Skip to content

Commit 2703f92

Browse files
Apply suggestions from code review
Co-authored-by: shainaraskas <[email protected]>
1 parent d0b5df0 commit 2703f92

File tree

6 files changed

+25
-31
lines changed

6 files changed

+25
-31
lines changed

deploy-manage/security/_snippets/cluster-comparison.md

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ Select your deployment type below to see what's available and how implementation
1717

1818
| Category | Security feature | Status | Notes |
1919
|------------------|------------|--------------|-------------|
20-
| **Communication** | TLS (HTTP Layer) | Fully managed | Automatically configured by Elastic |
21-
| | TLS (Transport Layer) | Fully managed | Automatically configured by Elastic |
20+
| **Communication** | TLS (HTTP layer) | Fully managed | Automatically configured by Elastic |
21+
| | TLS (Transport layer) | Fully managed | Automatically configured by Elastic |
2222
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-cloud.md) |
2323
| | Private link | Configurable | [Establish a secure VPC connection](/deploy-manage/security/private-link-traffic-filters.md) |
24-
| | Kubernetes Network Policies | N/A | |
24+
| | Kubernetes network policies | N/A | |
2525
| **Data** | Encryption at rest | Managed | You can [bring your own encryption key](/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md) |
2626
| | Secure settings | Configurable | Automatically protected by Elastic |
2727
| | Saved object encryption | Fully managed | Automatically encrypted by Elastic |
@@ -34,11 +34,11 @@ Select your deployment type below to see what's available and how implementation
3434

3535
| Category| Security feature | Status | Notes |
3636
|------------------|------------|--------------|-------------|
37-
| **Communication** | TLS (HTTP Layer) | Fully managed | Automatically configured by Elastic |
38-
| | TLS (Transport Layer) | Fully managed | Automatically configured by Elastic |
37+
| **Communication** | TLS (HTTP layer) | Fully managed | Automatically configured by Elastic |
38+
| | TLS (Transport layer) | Fully managed | Automatically configured by Elastic |
3939
| **Network** | IP traffic filtering | N/A | |
4040
| | Private link | N/A | |
41-
| | Kubernetes Network Policies | N/A | |
41+
| | Kubernetes network policies | N/A | |
4242
| **Data** | Encryption at rest | Fully managed | Automatically encrypted by Elastic |
4343
| | Secure settings | N/A | |
4444
| | Saved object encryption | Fully managed | Automatically encrypted by Elastic |
@@ -51,15 +51,15 @@ Select your deployment type below to see what's available and how implementation
5151

5252
| Category| Security feature | Status | Notes |
5353
|------------------|------------|--------------|-------------|
54-
| **Communication** | TLS (HTTP Layer) | Managed | You can [configure custom certificates](/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md) |
55-
| | TLS (Transport Layer) | Fully managed | Automatically configured by Elastic |
54+
| **Communication** | TLS (HTTP layer) | Managed | You can [configure custom certificates](/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md) |
55+
| | TLS (Transport layer) | Fully managed | Automatically configured by Elastic |
5656
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-cloud.md) |
5757
| | Private link | N/A | |
58-
| | Kubernetes Network Policies | N/A | |
58+
| | Kubernetes network policies | N/A | |
5959
| **Data** | Encryption at rest | N/A | |
6060
| | Secure settings | Configurable | [Configure secure settings](/deploy-manage/security/secure-settings.md) |
6161
| | Saved object encryption | Configurable | [Enable encryption for saved objects](/deploy-manage/security/secure-saved-objects.md) |
62-
| **User Session** | Kibana Sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
62+
| **User session** | {{kib}} sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
6363

6464
:::
6565

@@ -68,15 +68,15 @@ Select your deployment type below to see what's available and how implementation
6868

