Skip to content

Commit 82822e0

Browse files
florent-leborgneleemthompo
authored andcommitted
[D&M] Orchestrator security (#727)
^^ - Refocuses the 1st subsection on "orchestrators" - Left the self-managed section as an outlier and with some notes but I think currently it's the best place to provide a "360" centered on self-managed installs --------- Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
1 parent 40e0bbe commit 82822e0

13 files changed

+76
-79
lines changed

deploy-manage/security.md

+7-6
Original file line numberDiff line numberDiff line change
@@ -100,18 +100,19 @@ The availability and configurability of security features vary by deployment typ
100100

101101
The documentation is organized into four main areas.
102102

103-
:::{note}
104-
Throughout the documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
105-
:::
103+
On every page, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
106104

107-
### 1. Secure your hosting environment
105+
### 1. Secure your orchestrator
108106

109-
The [security of your hosting environment](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:
107+
The [security of your orchestrator](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:
110108

111109
- [**Elastic Cloud Hosted and Serverless**](security/secure-your-elastic-cloud-organization.md)
112110
- [**Elastic Cloud Enterprise**](security/secure-your-elastic-cloud-enterprise-installation.md)
113111
- [**Elastic Cloud on Kubernetes**](security/secure-your-eck-installation.md)
114-
- [**Self-managed environments**](security/manually-configure-security-in-self-managed-cluster.md)
112+
113+
:::{note}
114+
There is no orchestration layer for self-managed deployments because you directly control the host environment. Refer to [](security/manually-configure-security-in-self-managed-cluster.md) to learn more about securing self-managed installations.
115+
:::
115116

116117
### 2. Secure your deployments and clusters
117118

deploy-manage/security/install-stack-demo-secure.md

+12-6
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
1-
# Tutorial 2: Securing a self-managed {{stack}} [install-stack-demo-secure]
1+
---
2+
applies_to:
3+
deployment:
4+
self: ga
5+
---
26

3-
This tutorial is a follow-on to [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md). The first tutorial describes how to configure a multi-node {{es}} cluster and then set up {{kib}}, followed by {{fleet-server}} and {{agent}}. In a production environment, it’s recommended after completing the {{kib}} setup to proceed directly to this tutorial to configure your SSL certificates. These steps guide you through that process, and then describe how to configure {{fleet-server}} and {{agent}} with the certificates in place.
7+
# Tutorial: Securing a self-managed {{stack}} [install-stack-demo-secure]
8+
9+
This tutorial is a follow-on to [installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md) with a multi-node {{es}} cluster, {{kib}}, {{fleet-server}} and {{agent}}. In a production environment, it’s recommended after completing the {{kib}} setup to proceed directly to this tutorial to configure your SSL certificates. These steps guide you through that process, and then describe how to configure {{fleet-server}} and {{agent}} with the certificates in place.
410

511
**Securing the {{stack}}**
612

7-
Beginning with Elastic 8.0, security is enabled in the {{stack}} by default, meaning that traffic between {{es}} nodes and between {{kib}} and {{es}} is SSL-encrypted. While this is suitable for testing non-production viability of the Elastic platform, most production networks have requirements for the use of trusted CA-signed certificates. These steps demonstrate how to update the out-of-the-box self-signed certificates with your own trusted CA-signed certificates.
13+
Since {{stack}} 8.0, security is enabled by default, meaning that traffic between {{es}} nodes and between {{kib}} and {{es}} is SSL-encrypted. While this is suitable for testing non-production viability of the Elastic platform, most production networks have requirements for the use of trusted CA-signed certificates. These steps demonstrate how to update the out-of-the-box self-signed certificates with your own trusted CA-signed certificates.
814

915
For traffic to be encrypted between {{es}} cluster nodes and between {{kib}} and {{es}}, SSL certificates must be created for the transport ({{es}} inter-node communication) and HTTP (for the {{es}} REST API) layers. Similarly, when setting up {{fleet-server}} you’ll generate and configure a new certificate bundle, and then {{elastic-agent}} uses the generated certificates to communicate with both {{fleet-server}} and {{es}}. The process to set things up is as follows:
1016

