search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.7k stars 8.24k forks source link

[Fleet] Users should be able to switch Agents from privileged to unprivileged mode #184516

Open ycombinator opened 6 months ago

ycombinator commented 6 months ago

Describe the feature:

Elastic Agents have the ability to run in either privileged mode, i.e. with a privileged user like root on Linux systems, or unprivileged mode, i.e. with an unprivileged user.

Moreover, Agents running in privileged mode have the ability to switch themselves to unprivileged mode. This ability is being exposed via the Agent CLI. We now wish to expose this same ability using the Fleet UI.

⚠️ Important note: users should only be switch Agents from privileged to unprivileged mode, not the other way around, using the Fleet UI.

Describe a specific use case for the feature:

Security: Allowing users to reduce the privileges required to run Elastic Agent.

Depends on https://github.com/elastic/elastic-agent/issues/4973

elasticmachine commented 6 months ago

Pinging @elastic/fleet (Team:Fleet)

amitkanfer commented 5 months ago

why is this blocked?

kpollich commented 5 months ago

I think this should be unblocked now as https://github.com/elastic/elastic-agent/pull/4621 has landed, correct? @ycombinator is there more work to do with exposing the mode-toggling via actions?

ycombinator commented 5 months ago

I think this should be unblocked now as elastic/elastic-agent#4621 has landed, correct? @ycombinator is there more work to do with exposing the mode-toggling via actions?

Chatted with @blakerouse about this. We will indeed need to first define a new action for switching privileged Agents to unprivileged and implement the necessary changes "bottom up" from Agent to Fleet UI. I can also see a couple of small non-happy-path cases we'd want to think about. To that end, I've created https://github.com/elastic/elastic-agent/issues/4973 to capture the requirements and have suggested in that issue that we do some tech definition first.

So this issue here should remain blocked for now, on https://github.com/elastic/elastic-agent/issues/4973.