6969
| Category| Security feature | Status | Notes |
7070
|------------------|------------|--------------|-------------|
71-
| **Communication** | TLS (HTTP Layer) | Managed | [Multiple options](/deploy-manage/security/k8s-https-settings.md) |
72-
| | TLS (Transport Layer) | Managed | [Multiple options](/deploy-manage/security/k8s-transport-settings.md) |
71+
| **Communication** | TLS (HTTP layer) | Managed | [Multiple options](/deploy-manage/security/k8s-https-settings.md) for customization |
72+
| | TLS (Transport layer) | Managed | [Multiple options](/deploy-manage/security/k8s-transport-settings.md) for customization |
7373
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-basic.md) |
7474
| | Private link | N/A | |
75-
| | Kubernetes Network Policies | Configurable | [Apply network policies to your Pods](/deploy-manage/security/k8s-network-policies.md) |
75+
| | Kubernetes network policies | Configurable | [Apply network policies to your Pods](/deploy-manage/security/k8s-network-policies.md) |
7676
| **Data** | Encryption at rest | N/A | |
7777
| | Secure settings | Configurable | [Configure secure settings](/deploy-manage/security/k8s-secure-settings.md) |
7878
| | Saved object encryption | Configurable | [Enable encryption for saved objects](/deploy-manage/security/secure-saved-objects.md) |
79-
| **User Session** | Kibana Sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
79+
| **User session** | {{kib}} sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
8080

8181
:::
8282

@@ -90,11 +90,11 @@ Select your deployment type below to see what's available and how implementation
9090
| | TLS (Transport Layer) | Configurable | [Initial security setup](/deploy-manage/security/self-setup.md) |
9191
| **Network** | IP traffic filtering | Configurable | [Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-basic.md) |
9292
| | Private link | N/A | |
93-
| | Kubernetes Network Policies | N/A | |
93+
| | Kubernetes network policies | N/A | |
9494
| **Data** | Encryption at rest | N/A | |
9595
| | Keystore security | Configurable | [Configure secure settings](/deploy-manage/security/secure-settings.md) |
9696
| | Saved object encryption | Configurable | [Enable encryption for saved objects](/deploy-manage/security/secure-saved-objects.md) |
97-
| **User Session** | Kibana Sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
97+
| **User session** | {{kib}} sessions | Configurable | [Customize session parameters](/deploy-manage/security/kibana-session-management.md) |
9898

9999
:::
100100
::::

deploy-manage/security/k8s-https-settings.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,6 @@ mapped_urls:
1212

1313
## {{es}} certificates [k8s-tls-certificates]
1414

15-
```{applies_to}
16-
deployment:
17-
eck: all
18-
```
1915

2016
:::{note}
2117
This section only covers TLS certificates for the HTTP layer. TLS certificates for the transport layer that are used for internal communications between Elasticsearch nodes are managed by ECK and cannot be changed. You can however set your own certificate authority for the [transport layer](/deploy-manage/security/k8s-transport-settings.md#k8s-transport-ca).

deploy-manage/security/kibana-es-mutual-tls.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ To [enroll {{kib}} with an {{es}} cluster](/deploy-manage/security/self-auto-set
2323
Using a PKI realm is a [subscription feature](https://www.elastic.co/subscriptions).
2424
::::
2525

26-
#### Configure {{kib}} and {{es}} to use mutual TLS authentication [_configure_kib_and_es_to_use_mutual_tls_authentication]
26+
## Configure {{kib}} and {{es}} to use mutual TLS authentication [_configure_kib_and_es_to_use_mutual_tls_authentication]
2727

2828
If you haven’t already, start {{kib}} and connect it to {{es}} using the [enrollment token](/deploy-manage/security/self-auto-setup.md#stack-start-with-security).
2929

deploy-manage/security/secure-cluster-communications.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,21 +13,21 @@ mapped_urls:
1313
% Scope: landing page for manually handling TLS certificates, and for information about TLS in Elastic Stack in general.
1414
# TLS encryption for cluster communications
1515

16-
This page explains how to secure communications and setup TLS certificates between components in your {{stack}} deployment.
16+
This page explains how to secure communications and set up TLS certificates between components in your {{stack}} deployment.
1717

18-
For {{ech}} and {{serverless-full}} deployments, communication security is fully managed by Elastic with no configuration required, including TLS certificates.
18+
For {{ech}} deployments and {{serverless-full}} projects, communication security is [fully managed by Elastic](/deploy-manage/security.md#managed-security-in-elastic-cloud) with no configuration required, including TLS certificates.
1919

20-
For ECE, ECK, and self-managed deployments, this page provides specific configuration guidance to secure the various communication channels between components.
20+
For ECE, ECK, and self-managed deployments, some of this process can be automated, with opportunities for manual configuration depending on your requirements. This page provides specific configuration guidance to secure the various communication channels between components.
2121

