You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
$$$ece-all-stacks$$$Additional {{stack}} versions are available as Docker images that you can use with ECE. For offline installations, you need to download both the {{stack}} pack and the Docker images for the same version.
29
29
@@ -173,11 +173,11 @@ Enterprise Search is not available in versions 9.0+.
@@ -36,27 +36,27 @@ To perform an offline installation without a private Docker registry, you have t
36
36
37
37
```sh subs=true
38
38
docker save -o ece.{{version.ece}}.tar docker.elastic.co/cloud-enterprise/elastic-cloud-enterprise:{{version.ece}}
39
-
docker save -o es.8.18.2.tar docker.elastic.co/cloud-release/elasticsearch-cloud-ess:8.18.2
40
-
docker save -o kibana.8.18.2.tar docker.elastic.co/cloud-release/kibana-cloud:8.18.2
41
-
docker save -o apm.8.18.2.tar docker.elastic.co/cloud-release/elastic-agent-cloud:8.18.2
42
-
docker save -o enterprise-search.8.18.2.tar docker.elastic.co/cloud-release/enterprise-search-cloud:8.18.2
43
-
docker save -o es.9.0.1.tar docker.elastic.co/cloud-release/elasticsearch-cloud-ess:9.0.1
44
-
docker save -o kibana.9.0.1.tar docker.elastic.co/cloud-release/kibana-cloud:9.0.1
45
-
docker save -o apm.9.0.1.tar docker.elastic.co/cloud-release/elastic-agent-cloud:9.0.1
39
+
docker save -o es.8.18.2.tar docker.elastic.co/cloud-release/elasticsearch-cloud-ess:8.18.8
40
+
docker save -o kibana.8.18.2.tar docker.elastic.co/cloud-release/kibana-cloud:8.18.8
41
+
docker save -o apm.8.18.2.tar docker.elastic.co/cloud-release/elastic-agent-cloud:8.18.8
42
+
docker save -o enterprise-search.8.18.2.tar docker.elastic.co/cloud-release/enterprise-search-cloud:8.18.8
43
+
docker save -o es.9.0.1.tar docker.elastic.co/cloud-release/elasticsearch-cloud-ess:9.0.8
44
+
docker save -o kibana.9.0.1.tar docker.elastic.co/cloud-release/kibana-cloud:9.0.8
45
+
docker save -o apm.9.0.1.tar docker.elastic.co/cloud-release/elastic-agent-cloud:9.0.8
46
46
```
47
47
48
48
3. Copy the .tar files to a location on your network where they are available to each host where you plan to install {{ece}}. Alternatively, you can copy the .tar files to each host directly.
49
49
4. On each host, load the images into Docker, replacing `FILE_PATH` with the correct path to the .tar files:
@@ -42,26 +42,26 @@ Installing ECE on multiple hosts with your own registry server is simpler, becau
42
42
43
43
```sh subs=true
44
44
docker tag docker.elastic.co/cloud-enterprise/elastic-cloud-enterprise:{{version.ece}} REGISTRY/cloud-enterprise/elastic-cloud-enterprise:{{version.ece}}
45
-
docker tag docker.elastic.co/cloud-release/elasticsearch-cloud-ess:8.18.2 REGISTRY/cloud-release/elasticsearch-cloud-ess:8.18.2
46
-
docker tag docker.elastic.co/cloud-release/kibana-cloud:8.18.2 REGISTRY/cloud-release/kibana-cloud:8.18.2
47
-
docker tag docker.elastic.co/cloud-release/elastic-agent-cloud:8.18.2 REGISTRY/cloud-release/elastic-agent-cloud:8.18.2
48
-
docker tag docker.elastic.co/cloud-release/enterprise-search-cloud:8.18.2 REGISTRY/cloud-release/enterprise-search-cloud:8.18.2
49
-
docker tag docker.elastic.co/cloud-release/elasticsearch-cloud-ess:9.0.1 REGISTRY/cloud-release/elasticsearch-cloud-ess:9.0.1
50
-
docker tag docker.elastic.co/cloud-release/kibana-cloud:9.0.1 REGISTRY/cloud-release/kibana-cloud:9.0.1
51
-
docker tag docker.elastic.co/cloud-release/elastic-agent-cloud:9.0.1 REGISTRY/cloud-release/elastic-agent-cloud:9.0.1
45
+
docker tag docker.elastic.co/cloud-release/elasticsearch-cloud-ess:8.18.2 REGISTRY/cloud-release/elasticsearch-cloud-ess:8.18.8
46
+
docker tag docker.elastic.co/cloud-release/kibana-cloud:8.18.2 REGISTRY/cloud-release/kibana-cloud:8.18.8
47
+
docker tag docker.elastic.co/cloud-release/elastic-agent-cloud:8.18.2 REGISTRY/cloud-release/elastic-agent-cloud:8.18.8
48
+
docker tag docker.elastic.co/cloud-release/enterprise-search-cloud:8.18.2 REGISTRY/cloud-release/enterprise-search-cloud:8.18.8
49
+
docker tag docker.elastic.co/cloud-release/elasticsearch-cloud-ess:9.0.1 REGISTRY/cloud-release/elasticsearch-cloud-ess:9.0.8
50
+
docker tag docker.elastic.co/cloud-release/kibana-cloud:9.0.1 REGISTRY/cloud-release/kibana-cloud:9.0.8
51
+
docker tag docker.elastic.co/cloud-release/elastic-agent-cloud:9.0.1 REGISTRY/cloud-release/elastic-agent-cloud:9.0.8
52
52
```
53
53
54
54
4. Push the Docker images to your private Docker registry, using the same tags from the previous step. Replace `REGISTRY` with your actual registry URL, for example `my.private.repo:5000`:
@@ -298,6 +300,13 @@ For more information about custom certificates, refer to [Configure SSL/TLS for
298
300
`--help`
299
301
: Show help for the `enroll` command.
300
302
303
+
`--id <string>`
304
+
: Specifies the unique identifier (agent ID) to use when enrolling the {{agent}} with {{fleet-server}}. This setting is useful when restoring a previously enrolled agent or in stateless environments where the agent cannot persist enrollment data between redeployments.
305
+
306
+
:::{note}
307
+
If an agent with the same ID is already enrolled in {{fleet}}, enrollment will fail unless a valid replacement token is provided using the `--replace-token` flag.
308
+
:::
309
+
301
310
`--insecure`
302
311
: Allow the {{agent}} to connect to {{fleet-server}} over insecure connections. This setting is required in the following situations:
303
312
@@ -317,6 +326,13 @@ For more information about custom certificates, refer to [Configure SSL/TLS for
317
326
`--proxy-url <string>`
318
327
: Configures the proxy URL.
319
328
329
+
`--replace-token <string>`
330
+
: Specifies a token that can be used to replace the {{agent}} after its enrollment in {{fleet-server}}. The token must be provided when enrolling an agent with a specific agent ID for the first time. Subsequently, the agent can be replaced by enrolling another agent using the same agent ID and replacement token. Once replaced, the original agent can no longer communicate with {{fleet}}.
331
+
332
+
:::{note}
333
+
If an {{agent}} is enrolled without a replacement token, it cannot be replaced by another agent with the same ID. This mechanism prevents accidental or malicious takeovers by requiring the replacement token to match the hashed token stored in {{fleet}}.
334
+
:::
335
+
320
336
`--staging <string>`
321
337
: Configures agent to download artifacts from a staging build.
Copy file name to clipboardExpand all lines: reference/fleet/agent-environment-variables.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -86,11 +86,13 @@ Settings used to enroll an {{agent}} into a {{fleet-server}}.
