Merge branch 'main' into 2404-air-gapped-env-Security-AI

Author: benironside

deploy-manage/tools/snapshot-and-restore/ec-azure-snapshotting.md

@@ -19,26 +19,7 @@ Configure a custom snapshot repository using your Azure Blob storage account.
 Follow the Microsoft documentation to [set up an Azure storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-create) with an access key, and then [create a container](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal).
 
 
-## Enable the `repository-azure` plugin in {{stack}} 7.17 and earlier [ec-enable-azure-plugin]
-
-For deployments with **{{stack}} version 7.17 and earlier**, you’ll need to enable the `repository-azure` plugin to use the Azure repository type. On the Azure platform, the plugin is enabled by default. If your deployment is on AWS or GCP, follow these steps to enable the `repository-azure` plugin:
-
-1. Refer to [Azure Repository Plugin](https://www.elastic.co/guide/en/elasticsearch/plugins/7.17/repository-azure.html) to download the version of the plugin that matches your {{stack}} version.
-2. Upload the plugin to your deployment:
-
-    1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body).
-    2. From your deployment, select **Manage**.
-    3. From the lower navigation menu, select **Extensions** and then select **Upload extension**.
-    4. Specify the plugin name (`repository-azure`) and version.
-    5. Select **An installable plugin (compiled, no source code)**.
-    6. Select **Create extension**.
-    7. Navigate back to the **Extensions** page.
-    8. Select the extension name.
-    9. Drag and drop to upload the `repository-azure` plugin zip file.
-
-
-
-### Configure the keystore [ec-configure-azure-keystore]
+## Configure the keystore [ec-configure-azure-keystore]
 
 Create an entry for the Azure client in the {{es}} keystore:
 
@@ -52,8 +33,7 @@ Create an entry for the Azure client in the {{es}} keystore:
 
 5. Select **Save**.
 
-
-### Create the repository [ec-create-azure-repository]
+## Create the repository [ec-create-azure-repository]
 
 1. Open {{kib}} and go to **Management** > **Snapshot and Restore**.
 2. On the **Repositories** tab, select **Register a repository**.

deploy-manage/tools/snapshot-and-restore/ec-gcs-snapshotting.md

@@ -32,26 +32,7 @@ For more detailed information on the JSON account service key, refer to [Using a
 Follow the Google Cloud Storage documentation to [create a GCS bucket](https://cloud.google.com/storage/docs/creating-buckets).
 
 
-## Enable the `repository-gcs` plugin in {{stack}} 7.17 and earlier [ec-enable-gcs-plugin]
-
-For deployments with **{{stack}} version 7.17 and earlier**, you’ll need to enable the `repository-gcs` plugin to use the Google Cloud Storage repository type. On Google Cloud Platform, the plugin is enabled by default. If your deployment is on AWS or Azure, follow these steps to enable the `repository-gcs` plugin:
-
-1. Refer to [Google Cloud Storage Repository Plugin](https://www.elastic.co/guide/en/elasticsearch/plugins/7.17/repository-gcs.html) to download the version of the plugin that matches your {{stack}} version.
-2. Upload the plugin to your deployment:
-
-    1. Log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body).
-    2. From your deployment, select **Manage**.
-    3. From the lower navigation menu, select **Extensions** and then select **Upload extension**.
-    4. Specify the plugin name (`repository-gcs`) and version.
-    5. Select **An installable plugin (compiled, no source code)**.
-    6. Select **Create extension**.
-    7. Navigate back to the **Extensions** page.
-    8. Select the extension name.
-    9. Drag and drop to upload the `repository-gcs` plugin zip file.
-
-
-
-### Configure the keystore [ec-configure-gcs-keystore]
+## Configure the keystore [ec-configure-gcs-keystore]
 
 Create an entry for the GCS client in the {{es}} keystore:
 
@@ -62,8 +43,7 @@ Create an entry for the GCS client in the {{es}} keystore:
 5. With **Type** set to **JSON block / file**, add your [GCS service account key JSON file](#ec-gcs-service-account-key).
 6. Select **Save**.
 
-
-### Create the repository [ec-create-gcs-repository]
+## Create the repository [ec-create-gcs-repository]
 
 1. Open {{kib}} and go to **Management** > **Snapshot and Restore**.
 2. On the **Repositories** tab, select **Register a repository**.

reference/fleet/images/manage-agents-global-fleet.png

@@ -1,48 +1,45 @@
 ---
-navigation_title: Manage {{agent}}s in {{fleet}}
+navigation_title: Manage {{agents}} in {{fleet}}
 mapped_pages:
   - https://www.elastic.co/guide/en/fleet/current/manage-agents-in-fleet.html
 products:
   - id: fleet
   - id: elastic-agent
 ---
 
-# Centrally manage {{agent}}s in {{fleet}} [manage-agents-in-fleet]
+# Centrally manage {{agents}} in {{fleet}} [manage-agents-in-fleet]
 
-
-::::{admonition}
 The {{fleet}} app in {{kib}} supports both {{agent}} infrastructure management and agent policy management. You can use {{fleet}} to:
 
-* Manage {{agent}} binaries and specify settings installed on the host that determine whether the {{agent}} is enrolled in {{fleet}}, what version of the agent is running, and which agent policy is used.
-* Manage agent policies that specify agent configuration settings, which integrations are running, whether agent monitoring is turned on, input settings, and so on.
+- Manage {{agent}} binaries and specify settings installed on the host that determine whether the agent is enrolled in {{fleet}}, what version of the agent is running, and which agent policy is used.
+- Manage agent policies that specify agent configuration settings, which integrations are running, whether agent monitoring is turned on, input settings, and more.
 
