Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Meta] Enhance input Health reporting from agent to better convey issues related to installation of unprivileged agent #39604

Closed
6 tasks done
nimarezainia opened this issue May 16, 2024 · 10 comments
Labels
Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Comments

@nimarezainia
Copy link
Contributor

nimarezainia commented May 16, 2024

If the agent is provisioned in the unprivileged mode there may be data sources which won't be readable by the agent, as they require higher privilege to be accessed. This will cause the agent to go into a degraded state and show the integration as unhealthy.

Since the agent knows that it is running in an unprivileged mode AND can recognize that there's an issue with reading the input, it would be great to have this information propagated back to Fleet. Ideally the user has enough information to know that their input is unhealthy due to the fact that agent is in unprivileged mode.

Filebeat health reporting implementation: #39209

Tasks

  1. Team:Elastic-Agent-Data-Plane
    VihasMakwana
  2. Team:Elastic-Agent-Data-Plane
    VihasMakwana
  3. Team:Elastic-Agent-Data-Plane
    VihasMakwana
  4. Team:Elastic-Agent-Data-Plane
    VihasMakwana
  5. Team:Elastic-Agent-Data-Plane
    VihasMakwana
  6. Team:Elastic-Agent Team:Elastic-Agent-Data-Plane
    fearful-symmetry
@blakerouse
Copy link
Contributor

This should probably be filed more as a meta issue, with a list of beats or inputs that have actually implemented proper health reporting back to the Elastic Agent. The Elastic Agent itself already has all the mechanisms for this to be a great experience.

  1. Runtime protections that allow an input to define that it cannot be ran unless it is root or even non-root. This prevents the input from running and the reason why is reported and propagated back to Fleet Server.
  2. Health reporting of an individual input back to Elastic Agent that is then propagated back to Fleet Server. The issue her is that most inputs do not do that at all.

In quick summation, adding health reporting at the input level will provide this information.

@cmacknz
Copy link
Member

cmacknz commented May 16, 2024

Yes this is more of a Beats/input issue. We may want agent to explicitly tell inputs when agent is running as unprivileged so that they do not have to duplicate the detection logic.

@ycombinator
Copy link
Contributor

Transferring to Beats repo per discussion in the issue.

@ycombinator ycombinator transferred this issue from elastic/elastic-agent May 16, 2024
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 16, 2024
@ycombinator ycombinator added the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label May 16, 2024
@elasticmachine
Copy link
Collaborator

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label May 16, 2024
@ycombinator
Copy link
Contributor

We may want agent to explicitly tell inputs when agent is running as unprivileged so that they do not have to duplicate the detection logic.

@blakerouse @cmacknz Is this being done already? Or do we need a separate issue to track this as an enhancement that this issue here would then depend on?

@cmacknz
Copy link
Member

cmacknz commented May 16, 2024

I had tacked it on to elastic/elastic-agent#4683 which is needed to support the user agent changes we want as well.

@cmacknz cmacknz changed the title [Elastic Agent] Enhance input Health reporting from agent to better convey issues related to installation of unprivileged agent [Meta] Enhance input Health reporting from agent to better convey issues related to installation of unprivileged agent May 24, 2024
@cmacknz
Copy link
Member

cmacknz commented May 24, 2024

I have updated this to be a meta issue and added a task list to update the inputs that our team owns or are part of the system integration.

CC @pierrehilbert as all of these are work for the data plane team.

@nimarezainia
Copy link
Contributor Author

nimarezainia commented May 27, 2024

Ideally we would have this done in sp30 and sp31 so that we have the desired Fleet user exp, especially on the System Integration. If system was not installed by default I would say we could delay these for the follow on release. But as it stands All users, installing in `unprivilege mode will hit this issue.

@pierrehilbert is it possible to get #39736 and #39737 completed in sp30/sp31 so we keep our Q2 deliverable?

@jlind23
Copy link
Collaborator

jlind23 commented Aug 21, 2024

@pierrehilbert @nimarezainia all subtasks are done, shall we consider this issue as completer?

@pierrehilbert
Copy link
Collaborator

I'm in favor of closing it: remaining work is not related to Unprivileged as it is to fix issues we are now reporting and causing some inputs to be degraded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team
Projects
None yet
Development

No branches or pull requests

7 participants