Skip to content

Commit 67edd22

Browse files
authored
Merge branch 'main' into 514-cspm-typo-fix
2 parents 57f59f4 + 6ab3bbe commit 67edd22

File tree

107 files changed

+1087
-6058
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

107 files changed

+1087
-6058
lines changed

deploy-manage/deploy/cloud-on-k8s.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,11 @@ Alpha, beta, and stable API versions follow the same [conventions used by Kubern
8080

8181
ECK is compatible with the following Elastic Stack applications:
8282

83-
* Elasticsearch, Kibana, APM Server: 6.8+, 7.1+, 8+
84-
* Enterprise Search: 7.7+, 8+
85-
* Beats: 7.0+, 8+
86-
* Elastic Agent: 7.10+ (standalone), 7.14+ (Fleet), 8+
87-
* Elastic Maps Server: 7.11+, 8+
83+
* Elasticsearch, Kibana, APM Server: 7.17+, 8+
84+
* Enterprise Search: 7.17+, 8+
85+
* Beats: 7.17+, 8+
86+
* Elastic Agent: 7.10+ (standalone), 7.17+ (Fleet), 8+
87+
* Elastic Maps Server: 7.17+, 8+
8888
* Logstash: 8.7+
8989

9090
Elastic Stack application images for the OpenShift-certified Elasticsearch (ECK) Operator are only available from version 7.10 and later.

deploy-manage/deploy/cloud-on-k8s/configure-eck.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ mapped_pages:
1212
This page explains the various methods for configuring and applying ECK settings.
1313

1414
::::{tip}
15-
For a detailed list and description of all available settings in ECK, refer to [ECK configuration flags](asciidocalypse://docs/cloud-on-k8s/docs/reference/eck-configuration-flags.md).
15+
For a detailed list and description of all available settings in ECK, refer to [ECK configuration flags](cloud-on-k8s://reference/eck-configuration-flags.md).
1616
::::
1717

1818
By default, the ECK installation includes a [ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/) with an `eck.yaml` key where you can add, remove, or update configuration settings. This ConfigMap is mounted into the operator’s container as a file, and provided to the application through the `--config` flag.
@@ -56,7 +56,7 @@ If you installed ECK using the manifests and the commands listed in [Deploy ECK]
5656

5757
You can update the ConfigMap directly using the command `kubectl edit configmap elastic-operator -n elastic-operator` or modify the installation manifests and reapply them with `kubectl apply -f <your-manifest-file.yaml>`.
5858

59-
The following shows the default `elastic-operator` ConfigMap, for reference purposes. Refer to [ECK configuration flags](asciidocalypse://docs/cloud-on-k8s/docs/reference/eck-configuration-flags.md) for a complete list of available settings.
59+
The following shows the default `elastic-operator` ConfigMap, for reference purposes. Refer to [ECK configuration flags](cloud-on-k8s://reference/eck-configuration-flags.md) for a complete list of available settings.
6060

6161
```yaml
6262
apiVersion: v1

deploy-manage/deploy/cloud-on-k8s/elasticsearch-deployment-quickstart.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ The cluster that you deployed in this quickstart guide only allocates a persiste
4444
::::
4545

4646

47-
For a full description of each `CustomResourceDefinition` (CRD), refer to the [*API Reference*](asciidocalypse://docs/cloud-on-k8s/docs/reference/k8s-api-reference.md) or view the CRD files in the [project repository](https://github.com/elastic/cloud-on-k8s/tree/2.16/config/crds). You can also retrieve information about a CRD from the cluster. For example, describe the {{es}} CRD specification with [`describe`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_describe/):
47+
For a full description of each `CustomResourceDefinition` (CRD), refer to the [*API Reference*](cloud-on-k8s://reference/api-docs.md) or view the CRD files in the [project repository](https://github.com/elastic/cloud-on-k8s/tree/2.16/config/crds). You can also retrieve information about a CRD from the cluster. For example, describe the {{es}} CRD specification with [`describe`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_describe/):
4848

4949
```sh
5050
kubectl describe crd elasticsearch

deploy-manage/deploy/cloud-on-k8s/k8s-service-mesh-linkerd.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ kubectl annotate namespace elastic-stack linkerd.io/inject=enabled
4343

4444
Any Elasticsearch, Kibana, or APM Server resources deployed to a namespace with the above annotation will automatically join the mesh.
4545