@@ -23,7 +29,7 @@ It should take between one and two hours to complete these steps.
2329

2430
## Prerequisites and assumptions [install-stack-demo-secure-prereqs]
2531

26-
Before starting, you’ll need to have set up an on-premises {{es}} cluster with {{kib}}, following the steps in [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
32+
Before starting, you’ll need to have set up an on-premises {{es}} cluster with {{kib}}, following the steps for [installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
2733

2834
The examples in this guide use RPM packages to install the {{stack}} components on hosts running Red Hat Enterprise Linux 8. The steps for other install methods and operating systems are similar, and can be found in the documentation linked from each section.
2935

@@ -227,7 +233,7 @@ Now that communication between {{es}} nodes (the transport layer) has been secur
227233
```
228234

229235
2. When prompted, confirm that the settings are correct.
230-
3. Add the network IP address that clients can use to connect to the first {{es}} node. This is the same value that’s described in Step 2 of [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md), for example `10.128.0.84`:
236+
3. Add the network IP address that clients can use to connect to the first {{es}} node. For example `10.128.0.84`:
231237

232238
```shell
233239
10.128.0.84
@@ -617,7 +623,7 @@ Now that the transport and HTTP layers are configured with encryption using the
617623

618624
Open a web browser to the external IP address of the Kibana host machine: `https://<kibana-host-address>:5601`. Note that the URL should use the `https` and not the `http` protocol.
619625

620-
15. Log in using the `elastic` user and password that you configured in Step 1 of [Tutorial 1: Installing a self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
626+
15. Log in using the `elastic` user and password that you configured when [installing your self-managed {{stack}}](/deploy-manage/deploy/self-managed.md).
621627

622628
Congratulations! You’ve successfully updated the SSL certificates between {{es}} and {{kib}}.
623629

deploy-manage/security/manually-configure-security-in-self-managed-cluster.md

+5-19
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,11 @@ mapped_pages:
99

1010
# Manually configure security in a self-managed cluster [manually-configure-security]
1111

12-
Security needs vary depending on whether you’re developing locally on your laptop or securing all communications in a production environment. Regardless of where you’re deploying the {{stack}} ("ELK"), running a secure cluster is incredibly important to protect your data. That’s why security is [enabled and configured by default](../deploy/self-managed/installing-elasticsearch.md) in {{es}} 8.0 and later.
12+
:::{note}
13+
This page describes important aspects to consider and common end-to-end scenarios for securing your self-managed {{stack}}. For a more granular view of the available security options for your clusters and nodes, refer to [](secure-your-cluster-deployment.md).
14+
:::
15+
16+
Security needs vary depending on whether you’re developing locally on your laptop or securing all communications in a production environment. Regardless of where you’re deploying the {{stack}} ("ELK"), running a secure cluster is incredibly important to protect your data. That’s why security is [enabled and configured by default](../deploy/self-managed/installing-elasticsearch.md) since {{es}} 8.0.
1317

1418
If you want to enable security on an existing, unsecured cluster, use your own Certificate Authority (CA), or would rather manually configure security, the following scenarios provide steps for configuring TLS on the transport layer, plus securing HTTPS traffic if you want it.
1519

@@ -59,24 +63,6 @@ You then configure {{kib}} and Beats to communicate with {{es}} using TLS so tha
5963

6064
[Set up basic security plus HTTPS traffic](secure-http-communications.md)
6165

