Skip to content

Commit

Permalink
Enroll proxy settings (#26514)
Browse files Browse the repository at this point in the history 
(cherry picked from commit 26325b0)

# Conflicts:
#	x-pack/elastic-agent/pkg/agent/cmd/enroll_cmd.go
  • Loading branch information
Steffen Siering authored and mergify-bot committed Jun 30, 2021
1 parent 46e0064 commit b7b9eda
Show file tree
Hide file tree
Showing 4 changed files with 117 additions and 20 deletions.
2 changes: 2 additions & 0 deletions x-pack/elastic-agent/CHANGELOG.next.asciidoc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -116,5 +116,7 @@
- Use `filestream` input for internal log collection. {pull}25660[25660]
- Enable agent to send custom headers to kibana/ES {pull}26275[26275]
- Set `agent.id` to the Fleet Agent ID in events published from inputs backed by Beats. {issue}21121[21121] {pull}26394[26394] {pull}26548[26548]
- Add proxy support to artifact downloader and communication with fleet server. {pull}25219[25219]
- Add proxy support to enroll command. {pull}26514[26514]
- Enable configuring monitoring namespace {issue}26439[26439]
- Communicate with Fleet Server over HTTP2. {pull}26474[26474]
26 changes: 26 additions & 0 deletions x-pack/elastic-agent/pkg/agent/cmd/enroll.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,9 @@ func addEnrollFlags(cmd *cobra.Command) {
cmd.Flags().StringP("ca-sha256", "p", "", "Comma separated list of certificate authorities hash pins used for certificate verifications")
cmd.Flags().BoolP("insecure", "i", false, "Allow insecure connection to fleet-server")
cmd.Flags().StringP("staging", "", "", "Configures agent to download artifacts from a staging build")
cmd.Flags().StringP("proxy-url", "", "", "Configures the proxy url")
cmd.Flags().BoolP("proxy-disabled", "", false, "Disable proxy support including environment variables")
cmd.Flags().StringSliceP("proxy-header", "", []string{}, "Proxy headers used with CONNECT request")
}

func buildEnrollmentFlags(cmd *cobra.Command, url string, token string) []string {
Expand All @@ -89,6 +92,9 @@ func buildEnrollmentFlags(cmd *cobra.Command, url string, token string) []string
sha256, _ := cmd.Flags().GetString("ca-sha256")
insecure, _ := cmd.Flags().GetBool("insecure")
staging, _ := cmd.Flags().GetString("staging")
fProxyURL, _ := cmd.Flags().GetString("proxy-url")
fProxyDisabled, _ := cmd.Flags().GetBool("proxy-disabled")
fProxyHeaders, _ := cmd.Flags().GetStringSlice("proxy-header")

args := []string{}
if url != "" {
Expand Down Expand Up @@ -155,6 +161,20 @@ func buildEnrollmentFlags(cmd *cobra.Command, url string, token string) []string
args = append(args, "--staging")
args = append(args, staging)
}

if fProxyURL != "" {
args = append(args, "--proxy-url")
args = append(args, fProxyURL)
}
if fProxyDisabled {
args = append(args, "--proxy-disabled")
args = append(args, "true")
}
for k, v := range mapFromEnvList(fProxyHeaders) {
args = append(args, "--proxy-header")
args = append(args, k+"="+v)
}

return args
}

Expand Down Expand Up @@ -228,6 +248,9 @@ func enroll(streams *cli.IOStreams, cmd *cobra.Command, args []string) error {
fCert, _ := cmd.Flags().GetString("fleet-server-cert")
fCertKey, _ := cmd.Flags().GetString("fleet-server-cert-key")
fInsecure, _ := cmd.Flags().GetBool("fleet-server-insecure-http")
fProxyURL, _ := cmd.Flags().GetString("proxy-url")
fProxyDisabled, _ := cmd.Flags().GetBool("proxy-disabled")
fProxyHeaders, _ := cmd.Flags().GetStringSlice("proxy-header")

caStr, _ := cmd.Flags().GetString("certificate-authorities")
CAs := cli.StringToSlice(caStr)
Expand Down Expand Up @@ -257,6 +280,9 @@ func enroll(streams *cli.IOStreams, cmd *cobra.Command, args []string) error {
Insecure: fInsecure,
SpawnAgent: !fromInstall,
Headers: mapFromEnvList(fHeaders),
ProxyURL: fProxyURL,
ProxyDisabled: fProxyDisabled,
ProxyHeaders: mapFromEnvList(fProxyHeaders),
},
}