46-
Alternatively, if you only want specific resources to join the mesh, add the `linkerd.io/inject: enabled` annotation to the `podTemplate` (check [API documentation](asciidocalypse://docs/cloud-on-k8s/docs/reference/k8s-api-reference.md)) of the resource as follows:
46+
Alternatively, if you only want specific resources to join the mesh, add the `linkerd.io/inject: enabled` annotation to the `podTemplate` (check [API documentation](cloud-on-k8s://reference/api-docs.md)) of the resource as follows:
4747

4848
```yaml
4949
podTemplate:

deploy-manage/deploy/cloud-on-k8s/kibana-instance-quickstart.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ To deploy a simple [{{kib}}](/get-started/the-stack.md#stack-components-kibana)
6666
```
6767

6868

69-
For a full description of each `CustomResourceDefinition` (CRD), refer to the [*API Reference*](asciidocalypse://docs/cloud-on-k8s/docs/reference/k8s-api-reference.md) or view the CRD files in the [project repository](https://github.com/elastic/cloud-on-k8s/tree/2.16/config/crds). You can also retrieve information about a CRD from the instance. For example, describe the {{kib}} CRD specification with [`describe`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_describe/):
69+
For a full description of each `CustomResourceDefinition` (CRD), refer to the [*API Reference*](cloud-on-k8s://reference/api-docs.md) or view the CRD files in the [project repository](https://github.com/elastic/cloud-on-k8s/tree/2.16/config/crds). You can also retrieve information about a CRD from the instance. For example, describe the {{kib}} CRD specification with [`describe`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_describe/):
7070

7171
```sh
7272
kubectl describe crd kibana

deploy-manage/deploy/cloud-on-k8s/troubleshooting-beats.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ When `kubectl` is used to modify a resource, it calculates the diff between the
2525

2626
If you have configured a Beat to run as a `Deployment` and you are using a `hostPath` volume as the Beats data directory, you might encounter an error similar to the following:
2727

28-
```shell script
28+
```shell
2929
ERROR instance/beat.go:958 Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
3030
```
3131

deploy-manage/deploy/elastic-cloud/regions.md

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ A region is the geographic area where the data center of the cloud provider that
1212
Elastic Cloud Serverless handles all hosting details for you. You are unable to change the region after you create a project.
1313

1414
::::{note}
15-
Currently, a limited number of Amazon Web Services (AWS) and Microsoft Azure regions are available. More regions for AWS and Azure, as well as Google Cloud Platform (GCP), will be added in the future.
15+
Currently, a limited number of Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) regions are available. More regions for AWS, Azure, and GCP, will be added in the future.
1616

1717
::::
1818

@@ -39,4 +39,16 @@ The following Azure regions are currently available:
3939
4040
| Region | Name |
4141
| :--- | :--- |
42-
| eastus | East US |
42+
| eastus | East US |
43+
44+
## Google Cloud Platform (GCP) regions [regions-gcp-regions]
45+
46+
```yaml {applies_to}
47+
serverless: preview
48+
```
49+
50+
The following GCP regions are currently available:
51+
52+
| Region | Name |
53+
| :--- | :--- |
54+
| us-central1 | Iowa |

deploy-manage/security.md

Lines changed: 178 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
---
2+
applies_to:
3+
deployment: all
4+
serverless: ga
25
mapped_urls:
36
- https://www.elastic.co/guide/en/elasticsearch/reference/current/security-files.html
47
- https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-cluster.html
@@ -12,8 +15,6 @@ mapped_urls:
1215
- https://www.elastic.co/guide/en/cloud/current/ec-faq-technical.html
1316
---
1417

15-
# Security
16-
1718
% SR: include this info somewhere in this section
1819
% {{ech}} doesn't support custom SSL certificates, which means that a custom CNAME for an {{ech}} endpoint such as *mycluster.mycompanyname.com* also is not supported.
1920
%
@@ -22,7 +23,7 @@ mapped_urls:
2223
% encryption at rest (EAR) is enabled in {{ech}} by default. We support EAR for both the data stored in your clusters and the snapshots we take for backup, on all cloud platforms and across all regions.
2324
% You can also bring your own key (BYOK) to encrypt your Elastic Cloud deployment data and snapshots. For more information, check [Encrypt your deployment with a customer-managed encryption key](../../../deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md).
2425

25-
Note that the encryption happens at the file system level.
26+
% Note that the encryption happens at the file system level.
2627

