Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can monitoring.ui.elasticsearch.* credentials be deprecated #129114

Open
klacabane opened this issue Mar 31, 2022 · 2 comments
Open

Can monitoring.ui.elasticsearch.* credentials be deprecated #129114

klacabane opened this issue Mar 31, 2022 · 2 comments

Comments

@klacabane
Copy link
Contributor

klacabane commented Mar 31, 2022

Summary

Stack monitoring settings allows one to specify a monitoring cluster in monitoring.ui.elasticsearch.hosts configuration as a source to populate the views. To load the monitoring data remotely in Stack Monitoring we require that the same username/password pair authenticated in the local kibana exists in the monitoring one.

The monitoring cluster settings under monitoring.ui.elasticsearch.* also require credentials to poll the remote cluster license and collect telemetry but these are not critical since the UI loads even with wrong credentials provided[1].
They could also be used to run ccs queries/alerts: #93432

We should verify that these credentials are still required to power any functionality:

  • if they are required we should check whether the authenticated user has enough permissions to be a drop-in replacement
  • if not we should get rid of these settings and any code that rely on them

[1]

[2022-03-31T18:45:42.043+02:00][WARN ][plugins.licensing] License information could not be obtained from Elasticsearch due to ResponseError: security_exception: [security_exception] Reason: unable to authenticate user [foobar] for REST request [/_xpack] error
@klacabane klacabane added Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services Feature:Stack Monitoring labels Mar 31, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

@klacabane klacabane changed the title Can monitoring.ui.elasticsearch.(username|password|serviceAccountToken) be deprecated Can monitoring.ui.elasticsearch.* credentials be deprecated Mar 31, 2022
@matschaffer
Copy link
Contributor

matschaffer commented Apr 4, 2022

Just a gut feel, but I think CCS eliminates most of the need for this configuration. So +1 on deprecating it.

My guess is it was created prior to CCS as a way to access both prod & monitoring data without requiring an additional kibana instance.

Granted just removing it and requiring CCS to get set up would definitely qualify as a breaking change for any user leveraging the config option.

@smith smith added Team:Monitoring Stack Monitoring team and removed Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services labels Nov 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants