[Website]: remote clusters (ECH to ECE): The described process doesn't fit with the purpose of the manual

[JulGor-elastic]

Type of issue

None

What documentation page is affected

https://www.elastic.co/docs/deploy-manage/remote-clusters/ec-remote-cluster-ece#ec_connect_to_the_remote_cluster_3

What happened?

This link should be describing how to setup CCS from a ECH deployment to an ECE deployment.

There are parts of the process that do not look correct:

• Reading the option authentication with "API key", it is explained how to setup the CA of the remote cluster, that it should not be required with this type of connection
• In the section "Connect to the remote cluster" / "Using Kibana", it is explained how to setup the remote cluster to the ECH cluster, but the ECH cluster in this page should be the ECE deployment, not the ECH one.

I did not check the rest of the documentation, but there might be other issue.

Additional info

No response

[eedugon]

hi @JulGor-elastic !

I ack the Kibana issue, thanks a lot for highlighting it.

^^ That's definitely incorrect. I'll fix it soon as I'm already working on some changes to the remote clusters documentation.

For the other issue I think the doc is correct. Let me try to clarify with technical details and explanations, and please let me know if you believe this isn't accurate.

This link should be describing how to setup CCS from a ECH deployment to an ECE deployment.

Correct: ECH deployment is the client / local cluster, and ECE is the remote cluster (the server listening in port 9443 for API key based auth).

Reading the option authentication with "API key", it is explained how to setup the CA of the remote cluster, that it should not be required with this type of connection

It is required, let me explain:

With API Key based authentication, the client connects to the remote SSL endpoint with the API Key, and it must trust the server certificate presented by the remote server.

In this case the remote cluster is ECE, so the client (ECH) will need to know the CA certificate of the ECE cluster. This is only needed if ECE proxies use private certificates. If they use publicly trusted certificates then there's no need to add the CA of ECE proxies into the ECH deployment security area. I think that's properly described and presented both in the docs and in the Cloud UIs:

It's true that with this method there's not mTLS, but the client still needs to trust the server certificate.
With this method, the server (ECE) won't need the CA of the client (ECH) if that's what you meant. But ECH will need the CA cert of the ECE environment for the connection to succeed.

I did not check the rest of the documentation, but there might be other issue.

I'm currently working with remote cluster docs and I've tested the majority of use cases, if you have any other issue I'll be happy to review it.

Thanks again!

[eedugon]

I've created #3252 to solve this issue.

For

I did not check the rest of the documentation, but there might be other issue
We are already analyzing the rest of the documentation so we will ignore that comment in this issue.

The other issue mentioned here hasn't been ACK (the CA of the remote is required in the documented use cases). If I'm proved wrong I have no issues on reopening and fixing whatever is needed.