2728
% What needs to be done: Refine
2829

@@ -54,15 +55,177 @@ $$$preserving-data-integrity$$$
5455

5556
$$$maintaining-audit-trail$$$
5657

57-
**This page is a work in progress.** The documentation team is working to combine content pulled from the following pages:
58-
59-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md)
60-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md)
61-
* [/raw-migrated-files/kibana/kibana/xpack-security.md](/raw-migrated-files/kibana/kibana/xpack-security.md)
62-
* [/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md](/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md)
63-
* [/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md](/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md)
64-
* [/raw-migrated-files/cloud/cloud-heroku/ech-security.md](/raw-migrated-files/cloud/cloud-heroku/ech-security.md)
65-
* [/raw-migrated-files/kibana/kibana/using-kibana-with-security.md](/raw-migrated-files/kibana/kibana/using-kibana-with-security.md)
66-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md)
67-
* [/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md)
68-
* [/raw-migrated-files/cloud/cloud/ec-faq-technical.md](/raw-migrated-files/cloud/cloud/ec-faq-technical.md)
58+
:::{warning}
59+
**This page is a work in progress.**
60+
:::
61+
62+
63+
% The documentation team is working to combine content pulled from the following pages:
64+
65+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-files.md)
66+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/secure-cluster.md)
67+
% * [/raw-migrated-files/kibana/kibana/xpack-security.md](/raw-migrated-files/kibana/kibana/xpack-security.md)
68+
% * [/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md](/raw-migrated-files/cloud-on-k8s/cloud-on-k8s/k8s-securing-stack.md)
69+
% * [/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md](/raw-migrated-files/cloud/cloud-enterprise/ece-securing-ece.md)
70+
% * [/raw-migrated-files/cloud/cloud-heroku/ech-security.md](/raw-migrated-files/cloud/cloud-heroku/ech-security.md)
71+
% * [/raw-migrated-files/kibana/kibana/using-kibana-with-security.md](/raw-migrated-files/kibana/kibana/using-kibana-with-security.md)
72+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/security-limitations.md)
73+
% * [/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md](/raw-migrated-files/elasticsearch/elasticsearch-reference/es-security-principles.md)
74+
% * [/raw-migrated-files/cloud/cloud/ec-faq-technical.md](/raw-migrated-files/cloud/cloud/ec-faq-technical.md)
75+
76+
# Security
77+
78+
This overview page helps you understand Elastic's security capabilities across different deployment types. You'll find:
79+
80+
- Key security features for protecting your Elastic deployment
81+
- Security capabilities specific to each deployment type
82+
- Comparison tables showing feature availability and configurability by deployment type
83+
- Links to detailed implementation guides
84+
85+
## Security overview
86+
87+
An Elastic implementation comprises many moving parts: {{es}} nodes forming the cluster, {{kib}} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.
88+
89+
To keep your data secured, Elastic offers comprehensive security features that:
90+
- Prevent unauthorized access to your deployment
91+
- Encrypt communications between components
92+
- Protect data at rest
93+
- Secure sensitive settings and saved objects
94+
95+
:::{note}
96+
The availability and configurability of security features vary by deployment type. Refer to [Security by deployment type](#security-features-by-deployment-type) for a comparison table.
97+
:::
98+
99+
## Security topics
100+
101+
The documentation is organized into three main areas.
102+
103+
On every page, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
104+
105+
### 1. Secure your orchestrator
106+
107+
The [security of your orchestrator](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:
108+
109+
- [**Elastic Cloud Hosted and Serverless**](security/secure-your-elastic-cloud-organization.md)
110+
- [**Elastic Cloud Enterprise**](security/secure-your-elastic-cloud-enterprise-installation.md)
111+
- [**Elastic Cloud on Kubernetes**](security/secure-your-eck-installation.md)
112+
113+
:::{note}
114+
There is no orchestration layer for self-managed deployments because you directly control the host environment. Refer to [](security/manually-configure-security-in-self-managed-cluster.md) to learn more about securing self-managed installations.
115+
:::
116+
117+
### 2. Secure your deployments and clusters
118+
119+
[Secure your deployments](security/secure-your-cluster-deployment.md) with features available across all deployment types:
120+
121+
- [**Traffic filtering**](security/traffic-filtering.md): IP filtering, private links, and static IPs
122+
- [**Secure communications**](security/secure-cluster-communications.md): TLS configuration, certificates management
123+
- [**Data protection**](security/data-security.md): Encryption at rest, secure settings, saved objects
124+
- [**Session management**](security/kibana-session-management.md): Kibana session controls
125+
- [**FIPS 140-2 compliance**](security/fips-140-2.md): Federal security standards
126+
127+
### 3. Secure your clients and integrations
128+
129+
[Secure your clients and integrations](security/secure-clients-integrations.md) to ensure secure communication between your applications and Elastic:
130+
131+
