[Fleet] Fleet action to "uninstall" should remove the Elastic Agent from the host

nimarezainia commented 3 weeks ago

Fleet action to "uninstall" should remove the agent from the host.

[ ] This action should essentially issue an uninstall command at the host itself.
[ ] Agent's installed via DEB/RPM should be excluded.
[ ] The action should have an audit log associated with it.
[ ] Role based access should be the same as the user with access to the uninstall tokens

Once the agent is uninstalled, it will appear offline in the Fleet UI (missed checkin) and then at some interval unenrolled. There's no need to also unenroll the agent from Fleet as part of this uninstall action. Rather rely on this state machine to remove the agent as it will abide by the specific timeouts configured on the owning agent policy.

elasticmachine commented 3 weeks ago

Pinging @elastic/fleet (Team:Fleet)

gabriellandau commented 3 weeks ago

Thanks @nimarezainia. Also, Uninstall needs to be added to bulk actions. It's currently only in the ... menu.

cmacknz commented 3 weeks ago

Another limitation is that unprivileged agents won't be able to uninstall themselves because they aren't root/admin and therefore aren't able to completely remove the agent service.

nicpenning commented 3 weeks ago

👀

elastic / kibana

[Fleet] Fleet action to "uninstall" should remove the Elastic Agent from the host #196621