62-
## Considerations
63-
64-
### TLS certificate management
65-
66-
TLS certificates apply security controls to network communications. They encrypt data in transit, verify the identity of connecting parties, and help prevent man-in-the-middle attacks.
67-
68-
On **self-managed** installations, you manage certificates for both HTTP and transport layers.
69-
70-
### Network security
71-
72-
Control which systems can access your Elastic deployment through traffic filtering and network controls:
73-
74-
- **IP traffic filtering**: Restrict access based on IP addresses or CIDR ranges.
75-
76-
## Next step: secure your deployments and clusters
77-
78-
This section covered security principles and options at the environment level. You can take further measures individually for each deployment or cluster that you're running on this environment. Refer to [](secure-your-cluster-deployment.md).
79-
8066

8167

8268

deploy-manage/security/secure-hosting-environment.md

+6-7
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,18 @@ applies_to:
44
serverless: ga
55
---
66

7-
# Secure your hosting environment
7+
# Secure your orchestrator
88

9-
:::{warning}
10-
**This page is a work in progress.**
11-
:::
12-
13-
Whether you're running Elastic on {{ecloud}}, through an {{ece}} or {{eck}} orchestrator, or self-managed on your own premises, it is critical that you secure the layer responsible for deploying and hosting your Elastic products.
9+
Whether you're running Elastic on {{ecloud}} or using an {{ece}} or {{eck}} orchestrator, it is critical that you secure the layer responsible for deploying and hosting your Elastic products.
1410

1511
This section covers security measures specific to:
1612

1713
- [{{ecloud}}](secure-your-elastic-cloud-organization.md)
1814
- [{{ece}}](secure-your-elastic-cloud-enterprise-installation.md)
1915
- [{{eck}}](secure-your-eck-installation.md)
20-
- [Self-managed](manually-configure-security-in-self-managed-cluster.md)
16+
17+
:::{note}
18+
There is no orchestration layer for self-managed installations, but you can find a summary of your security options in [](manually-configure-security-in-self-managed-cluster.md).
19+
:::
2120

2221
Learn how to manage security certificates, configure TLS versions, and implement additional security controls at the environment level.

deploy-manage/security/secure-your-eck-installation.md

+9-16
Original file line numberDiff line numberDiff line change
@@ -5,26 +5,19 @@ applies_to:
55
eck: ga
66
---
77

8-
# Secure your {{eck}} installation [eck-securing-considerations]
8+
# Secure your {{eck}} orchestrator [eck-securing-considerations]
99

10-
:::{warning}
11-
**This page is a work in progress.**
12-
:::
10+
This section covers security settings for your {{eck}} orchestrator.
1311

12+
**Orchestrator-level security**
1413

15-
## TLS certificate management
14+
- [Restrict cross-namespace resources associations](/deploy-manage/deploy/cloud-on-k8s/restrict-cross-namespace-resource-associations.md)
15+
- [Isolate pods with network policies](/deploy-manage/deploy/cloud-on-k8s/network-policies.md)
16+
- [Secure the metrics endpoint](/deploy-manage/monitor/orchestrators/k8s-securing-metrics-endpoint.md)
1617

17-
TLS certificates apply security controls to network communications. They encrypt data in transit, verify the identity of connecting parties, and help prevent man-in-the-middle attacks.
18+
Also refer to [](/deploy-manage/deploy/cloud-on-k8s/configure.md) for more information about configuring {{eck}}.
1819

19-
With **{{eck}}**, you manage HTTP layer certificates. The transport layer is managed by ECK.
20+
**Additional deployment-level security settings**
2021

21-
## Network security
22-
23-
Control which systems can access your Elastic deployment through traffic filtering and network controls:
24-
25-
- **IP traffic filtering**: Restrict access based on IP addresses or CIDR ranges.
26-
27-
## Next step: secure your deployments and clusters
28-
29-
This section covered security principles and options at the environment level. You can take further measures individually for each deployment or cluster that you're running on this environment. Refer to [](secure-your-cluster-deployment.md).
22+
Additional security settings are available for you to configure individually for each deployment orchestrated using {{eck}}. Refer to [](secure-your-cluster-deployment.md) for more information.
3023

deploy-manage/security/secure-your-elastic-cloud-enterprise-installation.md

+15-16
Original file line numberDiff line numberDiff line change
@@ -7,23 +7,25 @@ mapped_pages:
77
- https://www.elastic.co/guide/en/cloud-enterprise/current/ece-securing-considerations.html
88
---
99