Expand Down
90 changes: 78 additions & 12 deletions x-pack/elastic-agent/pkg/agent/cmd/enroll_cmd.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,21 @@ import (
"fmt"
"io"
"math/rand"
"net/http"
"net/url"
"os"
"os/exec"
"time"

"gopkg.in/yaml.v2"

"github.com/elastic/beats/v7/libbeat/common"
"github.com/elastic/beats/v7/libbeat/common/backoff"
<<<<<<< HEAD
=======

"github.com/elastic/beats/v7/libbeat/common/transport/httpcommon"
>>>>>>> 26325b01d (Enroll proxy settings (#26514))
"github.com/elastic/beats/v7/libbeat/common/transport/tlscommon"
"github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application"
"github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/filelock"
Expand Down Expand Up @@ -79,6 +87,9 @@ type enrollCmdFleetServerOption struct {
Insecure bool
SpawnAgent bool
Headers map[string]string
ProxyURL string
ProxyDisabled bool
ProxyHeaders map[string]string
}

// enrollCmdOption define all the supported enrollment option.
Expand Down Expand Up @@ -116,6 +127,33 @@ func (e *enrollCmdOption) remoteConfig() (remote.Config, error) {
}
}

<<<<<<< HEAD
=======
cfg.Transport.TLS = &tlsCfg

var proxyURL *url.URL
if e.FleetServer.ProxyURL != "" {
proxyURL, err = common.ParseURL(e.FleetServer.ProxyURL)
if err != nil {
return remote.Config{}, err
}
}

var headers http.Header
if len(e.FleetServer.ProxyHeaders) > 0 {
headers = http.Header{}
for k, v := range e.FleetServer.ProxyHeaders {
headers.Add(k, v)
}
}

cfg.Transport.Proxy = httpcommon.HTTPClientProxySettings{
URL: proxyURL,
Disable: e.FleetServer.ProxyDisabled,
Headers: headers,
}

>>>>>>> 26325b01d (Enroll proxy settings (#26514))
return cfg, nil
}

Expand Down Expand Up @@ -166,15 +204,10 @@ func (c *enrollCmd) Execute(ctx context.Context) error {
return err
}

if c.options.FleetServer.ConnStr != "" {
token, err := c.fleetServerBootstrap(ctx)
if err != nil {
return err
}
if c.options.EnrollAPIKey == "" && token != "" {
c.options.EnrollAPIKey = token
}
}
// localFleetServer indicates that we start our internal fleet server. Agent
// will communicate to the internal fleet server on localhost only.
// Connection setup should disable proxies in that case.
localFleetServer := c.options.FleetServer.ConnStr != ""

c.remoteConfig, err = c.options.remoteConfig()
if err != nil {
Expand All @@ -184,6 +217,20 @@ func (c *enrollCmd) Execute(ctx context.Context) error {
errors.M(errors.MetaKeyURI, c.options.URL))
}

if localFleetServer {
// Ensure that the agent does not use a proxy configuration
// when connecting to the local fleet server.
c.remoteConfig.Transport.Proxy.Disable = true

token, err := c.fleetServerBootstrap(ctx)
if err != nil {
return err
}
if c.options.EnrollAPIKey == "" && token != "" {
c.options.EnrollAPIKey = token
}
}

c.client, err = fleetclient.NewWithConfig(c.log, c.remoteConfig)
if err != nil {
return errors.New(
Expand Down Expand Up @@ -234,7 +281,11 @@ func (c *enrollCmd) fleetServerBootstrap(ctx context.Context) (string, error) {
c.options.FleetServer.PolicyID,
c.options.FleetServer.Host, c.options.FleetServer.Port,
c.options.FleetServer.Cert, c.options.FleetServer.CertKey, c.options.FleetServer.ElasticsearchCA,
c.options.FleetServer.Headers)
c.options.FleetServer.Headers,
c.options.FleetServer.ProxyURL,
c.options.FleetServer.ProxyDisabled,
c.options.FleetServer.ProxyHeaders,
)
if err != nil {
return "", err
}
Expand Down Expand Up @@ -419,13 +470,15 @@ func (c *enrollCmd) enroll(ctx context.Context, persistentConfig map[string]inte
return err
}

