[Fleet] Add instructions and generation of a service token for Fleet Server onboarding by jen-huang · Pull Request #97585 · elastic/kibana

jen-huang · 2021-04-20T05:18:43Z

Summary

Relates to #96295. This PR adds a routes for generating (and regenerating, via sending delete + re-create requests to ES) a service token for Fleet Server. The name of this token is default-fleet-server-token. Since we don't have designs yet, I also took a stab try at a fully-fledged set of instructions for on prem Fleet Server onboarding that includes the service token step. Copy edits are much appreciated.

Remaining tasks:

Add tests
Update OpenAPI spec

Screenshots

What the user sees initially on empty state. They will also see this if they leave the page without finishing enrolling a Fleet server. In the latter case, Generate token will regenerate the default-fleet-server-token:

After they click Generate token, we display the token and install commands, the user can choose from Linux / macOS, Windows, or RPM / DEB for the platform. I took the commands from my own testing, our existing agent enrollment UI, and docs, please let me know if anything needs to be adjusted. The token and ES URL are dynamic:

Linux / macOS:

sudo ./elastic-agent install -f --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL2RlZmF1bHQtZmxlZXQtc2VydmVyLXRva2VuOnlXN0tGYXVmVGFDNkczeExEUmpqOWc --fleet-server-es=http://localhost:9200

Windows:

.\elastic-agent.exe install --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL2RlZmF1bHQtZmxlZXQtc2VydmVyLXRva2VuOnlXN0tGYXVmVGFDNkczeExEUmpqOWc --fleet-server-es=http://localhost:9200

RPM / DEB:

sudo elastic-agent install -f --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL2RlZmF1bHQtZmxlZXQtc2VydmVyLXRva2VuOnlXN0tGYXVmVGFDNkczeExEUmpqOWc --fleet-server-es=http://localhost:9200
sudo systemctl enable elastic-agent 
sudo systemctl start elastic-agent

… yet

elasticmachine · 2021-04-20T05:18:45Z

Pinging @elastic/fleet (Team:Fleet)

jen-huang · 2021-04-20T05:20:54Z

      <EuiFlyoutBody
        banner={
-          fleetServerHosts.length === 0 ? (
+          fleetServerHosts.length === 0 && mode === 'managed' ? (


I also updated the Add agent flyout so that the Run standalone tab can be viewed without Fleet Server being setup. I thought this was appropriate since, well, those are standalone agents! @nchaulet maybe you can help me double check if this makes sense.

Yes it make sense 👍

ruflin · 2021-04-20T06:17:18Z

+    }
+    switch (platform) {
+      case 'linux-mac':
+        return `./elastic-agent install -f --fleet-server-service-token=${serviceToken} --fleet-server-es=${esHost}`;


I think with fleet-server always sudo is required as a part will be exposed.

ruflin · 2021-04-20T06:17:42Z

Did a quick run locally and works as expected 🎉

ruflin · 2021-04-20T06:24:01Z

  }
 };

+export const regenerateServiceTokenHandler: RequestHandler = async (context, request, response) => {


Is regenerate really what we want? It means if this API endpoint is called, all existing fleet-servers will stop working. Instead I more thinking of it as "add token".

Yes I think we probably want to generate a new token here each time

My concern with adding a new token every time is that maybe some of them will get generated and then never used. Is that okay?

Also, since this is a new set of ES APIs, I couldn't find documentation for "retrieve all token names for this service account", which would let me generate incremental token names. Should we just generate the token names based on timestamp? token-{timestamp}?

There will be token that are generated and never used, that is why we will need some management. But it is also the reason I want to the user to "click" a button to generate it to not have too many just because a user reloaded.

++ on timestamp for now. More APIs are still under development and we can get better here.

ruflin · 2021-04-20T06:25:33Z

+import type { CheckPermissionsResponse, RegenerateServiceTokenResponse } from '../../../common';
+import { defaultIngestErrorHandler, RegenerateServiceTokenError } from '../../errors';
+
+const DEFAULT_FLEET_SERVER_SERVICE_TOKEN_NAME = 'default-fleet-server-token';


The service account is already called fleet-server and it is tokens for it, so not sure we need to include it all in the name. Thinking of a future where there are multiple tokens, how will the user differentiate between these. Should we call it token-{number} for token-{timestamp} for now and later let the user specify a name if they want?

nchaulet · 2021-04-20T11:52:04Z

+
+  const getServiceToken = useCallback(async () => {
+    setIsLoadingServiceToken(true);
+    const { data } = await sendRegenerateServiceToken();


should we add some error handling around that? and use a toast notification if there is an error?

nchaulet · 2021-04-20T14:38:31Z

@elasticmachine merge upstream

nchaulet

🚀

blakerouse · 2021-04-20T15:23:38Z

+    }
+    switch (platform) {
+      case 'linux-mac':
+        return `sudo ./elastic-agent install -f --fleet-server-service-token=${serviceToken} --fleet-server-es=${esHost}`;


Can we flip this and place the --fleet-server-es first?

blakerouse · 2021-04-20T15:24:08Z

+      case 'linux-mac':
+        return `sudo ./elastic-agent install -f --fleet-server-service-token=${serviceToken} --fleet-server-es=${esHost}`;
+      case 'windows':
+        return `.\\elastic-agent.exe install --fleet-server-service-token=${serviceToken} --fleet-server-es=${esHost}`;


On windows you will want to run that either in a cmd.exe or a Powershell that is started with Run as Administrator.

