You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|**Network**| IP traffic filtering | Configurable |[Configure IP-based access restrictions](/deploy-manage/security/ip-filtering-cloud.md)|
23
23
|| Private link | Configurable |[Establish a secure VPC connection](/deploy-manage/security/private-link-traffic-filters.md)|
24
-
|| Kubernetes Network Policies| N/A ||
24
+
|| Kubernetes network policies| N/A ||
25
25
|**Data**| Encryption at rest | Managed | You can [bring your own encryption key](/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md)|
Copy file name to clipboardExpand all lines: deploy-manage/security/k8s-https-settings.md
-4Lines changed: 0 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,10 +12,6 @@ mapped_urls:
12
12
13
13
## {{es}} certificates [k8s-tls-certificates]
14
14
15
-
```{applies_to}
16
-
deployment:
17
-
eck: all
18
-
```
19
15
20
16
:::{note}
21
17
This section only covers TLS certificates for the HTTP layer. TLS certificates for the transport layer that are used for internal communications between Elasticsearch nodes are managed by ECK and cannot be changed. You can however set your own certificate authority for the [transport layer](/deploy-manage/security/k8s-transport-settings.md#k8s-transport-ca).
Copy file name to clipboardExpand all lines: deploy-manage/security/kibana-es-mutual-tls.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ To [enroll {{kib}} with an {{es}} cluster](/deploy-manage/security/self-auto-set
23
23
Using a PKI realm is a [subscription feature](https://www.elastic.co/subscriptions).
24
24
::::
25
25
26
-
####Configure {{kib}} and {{es}} to use mutual TLS authentication [_configure_kib_and_es_to_use_mutual_tls_authentication]
26
+
## Configure {{kib}} and {{es}} to use mutual TLS authentication [_configure_kib_and_es_to_use_mutual_tls_authentication]
27
27
28
28
If you haven’t already, start {{kib}} and connect it to {{es}} using the [enrollment token](/deploy-manage/security/self-auto-setup.md#stack-start-with-security).
Copy file name to clipboardExpand all lines: deploy-manage/security/secure-cluster-communications.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,21 +13,21 @@ mapped_urls:
13
13
% Scope: landing page for manually handling TLS certificates, and for information about TLS in Elastic Stack in general.
14
14
# TLS encryption for cluster communications
15
15
16
-
This page explains how to secure communications and setup TLS certificates between components in your {{stack}} deployment.
16
+
This page explains how to secure communications and set up TLS certificates between components in your {{stack}} deployment.
17
17
18
-
For {{ech}} and {{serverless-full}} deployments, communication security is fully managed by Elastic with no configuration required, including TLS certificates.
18
+
For {{ech}} deployments and {{serverless-full}} projects, communication security is [fully managed by Elastic](/deploy-manage/security.md#managed-security-in-elastic-cloud) with no configuration required, including TLS certificates.
19
19
20
-
For ECE, ECK, and self-managed deployments, this page provides specific configuration guidance to secure the various communication channels between components.
20
+
For ECE, ECK, and self-managed deployments, some of this process can be automated, with opportunities for manual configuration depending on your requirements. This page provides specific configuration guidance to secure the various communication channels between components.
21
21
22
22
:::{tip}
23
-
For a complete comparison of security feature availability and responsibility by deployment type, see[Security features by deployment type](/deploy-manage/security.md#comparison-table).
23
+
For a complete comparison of security feature availability and responsibility by deployment type, refer to[Security features by deployment type](/deploy-manage/security.md#comparison-table).
24
24
:::
25
25
26
26
## Communication channels overview [communication-channels]
27
27
28
28
Both {{es}} and {{kib}}, the core components of the {{stack}}, expose service endpoints that must be secured. {{es}} handles traffic at two levels:
29
29
* The **transport layer** (defaults to port `9300`), used for internal communication between nodes in the cluster.
30
-
* The **HTTP layer** (defaults to port `9200`), used by external clients — including Kibana — to send requests via the REST API.
30
+
* The **HTTP layer** (defaults to port `9200`), used by external clients — including Kibana — to send requests using the REST API.
31
31
32
32
Additionally, {{kib}} functions as a web server, exposing its own **HTTP endpoint** (defaults to port `5601`) to users, and also acts as a client when sending requests to {{es}}.
33
33
@@ -77,7 +77,7 @@ Transport Layer Security (TLS) is the name of an industry standard protocol for
77
77
78
78
Transport Protocol is the name of the protocol that {{es}} nodes use to communicate with one another. This name is specific to {{es}} and distinguishes the transport port (default `9300`) from the HTTP port (default `9200`). Nodes communicate with one another using the transport port, and REST clients communicate with {{es}} using the HTTP port.
79
79
80
-
Although the word *transport* appears in both contexts, they mean different things. It’s possible to apply TLS to both the {{es}} transport port and the HTTP port. We know that these overlapping terms can be confusing, so to clarify, in this scenario we’re applying TLS to the {{es}} transport port. In [](./set-up-basic-security-plus-https.md), we’ll apply TLS to the {{es}} HTTP port.
80
+
Although the word *transport* appears in both contexts, they mean different things. It’s possible to apply TLS to both the {{es}} transport port and the HTTP port. We know that these overlapping terms can be confusing, so to clarify, in this scenario we’re applying TLS to the {{es}} transport port.
Copy file name to clipboardExpand all lines: deploy-manage/security/self-tls.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,9 +10,7 @@ applies_to:
10
10
11
11
This section provides guidance on managing TLS certificates in self-managed deployments after the initial security setup. It covers tasks such as configuring mutual authentication, renewing certificates, and customizing supported TLS versions and cipher suites.
12
12
13
-
::::{note}
14
13
If you're looking to secure a new or existing cluster by setting up TLS for the first time, refer to [](./self-setup.md), which covers both the [automatic](./self-auto-setup.md) and [manual](./self-setup.md#manual-configuration) configuration procedures.
15
-
::::
16
14
17
15
The topics in this section focus on post-setup tasks:
18
16
@@ -21,7 +19,7 @@ The topics in this section focus on post-setup tasks:
21
19
*[](./supported-ssltls-versions-by-jdk-version.md): Customize the list of supported SSL/TLS versions in your cluster.
22
20
*[](./enabling-cipher-suites-for-stronger-encryption.md): Enable additional cipher suites for TLS communications, including those used with authentication providers.
23
21
24
-
For an overview of the endpoints that need securing in {{es}} and {{kib}}, refer to [Communication channels](./secure-cluster-communications.md#communication-channels).
22
+
For an overview of the endpoints that can be secured in {{es}} and {{kib}}, refer to [Communication channels](./secure-cluster-communications.md#communication-channels).
Copy file name to clipboardExpand all lines: deploy-manage/security/using-kibana-with-security.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ mapped_urls:
11
11
12
12
This document describes security settings you may need to configure in self-managed deployments of {{kib}}. These settings help secure access, manage connections, and ensure consistent behavior across multiple instances.
13
13
14
-
Additional {{kib}} security features that apply to all deployment types — such as session management, saved objects encryption, and audit logging — are covered in a separate section [at the end of this document](#additional-security-topics).
14
+
Additional {{kib}} security features that apply to all deployment types, such as session management, saved objects encryption, and audit logging, are covered in a separate section [at the end of this document](#additional-security-topics).
0 commit comments