86
86
|$$$env-enroll-elastic-agent-cert$$$<br>`ELASTIC_AGENT_CERT`<br> | (string) The path to the mutual TLS client certificate that {{agent}} will use to connect to {{fleet-server}}.<br> |
87
87
|$$$env-enroll-elastic-agent-cert-key$$$<br>`ELASTIC_AGENT_CERT_KEY`<br> | (string) The path to the mutual TLS private key that {{agent}} will use to connect to {{fleet-server}}.<br> |
88
88
|$$$env-enroll-elastic-agent-cert-key-passphrase$$$<br>`ELASTIC_AGENT_CERT_KEY_PASSPHRASE`<br> | (string) The path to the file that contains the passphrase for the mutual TLS private key that {{agent}} will use to connect to {{fleet-server}}. The file must only contain the characters of the passphrase, no newline or extra non-printing characters.<br><br>This option is only used if the `--elastic-agent-cert-key` is encrypted and requires a passphrase to use.<br> |
89
+
|$$$env-enroll-elastic-agent-id$$$<br>`ELASTIC_AGENT_ID`<br> | (string) The unique identifier (agent ID) to use when enrolling the {{agent}} with {{fleet-server}}. This setting is useful when restoring a previously enrolled agent or in stateless containerized environments where the agent cannot persist enrollment data between redeployments.<br><br>If an agent with the same ID is already enrolled in {{fleet}}, enrollment will fail unless a valid replacement token is provided using the `FLEET_REPLACE_TOKEN` environment variable.<br><br>**Default:**`""`<br> |
89
90
|$$$env-enroll-elastic-agent-tag$$$<br>`ELASTIC_AGENT_TAGS`<br> | (string) A comma-separated list of tags to apply to {{fleet}}-managed {{agent}}s. You can use these tags to filter the list of agents in {{fleet}}.<br> |
90
91
|$$$env-enroll-fleet-enroll$$$<br>`FLEET_ENROLL`<br> | (bool) Set to `1` to enroll the {{agent}} into {{fleet-server}}.<br><br>**Default:**`false`<br> |
91
92
|$$$env-enroll-fleet-force$$$<br>`FLEET_FORCE`<br> | (bool) Set to `true` to force overwrite of the current {{agent}} configuration without prompting for confirmation. This flag is helpful when using automation software or scripted deployments.<br><br>**Default:**`false`<br> |
92
93
|$$$env-enroll-fleet-url$$$<br>`FLEET_URL`<br> | (string) URL to enroll the {{fleet-server}} into.<br><br>**Default:**`""`<br> |
93
94
|$$$env-enroll-fleet-enrollment-token$$$<br>`FLEET_ENROLLMENT_TOKEN`<br> | (string) The token to use for enrollment.<br><br>**Default:**`""`<br> |
95
+
|$$$env-enroll-fleet-replace-token$$$<br>`FLEET_REPLACE_TOKEN`<br> | (string) The token that can be used to replace the {{agent}} after it is enrolled in {{fleet-server}}. The `FLEET_REPLACE_TOKEN` environment variable must be provided when enrolling an agent with a specific agent ID for the first time. Subsequently, the agent can be replaced by enrolling another agent using the same `ELASTIC_AGENT_ID` and `FLEET_REPLACE_TOKEN` environment variables. Once replaced, the original agent can no longer communicate with {{fleet}}.<br><br>If an {{agent}} is enrolled without a replacement token, it cannot be replaced by another agent with the same ID. This mechanism prevents accidental or malicious takeovers by requiring the replacement token to match the hashed token stored in {{fleet}}.<br><br>**Default:**`""`<br> |
94
96
|$$$env-enroll-fleet-token-name$$$<br>`FLEET_TOKEN_NAME`<br> | (string) The token name to use to fetch the token from {{kib}}.<br><br>**Default:**`""`<br> |
95
97
|$$$env-enroll-fleet-token-policy-name$$$<br>`FLEET_TOKEN_POLICY_NAME`<br> | (string) The token policy name to use to fetch the token from {{kib}}.<br><br>**Default:**`false`<br> |
96
98
|$$$env-enroll-fleet-ca$$$<br>`FLEET_CA`<br> | (string) The path to a certificate authority. Overrides `ELASTICSEARCH_CA` when set.<br><br>By default, {{agent}} uses the list of trusted certificate authorities (CA) from the operating system where it is running. If the certificate authority that signed your node certificates is not in the host system’s trusted certificate authorities list, use this config to add the path to the `.pem` file that contains your CA’s certificate.<br><br>**Default:**`false`<br> |
0 commit comments