[REQUEST]: Document PGP key download from Fleet Server API in air-gapped envs

lucabelluccini commented 6 months ago

Description

Elastic Agent attempts to download the PGP/GPG key to validate the binaries. We had an unfortunate bug where the PGP/GPG key was downloaded even if it wasn't necessary. The bug was particularly unfortunate for air-gapped environments.

For air-gapped environments we need provide instructions to explain how to use a functionality introduced in 8.10.4 which allow Elastic Agents to download the PGP/GPG key from the Fleet Server. In particular, we need to explain how to customize the server.pgp.upstream_url in Fleet Serve settings in order to benefit from this new feature.

I've not tested using server.pgp.upstream_url and in particular I do not know the behavior when:

The URL is HTTPS and the CA cert is not in the trusted certs of the EA running as Fleet Server (does Fleet Server use the proxy_url of the Source URI? or we're obliged to use the HTTP_PROXY/HTTPS_PROXY/NO_PROXY)?
The URL is HTTP (Fleet Server will download it even if exposed via HTTP)?
Elastic Agent will reuse the same CA cert used to connect to Fleet Server for control plane also to trust the Fleet Server PGP API download endpoint?

Resources

https://support.elastic.dev/knowledge/view/5b5df063 (focus on Option I)

Collaboration

TBD. The docs and product team will work together to determine the best path forward.

Point of contact.

Main contact: @jlind23 / @pierrehilbert to delegate to the engineers who worked on the feature

Stakeholders: @lucabelluccini

lucabelluccini commented 6 months ago

Hello @kilfoyle - it is not urgent, but I think we need to add this for air-gapped envs.

jlind23 commented 6 months ago

@michalpristas / @michel-laterman are the ones who worked on this feature.

kilfoyle commented 6 months ago

For reference: https://github.com/elastic/sdh-beats/issues/4496

elastic / ingest-docs