attributes"] | ||
---- | ||
kubectl get secret my-kibana-kb-config -o jsonpath '{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This command fails with error: template format specified but no template given
. An =
is important to assign the jsonpath.
kubectl get secret my-kibana-kb-config -o jsonpath '{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey | |
kubectl get secret my-kibana-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey |
Now it works, I feel that it can be confusing because there are several encryptionKey
.
> kubectl get secret test-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -B 1 encryptionKey
encryptedSavedObjects:
encryptionKey: K8MYAwOohLrviRp4tXlQqS7Gb7AWPe6DsRI9TUs0PoyHAdmpKDjupE8Q3ms4lwmQ
--
reporting:
encryptionKey: EcZHDgOz5BJqLdp26t6ittWg3tCJHkCIraciRUqDU2NncYbpO5DNJ4pt1Ayb5VEV
--
realm: oidc1
encryptionKey: PIhbYdOg76JfzhnhzNpTz2JOasEj7oh1hpmZ47ZMEeTRR7Un1akRHVmA0pnDEBsw
I guess you don't want to provide an example using yq
?
Then here is a proposal to continue using grep
:
> kubectl get secret c14-kb-config -o jsonpath='{ .data.kibana\.yml }' | base64 --decode | grep -A1 encryptedSavedObjects
encryptedSavedObjects:
encryptionKey: K8MYAwOohLrviRp4tXlQqS7Gb7AWPe6DsRI9TUs0PoyHAdmpKDjupE8Q3ms4lwmQ
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @thbkrkr!
@stefnestor Please let me know if you like the proposal.
(I've added it in already but if you disagree, please let us know)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@thbkrkr I see that Stef will be offline for a couple of days, so I think it's safe to merge this. If she'd like anything changed I can open a new PR.
Co-authored-by: Peter Brachwitz <peter.brachwitz@gmail.com>
This updates the Advanced configuration page with a tip about how to access the operator-generated encryption keys. --------- Co-authored-by: Stef Nestor <26751266+stefnestor@users.noreply.github.com> Co-authored-by: Peter Brachwitz <peter.brachwitz@gmail.com> Co-authored-by: Thibault Richard <thbkrkr@users.noreply.github.com>
…) (#8160) This updates the Advanced configuration page with a tip about how to access the operator-generated encryption keys. --------- Co-authored-by: Stef Nestor <26751266+stefnestor@users.noreply.github.com> Co-authored-by: Peter Brachwitz <peter.brachwitz@gmail.com> Co-authored-by: Thibault Richard <thbkrkr@users.noreply.github.com> Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com>
This updates the Advanced configuration page with a tip about how to access the operator-generated encryption keys.
Closes: #8129