10-
# Secure your Elastic Cloud Enterprise installation [ece-securing-considerations]
10+
# Secure your Elastic Cloud Enterprise orchestrator [ece-securing-considerations]
1111

12-
:::{warning}
13-
**This page is a work in progress.**
14-
:::
12+
This section covers security settings for your {{ece}} orchestrator.
1513

14+
**Orchestrator-level security**
1615

17-
When securing your {{ece}} installation, consider the following:
16+
- [**TLS certificates**](secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md): Apply security controls to network communications. With {{ece}}, you manage proxy certificates for the HTTP layer. The transport layer is managed by ECE.
17+
- [**Platform role-based access control**](/deploy-manage/users-roles/cloud-enterprise-orchestrator.md): Define the roles of users who have access to your organization and its resources. Note that you can also [manage non-cloud users and roles](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md).
18+
- [**Authentication providers**](/deploy-manage/users-roles/cloud-enterprise-orchestrator.md): Integrate with external authentication providers, including Active Directory, LDAP, and SAML.
1819

19-
## TLS certificate management
2020

21-
TLS certificates apply security controls to network communications. They encrypt data in transit, verify the identity of connecting parties, and help prevent man-in-the-middle attacks.
21+
**Additional deployment-level security settings**
2222

23-
With {{ece}}, you manage proxy certificates for the HTTP layer. The transport layer is managed by ECE. Refer to [](secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md).
23+
Additional security settings are available for you to configure individually for each deployment orchestrated using {{ece}}. Refer to [](secure-your-cluster-deployment.md) for more information.
2424

2525

26-
## Users with admin privileges [ece_users_with_admin_privileges]
26+
## Notes about {{ece}} security
27+
28+
### Users with admin privileges [ece_users_with_admin_privileges]
2729

2830
In Elastic Cloud Enterprise, every user who can manage your installation through the Cloud UI or the RESTful API is a user with admin privileges. This includes both the `admin` user and the `readonly` user that get created when you install ECE on your first host. Initially, only the `admin` user has the required privileges to make changes to resources on ECE.
2931

@@ -32,7 +34,7 @@ In Elastic Cloud Enterprise, every user who can manage your installation through
3234
All Elasticsearch clusters come with X-Pack security features and support role-based access control. To learn more, check [Secure Your Clusters](../users-roles/cluster-or-deployment-auth.md).
3335

3436

35-
## Encryption [ece_encryption]
37+
### Encryption [ece_encryption]
3638

3739
Elastic Cloud Enterprise does not implement encryption at rest out of the box. To ensure encryption at rest for all data managed by Elastic Cloud Enterprise, the hosts running Elastic Cloud Enterprise must be configured with disk-level encryption, such as dm-crypt. In addition, snapshot targets must ensure that data is encrypted at rest as well.
3840

@@ -43,7 +45,7 @@ Elastic Cloud Enterprise provides full encryption of all network traffic by defa
4345
TLS is supported when interacting with the [RESTful API of Elastic Cloud Enterprise](https://www.elastic.co/docs/api/doc/cloud-enterprise/) and for the proxy layer that routes user requests to clusters of all versions. Internally, our administrative services also ensure transport-level encryption.
4446

4547

46-
## Attack vectors versus separation of roles [ece-securing-vectors]
48+
### Attack vectors versus separation of roles [ece-securing-vectors]
4749

4850
As covered in [Separation of Roles](../deploy/cloud-enterprise/ece-roles.md), it is important to not mix certain roles in a production environment.
4951

@@ -53,13 +55,10 @@ Elastic Cloud Enterprise is designed to ensure that an allocator has access only
5355

