compose: Use service tokens for fleet-server

docker-compose.yml

@@ -7,6 +7,7 @@ services:
     depends_on:
       elasticsearch: { condition: service_healthy }
       kibana: { condition: service_healthy }
+      fleet-server: { condition: service_healthy }
 
   elasticsearch:
     image: docker.elastic.co/elasticsearch/elasticsearch:8.1.0-dbc834fd-SNAPSHOT
@@ -63,6 +64,7 @@ services:
 
   fleet-server:
     image: docker.elastic.co/beats/elastic-agent:8.1.0-dbc834fd-SNAPSHOT
+    entrypoint: /entrypoint.sh
     ports:
       - 8220:8220
     healthcheck:
@@ -72,8 +74,6 @@ services:
     environment:
       FLEET_SERVER_ENABLE: "1"
       FLEET_SERVER_ELASTICSEARCH_HOST: http://elasticsearch:9200
-      FLEET_SERVER_ELASTICSEARCH_USERNAME: "${ES_SUPERUSER_USER:-admin}"
-      FLEET_SERVER_ELASTICSEARCH_PASSWORD: "${ES_SUPERUSER_PASS:-changeme}"
       FLEET_SERVER_CERT: /etc/pki/tls/certs/fleet-server.pem
       FLEET_SERVER_CERT_KEY: /etc/pki/tls/private/fleet-server-key.pem
       FLEET_URL: https://fleet-server:8220
@@ -85,6 +85,7 @@ services:
       elasticsearch: { condition: service_healthy }
       kibana: { condition: service_healthy }
     volumes:
+      - "./testing/docker/fleet-server/docker-entrypoint.sh:/entrypoint.sh"
       - "./testing/docker/fleet-server/certificate.pem:/etc/pki/tls/certs/fleet-server.pem"
       - "./testing/docker/fleet-server/key.pem:/etc/pki/tls/private/fleet-server-key.pem"
 

testing/docker/fleet-server/docker-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+SERVICE_TOKEN_FILE=service_token
+
+if [[ ! -f ${SERVICE_TOKEN_FILE} ]]; then
+    jsonBody="$(curl -u${KIBANA_USERNAME}:${KIBANA_PASSWORD} -fsSL -XPOST \
+        "${FLEET_SERVER_ELASTICSEARCH_HOST}/_security/service/elastic/fleet-server/credential/token/compose")"
+    # use grep and sed to get the service token value as we may not have jq or a similar tool on the instance
+    token=$(echo ${jsonBody} |  grep -Eo '"value"[^}]*' | grep -Eo ':.*' | sed -r "s/://" | sed -r 's/"//g')
+
+    echo ${token} > ${SERVICE_TOKEN_FILE}
+fi
+
+export FLEET_SERVER_SERVICE_TOKEN=$(cat ${SERVICE_TOKEN_FILE})
+
+/usr/bin/tini -s -- /usr/local/bin/docker-entrypoint