Skip to content

Latest commit

 

History

History
636 lines (442 loc) · 20.3 KB

release-notes-8.10.asciidoc

File metadata and controls

636 lines (442 loc) · 20.3 KB

Release notes

This section summarizes the changes in each release.

Also see:

  • {kibana-ref}/release-notes.html[{kib} release notes]

  • {beats-ref}/release-notes.html[{beats} release notes]

{fleet} and {agent} 8.10.4

Review important information about the {fleet} and {agent} 8.10.4 release.

Breaking changes

Breaking changes can prevent your application from optimal operation and performance. Before you upgrade, review the breaking changes, then mitigate the impact to your application.

elastic-agent
elastic-agent-autodiscover library has been updated to version 0.6.4, disabling metadata For kubernetes.deployment and kubernetes.cronjob fields.

Details
The elastic-agent-autodiscover Kubernetes library by default comes with add_resource_metadata.deployment=false and add_resource_metadata.cronjob=false.

Impact
Pods that will be created from deployments or cronjobs will not have the extra metadata field for kubernetes.deployment or kubernetes.cronjob, respectively. This change was made to avoid the memory impact of keeping the feature enabled in big Kubernetes clusters.

For more information, refer to #3591.

Enhancements

{agent}

  • Enable {agent} to upgrade securely in an air-gapped environment where {fleet-server} is the only reachable URI. #3591 #3863

Bug fixes

{fleet}

  • Fix validation errors in KQL queries. (#168329)

{fleet} and {agent} 8.10.3

Review important information about the {fleet} and {agent} 8.10.3 release.

Security updates

  • Fleet Server Insertion of Sensitive Information into Log File (ESA-2023-20)

    An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrollment tokens are being inserted into the Fleet Server’s log file in plain text.

    These enrollment tokens could allow someone to enroll an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enroll agents to the clusters and send arbitrary events to Elasticsearch.

    The issue is resolved in 8.10.3.

    For more information, see our related security announcement.

Known issues

Important
 The known issue that prevents successful upgrades in an air-gapped environment for {agent} versions 8.9.0 to 8.10.2 has been resolved in this release. If you’re using an air-gapped environment, we recommend installing version 8.10.3 or any higher version to avoid not being unable to upgrade.

Enhancements

{agent}

  • Improve {agent} uninstall on Windows by adding delay between retries when file removal is blocked by busy files #3431 #3221

Bug fixes

{fleet}

  • Fix incorrect index template used from the data stream name (#166941)

  • Increase package install max timeout limit and add concurrency control to rollovers (#166775)

  • Fix bulk action dropdown (#166475)

{agent}

  • Resilient handling of air gapped PGP checks. {agent} should not fail when remote PGP is specified (or official Elastic fallback PGP is used) and remote is not available #3427 #3426 #3368

{fleet} and {agent} 8.10.2

Review important information about the {fleet} and {agent} 8.10.2 release.

Known issues

PGP key download fails in an air-gapped environment

Details

Important
 If you’re using an air-gapped environment, we recommended installing version 8.10.3 or any higher version, to avoid being unable to upgrade.

Starting from version 8.9.0, when {agent} tries to perform an upgrade, it first verifies the binary signature with the key bundled in the agent. This process has a backup mechanism that will use the key coming from https://artifacts.elastic.co/GPG-KEY-elastic-agent instead of the one it already has.

In an air-gapped environment, the agent won’t be able to download the remote key and therefore cannot be upgraded.

Impact

For the upgrade to succeed, the agent needs to download the remote key from a server accessible from the air-gapped environment. Two workarounds are available.

Option 1

If an HTTP proxy is available to be used by the {agents} in your {fleet}, add the proxy settings using environment variables as explained in Proxy Server connectivity using default host variables. Please note that you need to enable HTTP Proxy usage for artifacts.elastic.co to bypass this problem, so you can craft the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables to be used exclusively for it.

Option 2

As the upgrade URL is not customizable, we have to "trick" the system by pointing https://artifacts.elastic.co/ to another host that will have the file.

The following examples require a server in your air-gapped environment that will expose the key you will have downloaded from https://artifacts.elastic.co/GPG-KEY-elastic-agent`.

Example 1: Manual

Edit the {agent} server hosts file to add the following content:

<YOUR_HOST_IP> artifacts.elastic.co

The Linux hosts file path is /etc/hosts.

Windows hosts file path is C:\Windows\System32\drivers\etc\hosts.