2222
:::{tip}
23-
For a complete comparison of security feature availability and responsibility by deployment type, see [Security features by deployment type](/deploy-manage/security.md#comparison-table).
23+
For a complete comparison of security feature availability and responsibility by deployment type, refer to [Security features by deployment type](/deploy-manage/security.md#comparison-table).
2424
:::
2525

2626
## Communication channels overview [communication-channels]
2727

2828
Both {{es}} and {{kib}}, the core components of the {{stack}}, expose service endpoints that must be secured. {{es}} handles traffic at two levels:
2929
* The **transport layer** (defaults to port `9300`), used for internal communication between nodes in the cluster.
30-
* The **HTTP layer** (defaults to port `9200`), used by external clients — including Kibana — to send requests via the REST API.
30+
* The **HTTP layer** (defaults to port `9200`), used by external clients — including Kibana — to send requests using the REST API.
3131

3232
Additionally, {{kib}} functions as a web server, exposing its own **HTTP endpoint** (defaults to port `5601`) to users, and also acts as a client when sending requests to {{es}}.
3333

@@ -77,7 +77,7 @@ Transport Layer Security (TLS) is the name of an industry standard protocol for
7777

7878
Transport Protocol is the name of the protocol that {{es}} nodes use to communicate with one another. This name is specific to {{es}} and distinguishes the transport port (default `9300`) from the HTTP port (default `9200`). Nodes communicate with one another using the transport port, and REST clients communicate with {{es}} using the HTTP port.
7979

80-
Although the word *transport* appears in both contexts, they mean different things. It’s possible to apply TLS to both the {{es}} transport port and the HTTP port. We know that these overlapping terms can be confusing, so to clarify, in this scenario we’re applying TLS to the {{es}} transport port. In [](./set-up-basic-security-plus-https.md), we’ll apply TLS to the {{es}} HTTP port.
80+
Although the word *transport* appears in both contexts, they mean different things. It’s possible to apply TLS to both the {{es}} transport port and the HTTP port. We know that these overlapping terms can be confusing, so to clarify, in this scenario we’re applying TLS to the {{es}} transport port.
8181
::::
8282

8383

deploy-manage/security/self-tls.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,7 @@ applies_to:
1010

1111
This section provides guidance on managing TLS certificates in self-managed deployments after the initial security setup. It covers tasks such as configuring mutual authentication, renewing certificates, and customizing supported TLS versions and cipher suites.
1212

13-
::::{note}
1413
If you're looking to secure a new or existing cluster by setting up TLS for the first time, refer to [](./self-setup.md), which covers both the [automatic](./self-auto-setup.md) and [manual](./self-setup.md#manual-configuration) configuration procedures.
15-
::::
1614

1715
The topics in this section focus on post-setup tasks:
1816

@@ -21,7 +19,7 @@ The topics in this section focus on post-setup tasks:
2119
* [](./supported-ssltls-versions-by-jdk-version.md): Customize the list of supported SSL/TLS versions in your cluster.
2220
* [](./enabling-cipher-suites-for-stronger-encryption.md): Enable additional cipher suites for TLS communications, including those used with authentication providers.
2321

24-
For an overview of the endpoints that need securing in {{es}} and {{kib}}, refer to [Communication channels](./secure-cluster-communications.md#communication-channels).
22+
For an overview of the endpoints that can be secured in {{es}} and {{kib}}, refer to [Communication channels](./secure-cluster-communications.md#communication-channels).
2523

2624
## Certificates lifecycle
2725

deploy-manage/security/using-kibana-with-security.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ mapped_urls:
1111

1212
This document describes security settings you may need to configure in self-managed deployments of {{kib}}. These settings help secure access, manage connections, and ensure consistent behavior across multiple instances.
1313

14-
Additional {{kib}} security features that apply to all deployment typessuch as session management, saved objects encryption, and audit logging are covered in a separate section [at the end of this document](#additional-security-topics).
14+
Additional {{kib}} security features that apply to all deployment types, such as session management, saved objects encryption, and audit logging, are covered in a separate section [at the end of this document](#additional-security-topics).
1515

1616
## Configure encryption keys [security-configure-settings]
1717

0 commit comments

Comments
 (0)