elastic / elastic-agent

Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host.
Other
113 stars 126 forks source link

Actionable error message when attempting to `inspect` an unprivileged Agent as a privileged user #4888

Open kaanyalti opened 4 weeks ago

kaanyalti commented 4 weeks ago

Version: 8.14.0 Operating System: macos sonoma v14.5 Platform: arm64

While working on this issue comparing root and unprivileged elastic agents, I encountered an error with the inspect command when using unprivileged agent.

Steps to Reproduce:

  1. Deploy ESS v8.14.0
  2. Create agent policy with system integration
  3. Install fleet managed agent with the unprivileged flag sudo ./elastic-agent install --unprivileged --url=<fleet url> --enrollment-token=<token>
  4. Run sudo elastic-agent inspect. You should see an error similar to what's shown below
    Error: error loading agent config: error loading raw config: fail to read configuration /Library/Elastic/Agent/fleet.enc for the elastic-agent: fail to decode bytes: cipher: message authentication failed
    For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.14/fleet-troubleshooting.html

Definition of Done

Based on discussion in https://github.com/elastic/elastic-agent/issues/4889 comments:

kaanyalti commented 4 weeks ago

cc: @ycombinator @cmacknz

blakerouse commented 3 weeks ago

Again do not use sudo the Elastic Agent is not root.

ycombinator commented 3 weeks ago

I updated the title of this issue and added a Definition of Done to make this issue about improving the error message, based on a related discussion in https://github.com/elastic/elastic-agent/issues/4889. As for documentation, I've brought that to @kilfoyle's attention via https://github.com/elastic/ingest-docs/pull/1087#issuecomment-2159456944.

elasticmachine commented 3 weeks ago

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)