Add documentation to cover the container flow.

[merlixelastic]

Description

We discovered a scenario where deploying Elastic agent with Fleet server integration need to have certificate to connect to Kibana.
This is setup apparently with variable KIBANA_CA or KIBANA_FLEET_CA.
I believe the code (reference in resources below) is related to the installation of Elastic agent with Fleet server on Kubernetes or docker.

Resources

The code related to this is here

I'm not seeing mention of setting up certificate between Elastic agent to Kibana in our documentation here and there.

This was discovered when we investigated error:
Kibana fetch policy failed: http GET request to https://kibana-multi:5601/api/fleet/agent_policies fails: fail to execute the HTTP GET request: Get "https://kibana-multi:5601/api/fleet/agent_policies": x509: certificate signed by unknown authority.

Collaboration

TBD. The docs and product team will work together to determine the best path forward.

Point of contact.

Main contact: @merlixelastic

Stakeholders: @lucabelluccini

[lucabelluccini]

This item has been discussed on 3rd June with Julien & Pierre

[lucabelluccini]

Notable points:

• We do not cover at all the use case of deploying Fleet Server on plain Kubernetes in our docs at https://www.elastic.co/guide/en/fleet/current/fleet-deployment-models.html
  • Not exactly the same, but we do not link deploying Fleet Servers on ECK, which exists at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet.html
• The page https://www.elastic.co/guide/en/fleet/current/add-fleet-server-mixed.html#default-port-assignments-mixed at least to my analysis shows wrong "data flows". Elastic Agents for example reach out Fleet Server (enroll, checkin, management), the outputs (e.g. Elasticsearch or Logstash), but never Kibana. Also what Elastic Agent → Fleet mean?
• It seems in some flows, Fleet Servers on containerized environments need to reach Kibana, while it isn't necessary on normal installations.

[kilfoyle]

Thanks for reporting this @merlixelastic and for the clarifications @lucabelluccini.

So I think we need to:

• 1. Update the Deployment models page to cover the steps for setting up Fleet Server on Kubernetes.

• 2. Mention on that same page that managed Elastic Agent can be set up in ECK, with a link to the relevant docs.
  -> Opened docs PR: Add ECK deployment type with link to docs #1176

• 3. Update the default port assignments. It seems the only change needed is to remove the "Elastic Agent -> Fleet" entry.
  -> Opened docs PR: Remove "Elastic Agent to Fleet" default port assignments #1177

@michel-laterman could you perhaps provide the steps for number 1? I have no idea about the K8s setup at all, so if you don't mind putting something in a draft document I'd be happy to port that into the Deployment models page.

@nimarezainia just for your awareness.

[kilfoyle]

Regarding requirement 1, @nimarezainia and I discussed this and are thinking that we can update the Elastic Agent install instruction pages for Kubernetes and for Docker, to add the additional settings required to run agent as a Fleet Server. I've opened a PR with the proposed changes: #1184

@michel-laterman I'm guessing a bit at what I think the settings are so please take a look and let us know if anything needs fixing. We would still need to document setting up certificates between Elastic Agent and Kibana, which I guess would best fit in Configure SSL/TLS for self-managed Fleet Servers.

[michel-laterman]

We have documentation for container env vars that fleet-server uses during bootstrapping; however these are under the elastic-agent install instructions: https://www.elastic.co/guide/en/fleet/current/agent-environment-variables.html#env-prepare-kibana-for-fleet

I think we can re-organize some pages to make it more clear that we expect an end user to only deploy a fleet-server as an agent component and better utilize the agent installation instructions.

Additionally we should go over the env vars, i'm not certain if KIBANA_FLEET_SETUP still applies to agents in containers anymore