Example 2: Puppet

host { 'elastic-artifacts':
  ensure       => 'present'
  comment      => 'Workaround for PGP check'
  ip           => '<YOUR_HOST_IP>'
}

Example 3: Ansible

- name  : 'elastic-artifacts'
  hosts : 'all'
  become: 'yes'

  tasks:
    - name: 'Add entry to /etc/hosts'
      lineinfile:
        path: '/etc/hosts'
        line: '<YOUR_HOST_IP> artifacts.elastic.co'

Enhancements

{agent}

  • Updated Go version to 1.20.8. #3393

Bug fixes

{fleet}

  • Fixed force delete package API, fixed validation check to reject request if package is used by agents. (#166623)

{fleet} and {agent} 8.10.1

Review important information about the {fleet} and {agent} 8.10.1 release.

Known issues

PGP key download fails in an air-gapped environment

Details

Important
 If you’re using an air-gapped environment, we recommended installing version 8.10.3 or any higher version, to avoid being unable to upgrade.

Starting from version 8.9.0, when {agent} tries to perform an upgrade, it first verifies the binary signature with the key bundled in the agent. This process has a backup mechanism that will use the key coming from https://artifacts.elastic.co/GPG-KEY-elastic-agent instead of the one it already has.

In an air-gapped environment, the agent won’t be able to download the remote key and therefore cannot be upgraded.

Impact

For the upgrade to succeed, the agent needs to download the remote key from a server accessible from the air-gapped environment. Two workarounds are available.

Option 1

If an HTTP proxy is available to be used by the {agents} in your {fleet}, add the proxy settings using environment variables as explained in Proxy Server connectivity using default host variables. Please note that you need to enable HTTP Proxy usage for artifacts.elastic.co to bypass this problem, so you can craft the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables to be used exclusively for it.

Option 2

As the upgrade URL is not customizable, we have to "trick" the system by pointing https://artifacts.elastic.co/ to another host that will have the file.

The following examples require a server in your air-gapped environment that will expose the key you will have downloaded from https://artifacts.elastic.co/GPG-KEY-elastic-agent`.

Example 1: Manual

Edit the {agent} server hosts file to add the following content:

<YOUR_HOST_IP> artifacts.elastic.co

The Linux hosts file path is /etc/hosts.

Windows hosts file path is C:\Windows\System32\drivers\etc\hosts.

Example 2: Puppet

host { 'elastic-artifacts':
  ensure       => 'present'
  comment      => 'Workaround for PGP check'
  ip           => '<YOUR_HOST_IP>'
}

Example 3: Ansible

- name  : 'elastic-artifacts'
  hosts : 'all'
  become: 'yes'

  tasks:
    - name: 'Add entry to /etc/hosts'
      lineinfile:
        path: '/etc/hosts'
        line: '<YOUR_HOST_IP> artifacts.elastic.co'

Enhancements

{agent}

  • Improve logging during {agent} upgrades. #3382

Bug fixes

{fleet}

  • Show snapshot version in agent upgrade modal and allow custom values. (#165978).

{agent}

  • Rollback {agent} upgrade if upgraded agent process crashes immediately. #3166 #3124

{fleet} and {agent} 8.10.0

Review important information about the {fleet} and {agent} 8.10.0 release.

Breaking changes

Breaking changes can prevent your application from optimal operation and performance. Before you upgrade, review the breaking changes, then mitigate the impact to your application.

{agent} diagnostics unavailable with {fleet-server} below 8.10.0.

Details
The mechanism that {fleet} uses to generate diagnostic bundles has been updated. To collect {agent} diagnostics, {fleet-server} needs to be at version 8.10.0 or higher.

Impact
If you need to access a diagnostic bundle for an agent, ensure that {fleet-server} is at the required version.

Known issues

PGP key download fails in an air-gapped environment

Details

Important
 If you’re using an air-gapped environment, we recommended installing version 8.10.3 or any higher version, to avoid being unable to upgrade.

Starting from version 8.9.0, when {agent} tries to perform an upgrade, it first verifies the binary signature with the key bundled in the agent. This process has a backup mechanism that will use the key coming from https://artifacts.elastic.co/GPG-KEY-elastic-agent instead of the one it already has.

In an air-gapped environment, the agent won’t be able to download the remote key and therefore cannot be upgraded.

Impact

For the upgrade to succeed, the agent needs to download the remote key from a server accessible from the air-gapped environment. Two workarounds are available.

Option 1

If an HTTP proxy is available to be used by the {agents} in your {fleet}, add the proxy settings using environment variables as explained in Proxy Server connectivity using default host variables. Please note that you need to enable HTTP Proxy usage for artifacts.elastic.co to bypass this problem, so you can craft the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables to be used exclusively for it.

Option 2

As the upgrade URL is not customizable, we have to "trick" the system by pointing https://artifacts.elastic.co/ to another host that will have the file.