 Advanced users who don’t want to use {{fleet}} for central management can use an external infrastructure management solution and [install {{agent}} in standalone mode](/reference/fleet/install-standalone-elastic-agent.md) instead.
 
-::::
-
-
 ::::{important}
 {{fleet}} currently requires a {{kib}} user with `All` privileges on {{fleet}} and {{integrations}}. Since many Integrations assets are shared across spaces, users need the {{kib}} privileges in all spaces. Refer to [Required roles and privileges](/reference/fleet/fleet-roles-privileges.md) to learn how to create a user role with the required privileges to access {{fleet}} and {{integrations}}.
-
 ::::
 
+To learn how to add {{agents}} to {{fleet}}, refer to [Install {{fleet}}-managed {{agents}}](/reference/fleet/install-fleet-managed-elastic-agent.md).
 
-To learn how to add {{agent}}s to {{fleet}}, refer to [Install {{fleet}}-managed {{agent}}s](/reference/fleet/install-fleet-managed-elastic-agent.md).
-
-To use {{fleet}} go to **Management > {{fleet}}** in {{kib}}. The following table describes the main management actions you can perform in {{fleet}}:
+Find **{{fleet}}** in the {{kib}} navigation menu, or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). The following table describes the main management actions you can perform in {{fleet}}:
 
 | Component | Management actions |
 | --- | --- |
-| [{{fleet}} settings](/reference/fleet/fleet-settings.md) | Configure global settings available to all {{agent}}s managed by {{fleet}},including {{fleet-server}} hosts and output settings. |
-| [{{agent}}s](/reference/fleet/manage-agents.md) | Enroll, unenroll, upgrade, add tags, and view {{agent}} status and logs. |
+| [{{fleet}} settings](/reference/fleet/fleet-settings.md) | Configure global settings available to all {{agents}} managed by {{fleet}}, including {{fleet-server}} hosts and output settings. |
+| [{{agents}}](/reference/fleet/manage-agents.md) | Enroll, unenroll, upgrade, add tags, and view {{agent}} status and logs. |
 | [Policies](/reference/fleet/agent-policy.md) | Create and edit agent policies and add integrations to them. |
 | [{{fleet}} enrollment tokens](/reference/fleet/fleet-enrollment-tokens.md) | Create and revoke enrollment tokens. |
 | [Uninstall tokens](/solutions/security/configure-elastic-defend/prevent-elastic-agent-uninstallation.md) | ({{elastic-defend}} integration only) Access tokens to allow uninstalling {{agent}} from endpoints with Agent tamper protection enabled. |
 | [Data streams](/reference/fleet/data-streams.md) | View data streams and navigate to dashboards to analyze your data. |
 
+## Global {{fleet}} management
 
+In {{fleet}} deployments where {{agents}} are installed in diverse locations and where data must be stored in local clusters, operators need a unified view of all agents and a central management interface for tasks like upgrades, policy organization, and metrics collection. {{fleet}} offers features to facilitate this deployment model:
 
+- [Remote {{es}} output](/reference/fleet/remote-elasticsearch-output.md): Configure {{agents}} to send data to remote {{es}} clusters while still sending their check-in payloads to the management cluster. This allows {{fleet}} on the management cluster to maintain a global view of all agents while the ingested data is routed to the agents' respective local clusters.
+- [Automatic integrations synchronization](/reference/fleet/automatic-integrations-synchronization.md) {applies_to}`stack: ga 9.1.0`: Install an integration once in the management cluster and use {{fleet}} to synchronize and update the integration across all remote clusters. This enables you to initiate services like [OSquery](integration-docs://reference/osquery-intro.md) from the management cluster, and to collect and display responses from dispersed agents in {{fleet}} on the central management cluster.
 
-
-
-
+:::{image} images/manage-agents-global-fleet.png
+:alt: A diagram showing Elastic Agents connected to remote data clusters and to a Fleet management cluster
+:::

reference/fleet/manage-elastic-agents-in-fleet.md

@@ -101,6 +101,7 @@ You can do rolling upgrades to avoid exhausting network resources when updating
 
 5. Upgrade the agents.
 
+Note that agents in a rollout period have the status `Updating` until the upgrade is complete, even if the upgrade has not started yet.
 
 ## Schedule an upgrade [schedule-agent-upgrade]
 
@@ -245,7 +246,9 @@ To configure an automatic rollout of a new minor or patch version to a percentag
 7. You can then add a different target version, and specify the percentage of agents you want to be upgraded to that version. The total percentage of agents to be upgraded cannot exceed 100%.
 8. Click **Save**.
 
-Once the configuration is saved, an asynchronous task runs every 30 minutes, gradually upgrading the agents in the policy to the specified target version.
+Once the configuration is saved, an asynchronous task runs every 30 minutes, upgrading the agents in the policy to the specified target version.
+
+If the number of agents to be upgraded is greater than or equal to 10, a rollout period is automatically applied. The rollout duration is either 10 minutes or `nAgents * 0.03` seconds, whichever is greater.
 
 In case of any failed upgrades, the upgrades are retried with exponential backoff mechanism until the upgrade is successful, or the maximum number of retries is reached. Note that the maximum number of retries is the number of [configured retry delays](#auto-upgrade-settings).