[Fleet] Allow more registry proxy configuration

[jfsiii]

#78648 added this interface for specifying proxy settings/behavior when connecting to package registry (EPR).

kibana/x-pack/plugins/ingest_manager/server/services/epm/registry/proxy.ts

Lines 14 to 18 in 243e56c

	export interface ProxySettings {
	proxyUrl: string;
	proxyHeaders?: Record<string, string>;
	proxyRejectUnauthorizedCertificates?: boolean;
	}

Note: proxyRejectUnauthorizedCertificates should be changed to required boolean type, so that it defaults to true instead of undefined.

Progress on exposing those values for configuration

Proxy setting	xpack.fleet.*
URL	💚 registryProxyUrl #78648
additional headers	❌ registryProxyHeaders
TLS behavior	❌ registryProxyRejectUnauthorizedCertificates

• Use a proxy URL specified in kibana.yml when making requests to the Registry
• Specify additional headers to be sent
• Override node's default rejectUnauthorized: true behavior

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[horvatal]

As our company has SSL interception in place on the proxy, we really need something to disable the certificate check or a possibility to add our CA to the cert trust chain.

[joshdover]

If you have a specific CA that you need Kibana's backend to trust, you should be able to use the NODE_EXTRA_CA_CERTS environment variable to allow Kibana's runtime to trust your proxy's public certificate authority. Note that this will cause any request made from Kibana's backend to trust this CA and not only requests to the Fleet Package Registry. I imagine that may be acceptable for your use case, @horvatal?

[horvatal]

@joshdover thank you for the hint. I have to check, if there is a possibility to inject such environment vars in ECE, and also the needed CA files.

[joshdover]

@horvatal I believe the runtime will also respect any system-wide installed CAs, though in the context of ECE this would mean any CAs installed into the Kibana docker images.

We have documentation here about how to add custom Kibana plugins to a custom docker image and configure ECE to use your custom image. You should be able to largely follow the same process, except instead of installing a plugin, you'll need to add your CA. Our docker images use CentOS as the base image, so I believe your custom Dockerfile would look something like:

FROM docker.elastic.co/cloud-assets/kibana:7.14.0-0
MAINTAINER Your Name <youremail@example.com>

ADD mycert.pem /etc/pki/ca-trust/source/anchors/mycert.pem
RUN update-ca-trust