5456
Security comes in layers, and running separate services on separate infrastructure is the last layer of defense, on top of other security features like the JVM security manager, system call filtering, and running nodes in isolated containers with no shared secrets.
5557

56-
## Hardware isolation
58+
59+
### Hardware isolation
5760
$$$ece_clusters_share_the_same_resources$$$
5861

5962
The Elasticsearch clusters you create on Elastic Cloud Enterprise share the same resources. It is currently not possible to run a specific cluster on entirely dedicated hardware not shared by other clusters.
6063

6164

62-
## Next step: secure your deployments and clusters
63-
64-
This section covered security principles and options at the environment level. You can take further measures individually for each deployment or cluster that you're running on this environment. Refer to [](secure-your-cluster-deployment.md).
65-

deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/allow-x509-certificates-signed-with-sha-1.md

+3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
---
2+
applies_to:
3+
deployment:
4+
ece: ga
25
mapped_pages:
36
- https://www.elastic.co/guide/en/cloud-enterprise/current/ece-allow-x509-sha1.html
47
---

deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/configure-tls-version.md

+3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
---
2+
applies_to:
3+
deployment:
4+
ece: ga
25
mapped_pages:
36
- https://www.elastic.co/guide/en/cloud-enterprise/current/ece-configure-tls-version.html
47
---

deploy-manage/security/secure-your-elastic-cloud-enterprise-installation/manage-security-certificates.md

+3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
---
2+
applies_to:
3+
deployment:
4+
ece: ga
25
mapped_pages:
36
- https://www.elastic.co/guide/en/cloud-enterprise/current/ece-manage-certificates.html
47
---

deploy-manage/security/secure-your-elastic-cloud-organization.md

+3-8
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,9 @@ As a managed service, Elastic automatically handles a [number of security featur
2222

2323
To reinforce the security of your organization, consider implementing the following measures:
2424

25-
- **Network security**. Control which systems can access your Elastic deployments and projects through traffic filtering and network controls:
26-
- [**IP traffic filtering**](/deploy-manage/security/ip-traffic-filtering.md): Restrict access based on IP addresses or CIDR ranges.
27-
- [**Private link filters**](/deploy-manage/security/private-link-traffic-filters.md): Secure connectivity through AWS PrivateLink, Azure Private Link, or GCP Private Service Connect.
28-
- [**Static IPs**](/deploy-manage/security/elastic-cloud-static-ips.md): Use static IP addresses for predictable firewall rules.
29-
- **Access control**
30-
- [**Organization-level SSO**](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md). Note that for {{ech}} deployments, you can also configure SSO at the [deployment level](/deploy-manage/users-roles/cluster-or-deployment-auth.md).
31-
- [**Cloud role-based access control**](/deploy-manage/users-roles/cloud-organization/manage-users.md): Define the roles of users who have access to your organization and its resources. Note that for {{ech}} deployments, you can also [manage non-cloud users and roles](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md).
32-
- [**Cloud API keys**](/deploy-manage/api-keys/elastic-cloud-api-keys.md): Manage API keys used for programmatic access to [{{ecloud}}](https://www.elastic.co/docs/api/doc/cloud/) and [{{ecloud}} serverless](https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/) APIs.
25+
- [**Organization-level SSO**](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md). Note that for {{ech}} deployments, you can also configure SSO at the [deployment level](/deploy-manage/users-roles/cluster-or-deployment-auth.md).
26+
- [**Cloud role-based access control**](/deploy-manage/users-roles/cloud-organization/manage-users.md): Define the roles of users who have access to your organization and its resources. Note that for {{ech}} deployments, you can also [manage non-cloud users and roles](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md).
27+
- [**Cloud API keys**](/deploy-manage/api-keys/elastic-cloud-api-keys.md): Manage API keys used for programmatic access to [{{ecloud}}](https://www.elastic.co/docs/api/doc/cloud/) and [{{ecloud}} serverless](https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/) APIs.
3328

3429

3530

0 commit comments

Comments
 (0)