if c.options.FleetServer.ConnStr != "" {
localFleetServer := c.options.FleetServer.ConnStr != ""
if localFleetServer {
serverConfig, err := createFleetServerBootstrapConfig(
c.options.FleetServer.ConnStr, c.options.FleetServer.ServiceToken,
c.options.FleetServer.PolicyID,
c.options.FleetServer.Host, c.options.FleetServer.Port,
c.options.FleetServer.Cert, c.options.FleetServer.CertKey, c.options.FleetServer.ElasticsearchCA,
c.options.FleetServer.Headers)
c.options.FleetServer.Headers,
c.options.FleetServer.ProxyURL, c.options.FleetServer.ProxyDisabled, c.options.FleetServer.ProxyHeaders)
if err != nil {
return err
}
Expand Down Expand Up @@ -725,7 +778,12 @@ func createFleetServerBootstrapConfig(
port uint16,
cert, key, esCA string,
headers map[string]string,
proxyURL string,
proxyDisabled bool,
proxyHeaders map[string]string,
) (*configuration.FleetAgentConfig, error) {
localFleetServer := connStr != ""

es, err := configuration.ElasticsearchFromConnStr(connStr, serviceToken)
if err != nil {
return nil, err
Expand All @@ -750,6 +808,10 @@ func createFleetServerBootstrapConfig(
es.Headers[k] = v
}
}
es.ProxyURL = proxyURL
es.ProxyDisabled = proxyDisabled
es.ProxyHeaders = proxyHeaders

cfg := configuration.DefaultFleetAgentConfig()
cfg.Enabled = true
cfg.Server = &configuration.FleetServerConfig{
Expand All @@ -772,6 +834,10 @@ func createFleetServerBootstrapConfig(
}
}

if localFleetServer {
cfg.Client.Transport.Proxy.Disable = true
}

if err := cfg.Valid(); err != nil {
return nil, errors.New(err, "invalid enrollment options", errors.TypeConfig)
}
Expand Down
19 changes: 11 additions & 8 deletions x-pack/elastic-agent/pkg/agent/configuration/fleet_server.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,17 @@ type FleetServerOutputConfig struct {

// Elasticsearch is the configuration for elasticsearch.
type Elasticsearch struct {
Protocol string `config:"protocol" yaml:"protocol"`
Hosts []string `config:"hosts" yaml:"hosts"`
Path string `config:"path" yaml:"path,omitempty"`
Username string `config:"username" yaml:"username,omitempty"`
Password string `config:"password" yaml:"password,omitempty"`
ServiceToken string `config:"service_token" yaml:"service_token,omitempty"`
TLS *tlscommon.Config `config:"ssl" yaml:"ssl,omitempty"`
Headers map[string]string `config:"headers" yaml:"headers,omitempty"`
Protocol string `config:"protocol" yaml:"protocol"`
Hosts []string `config:"hosts" yaml:"hosts"`
Path string `config:"path" yaml:"path,omitempty"`
Username string `config:"username" yaml:"username,omitempty"`
Password string `config:"password" yaml:"password,omitempty"`
ServiceToken string `config:"service_token" yaml:"service_token,omitempty"`
TLS *tlscommon.Config `config:"ssl" yaml:"ssl,omitempty"`
Headers map[string]string `config:"headers" yaml:"headers,omitempty"`
ProxyURL string `config:"proxy_url" yaml:"proxy_url,omitempty"`
ProxyDisabled bool `config:"proxy_disabled" yaml:"proxy_disabled"`
ProxyHeaders map[string]string `config:"proxy_headers" yaml:"proxy_headers"`
}

// ElasticsearchFromConnStr returns an Elasticsearch configuration from the connection string.
Expand Down

0 comments on commit b7b9eda

Please sign in to comment.