elastic / uptime

This project includes resources and general issue tracking for the Elastic Uptime solution
12 stars 3 forks source link

Use Mtls to communicate with synthetics service #436

Closed shahzad31 closed 2 years ago

shahzad31 commented 2 years ago

Synthetics service has implemented dual auth strategy using credentials or Mtls, kibana is using credentials and Basic auth to communicate with synthetics service currently.

We need to read ssl certificates used by kibana to communicate with elasticsearch on cloud within uptime plugin and use those existing certificates to create an HttpAgent , that will be provided to axios client to communicate with Synthetics service.

We need to add a new key in uptime service config

xpack.uptime.unsafe.service.tls:

we will uses existing schema type exposed by @kbn/server-http-tools for this new new tls key

import { sslSchema } from '@kbn/server-http-tools';

Cloud needs to populate this new key and it's attributes while the instances are being created, that's being tracked in a separate ticket in cloud.

Meanwhile for tech preview, we will manually set those keys in the CFT region.

xpack.uptime.unsafe.service.tls.certificate: 
xpack.uptime.unsafe.service.tls.key:
xpack.uptime.unsafe.service.tls.certificateAuthorities: 

Once these keys are read by uptime, they will be passed to axios client via httpsAgent.