The following examples require a server in your air-gapped environment that will expose the key you will have downloaded from https://artifacts.elastic.co/GPG-KEY-elastic-agent`.

Example 1: Manual

Edit the {agent} server hosts file to add the following content:

<YOUR_HOST_IP> artifacts.elastic.co

The Linux hosts file path is /etc/hosts.

Windows hosts file path is C:\Windows\System32\drivers\etc\hosts.

Example 2: Puppet

host { 'elastic-artifacts':
  ensure       => 'present'
  comment      => 'Workaround for PGP check'
  ip           => '<YOUR_HOST_IP>'
}

Example 3: Ansible

- name  : 'elastic-artifacts'
  hosts : 'all'
  become: 'yes'

  tasks:
    - name: 'Add entry to /etc/hosts'
      lineinfile:
        path: '/etc/hosts'
        line: '<YOUR_HOST_IP> artifacts.elastic.co'
Filtering Elastic Agents in Kibana generates an "Error fetching agents" message

Details

A {kibana-ref}/kuery-query.html[KQL query] in a Fleet search field now returns a 400 error when the query is not valid.

Previously, the search fields would accept any type of query, but with the merge of #161064 any type of KQL sent to {fleet} needs to have a valid field name, otherwise it returns an error.

Cause

Entering an invalid KQL query on one of the {fleet} KQL search fields or through the API produces the error.

Affected search fields in the {fleet} UI:

  • Agent list

  • Agent policies

  • Enrollment Keys

Affected endpoints in the [fleet-api-docs] (these are the endpoints that accept the parameter ListWithKuery):

  • GET api/fleet/agents

  • GET api/fleet/agent_status

  • GET api/fleet/agent_policies

  • GET api/fleet/package_policies

  • GET api/fleet/enrollment_api_keys

  • GET api/fleet/agent_status

Impact

To avoid getting the 400 error, the queries should be valid.

For instance, entering the query 8.10.0 results in an error. The correct query should be: local_metadata.agent.version="8.10.0".

As another example, when viewing the Agents tab in Fleet, typing a hostname such as a0c8c88ef2f5 in the search field results in an error. The correct query should have the correct field name, taken from among the allowed ones, for example local_metadata.host.hostname: a0c8c88ef2f5.

The list of available field names is visible by clicking on any of the search fields.

New features

The 8.10.0 release Added the following new and notable features.

{fleet}

  • Enable agent policy secret storage when all fleet servers are above 8.10.0 #163627.

  • Kafka integration API #159110.

{fleet-server}

  • Add a new policy token that can be used to enroll {agent} into fleet server. #2654

  • Add a Kafka output type for agent policies. #2850

  • Fleet Server support to handle agent policy secrets. #2863 #2485

{agent}

  • Report the version from the {agent} package instead of the agent binary to enhance release process. #2908

  • Implement tamper protection for {elastic-endpoint} uninstall use cases. #2781

  • Add component-level diagnostics and CPU profiling. #3118

  • Improve upgrade process to use upgraded version of Watcher to ensure a successful upgrade. #3140 #2873

Enhancements

{fleet}

  • Add support for runtime fields. #161129.

{fleet-server}

  • Keep the {fleet-server} service running when {es} is not available. #2693 #2683

  • Add APM trace fields to HTTP request logs. #2743

  • File transfers with integrations now use datastreams. #2741

  • Use a unique ID for agent action results to ensure accurate counts on {fleet} UI. #2782 #2596

{agent}

  • Redundant calls to /api/fleet/setup were removed in favor of {kib}-initiated calls. #2985 #2910

  • Updated Go version to 1.20.7. #3177

  • Add runtime prevention to prevent {elastic-defend} from running if {agent} is not installed in the default location. #3114

  • Add a new flag complete to agent metadata to signal that the instance running is synthetics-capable. #3190 #1754

  • Add support for setting GOMAXPROCS to limit CPU usage through the agent policy. #3179

  • Add logging to the restart step of the {agent} upgrade rollback process. #3245 #3305

Bug fixes

{fleet}

  • Only show agent dashboard links if there is more than one non-server agent and if the dashboards exist. #164469.

  • Exclude synthetics from per-policy-outputs. #161949.

  • Fix the path for hint templates for auto-discover. #161075.

{agent}

  • Don’t trigger Indicator of Compromise (IoC) alert on Windows uninstall. #3014 #2970

  • Fix credential redaction in diagnostic bundle collection. #3165

  • Ensure that {agent} upgrades are rolled back even when the upgraded agent crashes immediately and repeatedly. #3220 #3123

  • Ensure that Elastic Agent is restarted during rollback. #3268

  • Fix how the diagnostics command handles the custom path to save the diagnostics. #3340 #3339