In the copy above the commands we tell user administrator privileges are needed

blakerouse · 2021-04-20T15:25:34Z

+      case 'deb-rpm':
+        return `sudo elastic-agent install -f --fleet-server-service-token=${serviceToken} --fleet-server-es=${esHost}
+sudo systemctl enable elastic-agent
+sudo systemctl start elastic-agent`;


None of this is correct on the DEB/RPM. You only need a single command, that command will automatically handle the restart of the Elastic Agent. You also need to use the enroll command on DEB/RPM.

So just change it to one-line:

elastic-agent enroll -f --fleet-server-es=${esHost} --fleet-server-service-token=${serviceToken}

~~is sudo needed in this case?~~ yes it is

EricDavisX · 2021-04-20T15:35:50Z

we had previously not exposed the rpm/deb commands as we were slightly downplaying them (relying on docs support) since their usage inherently prevents being able to 'upgrade' the agent later on. We could pull them out of this as well, but it is fine to list it, and folks may use and desire it even though it isn't our recommended usage on linux to deploy. @jen-huang

kibanamachine · 2021-04-20T17:53:15Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`fleet`	475	454	-21

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	787.1KB	719.6KB	-67.6KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	346.1KB	346.3KB	+135.0B

Unknown metric groups

API count

id	before	after	diff
`fleet`	1076	1081	+5

API count missing comments

id	before	after	diff
`fleet`	986	991	+5

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @jen-huang

…Server onboarding (elastic#97585) * Don't block standalone agent instructions when not using Fleet server yet * Add service token instructions - UI only * Add route for regenerating fleet server service token * generate tokens instead of regenerate and add error catching and tests * fix i18n typo * i18n fix, add sudo, copy edits * Fix commands * Add missing test file Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2021-04-20T17:57:53Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…Server onboarding (#97585) (#97696) * Don't block standalone agent instructions when not using Fleet server yet * Add service token instructions - UI only * Add route for regenerating fleet server service token * generate tokens instead of regenerate and add error catching and tests * fix i18n typo * i18n fix, add sudo, copy edits * Fix commands * Add missing test file Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Jen Huang <its.jenetic@gmail.com> Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co>

jen-huang added 3 commits April 19, 2021 15:36

Don't block standalone agent instructions when not using Fleet server…

8b8b985

… yet

Add service token instructions - UI only

30e9377

Add route for regenerating fleet server service token

76e32d6

jen-huang added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team v7.13.0 labels Apr 20, 2021

jen-huang requested a review from nchaulet April 20, 2021 05:18

jen-huang self-assigned this Apr 20, 2021

jen-huang requested a review from a team as a code owner April 20, 2021 05:18

jen-huang commented Apr 20, 2021

View reviewed changes

ruflin reviewed Apr 20, 2021

View reviewed changes

nchaulet reviewed Apr 20, 2021

View reviewed changes

nchaulet added 2 commits April 20, 2021 10:24

generate tokens instead of regenerate and add error catching and tests

810657c

fix i18n typo

0309ac2

kibanamachine and others added 2 commits April 20, 2021 10:38

Merge branch 'master' into fix/onboarding-service-tokens

3283391

i18n fix, add sudo, copy edits

2dfadbd

nchaulet approved these changes Apr 20, 2021

View reviewed changes

blakerouse reviewed Apr 20, 2021

View reviewed changes

jen-huang and others added 2 commits April 20, 2021 08:39

Fix commands

860cae0

Add missing test file

d03e1b3

jen-huang mentioned this pull request Apr 20, 2021

[Fleet] Show Fleet Server instructions when user wants to add another Fleet Server after the first #97681

Merged

jen-huang added the auto-backport Deprecated - use backport:version if exact versions are needed label Apr 20, 2021

jen-huang enabled auto-merge (squash) April 20, 2021 17:13

jen-huang merged commit 10e52bb into elastic:master Apr 20, 2021

kibanamachine mentioned this pull request Apr 20, 2021

[7.x] [Fleet] Add instructions and generation of a service token for Fleet Server onboarding (#97585) #97696

Merged

jen-huang deleted the fix/onboarding-service-tokens branch April 20, 2021 17:59

jfsiii mentioned this pull request May 4, 2021

[Fleet] need to add api/fleet/service-tokens to the Fleet API Docs #99218

Closed

Conversation

jen-huang commented Apr 20, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

Uh oh!

elasticmachine commented Apr 20, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ruflin commented Apr 20, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nchaulet Apr 20, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nchaulet commented Apr 20, 2021

Uh oh!

nchaulet left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jen-huang Apr 20, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

EricDavisX commented Apr 20, 2021

Uh oh!

kibanamachine commented Apr 20, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

API count

API count missing comments

History

Uh oh!

kibanamachine commented Apr 20, 2021

💚 Backport successful

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

jen-huang commented Apr 20, 2021 •

edited

Loading

nchaulet Apr 20, 2021 •

edited

Loading

jen-huang Apr 20, 2021 •

edited

Loading