- [**Client security**](security/httprest-clients-security.md): Best practices for securely connecting applications to {{es}}
132+
- **Integration security**: Secure configuration for Beats, Logstash, and other integrations
133+
134+
## Security features by deployment type
135+
136+
Security feature availability varies by deployment type, with each feature having one of the following statuses:
137+
138+
| **Status** | **Description** |
139+
|--------|-------------|
140+
| **Managed** | Handled automatically by Elastic with no user configuration needed |
141+
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
142+
| **Self-managed** | Infrastructure-level security you implement and maintain |
143+
| **N/A** | Not available for this deployment type |
144+
145+
Select your deployment type below to see what's available and how implementation responsibilities are distributed:
146+
147+
::::{tab-set}
148+
:group: deployment-type
149+
150+
:::{tab-item} Elastic Cloud Hosted
151+
:sync: cloud-hosted
152+
153+
| **Security Category** | **Security Feature** | **Status** | **Description** |
154+
|------------------|------------|--------------|-------------|
155+
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
156+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
157+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
158+
| | Private link | Configurable | Establish secure VPC connection |
159+
| | Static IPs | Configurable | Enable fixed IP addresses |
160+
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
161+
| | Bring your own encryption key | Configurable | Implement customer-provided keys |
162+
| | Keystore security | Managed | Automatically protected by Elastic |
163+
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
164+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
165+
166+
:::
167+
168+
:::{tab-item} Serverless
169+
:sync: serverless
170+
171+
| **Security Category** | **Security Feature** | **Status** | **Description** |
172+
|------------------|------------|--------------|-------------|
173+
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
174+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
175+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
176+
| | Private link | N/A | X |
177+
| | Static IPs | Configurable | Enable fixed IP addresses |
178+
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
179+
| | Bring your own encryption key | N/A | X |
180+
| | Keystore security | Managed | Automatically protected by Elastic |
181+
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
182+
| **User Session** | Kibana Sessions | Managed | Automatically configured by Elastic |
183+
184+
:::
185+
186+
:::{tab-item} ECE/ECK
187+
:sync: ece-eck
188+
189+
| **Security Category** | **Security Feature** | **Status** | **Description** |
190+
|------------------|------------|--------------|-------------|
191+
| **Communication** | TLS (HTTP Layer) | Configurable | Configure custom certificates |
192+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
193+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
194+
| | Private link | N/A | X |
195+
| | Static IPs | N/A | X |
196+
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
197+
| | Bring your own encryption key | N/A | X |
198+
| | Keystore security | Configurable | Configure secure settings storage |
199+
| | Saved object encryption | Configurable | Enable encryption for saved objects |
200+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
201+
202+
:::
203+
204+
:::{tab-item} Self-managed
205+
:sync: self-managed
206+
207+
| **Security Category** | **Security Feature** | **Status** | **Description** |
208+
|------------------|------------|--------------|-------------|
209+
| **Communication** | TLS (HTTP Layer) | Self-managed | Implement and maintain certificates |
210+
| | TLS (Transport Layer) | Self-managed | Implement and maintain certificates |
211+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
212+
| | Private link | N/A | X |
213+
| | Static IPs | N/A | X |
214+
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
215+
| | Bring your own encryption key | N/A | X |
216+
| | Keystore security | Configurable | Configure secure settings storage |
217+
| | Saved object encryption | Configurable | Enable encryption for saved objects |
218+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
219+
220+
:::
221+
222+
::::
223+
224+
## Next steps
225+
226+
Refer to the following sections for detailed instructions about securing your hosting environment:
227+
228+
* [Elastic Cloud Hosted and Serverless security setup](/deploy-manage/security/secure-your-elastic-cloud-organization.md)
229+
* [Elastic Cloud Enterprise (ECE) security setup](/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation.md)
230+
* [Elastic Cloud on Kubernetes (ECK) security setup](/deploy-manage/security/secure-your-eck-installation.md)
231+
* [Self-managed cluster security setup](/deploy-manage/security/manually-configure-security-in-self-managed-cluster.md)
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Secure your data
2+
3+
:::{warning}
4+
**This page is a work in progress.**
5+
:::

deploy-manage/security/fips-140-2.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ mapped_urls:
44
- https://www.elastic.co/guide/en/kibana/current/xpack-security-fips-140-2.html
55
---
66

7-
# FIPS 140-2
7+
# FIPS 140-2 compliance
88

99
% What needs to be done: Refine
1010

0 commit comments

Comments
 (0)