Skip to content

Latest commit

 

History

History
523 lines (365 loc) · 15.6 KB

release-notes-8.9.asciidoc

File metadata and controls

523 lines (365 loc) · 15.6 KB

Release notes

This section summarizes the changes in each release.

Also see:

  • {kibana-ref}/release-notes.html[{kib} release notes]

  • {beats-ref}/release-notes.html[{beats} release notes]

{fleet} and {agent} 8.9.2

Review important information about the {fleet} and {agent} 8.9.2 release.

Known issues

PGP key download fails in an air-gapped environment

Details

Important
 If you’re using an air-gapped environment, we recommended installing version 8.10.3 or any higher version, to avoid being unable to upgrade.

Starting from version 8.9.0, when {agent} tries to perform an upgrade, it first verifies the binary signature with the key bundled in the agent. This process has a backup mechanism that will use the key coming from https://artifacts.elastic.co/GPG-KEY-elastic-agent instead of the one it already has.

In an air-gapped environment, the agent won’t be able to download the remote key and therefore cannot be upgraded.

Impact

For the upgrade to succeed, the agent needs to download the remote key from a server accessible from the air-gapped environment. Two workarounds are available.

Option 1

If an HTTP proxy is available to be used by the {agents} in your {fleet}, add the proxy settings using environment variables as explained in Proxy Server connectivity using default host variables. Please note that you need to enable HTTP Proxy usage for artifacts.elastic.co to bypass this problem, so you can craft the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables to be used exclusively for it.

Option 2

As the upgrade URL is not customizable, we have to "trick" the system by pointing https://artifacts.elastic.co/ to another host that will have the file.

The following examples require a server in your air-gapped environment that will expose the key you will have downloaded from https://artifacts.elastic.co/GPG-KEY-elastic-agent`.

Example 1: Manual

Edit the {agent} server hosts file to add the following content:

<YOUR_HOST_IP> artifacts.elastic.co

The Linux hosts file path is /etc/hosts.

Windows hosts file path is C:\Windows\System32\drivers\etc\hosts.

Example 2: Puppet

host { 'elastic-artifacts':
  ensure       => 'present'
  comment      => 'Workaround for PGP check'
  ip           => '<YOUR_HOST_IP>'
}

Example 3: Ansible

- name  : 'elastic-artifacts'
  hosts : 'all'
  become: 'yes'

  tasks:
    - name: 'Add entry to /etc/hosts'
      lineinfile:
        path: '/etc/hosts'
        line: '<YOUR_HOST_IP> artifacts.elastic.co'

Enhancements

{fleet}

  • Adds the configuration setting xpack.fleet.packageVerification.gpgKeyPath as an environment variable in the {kib} container. #163783.

{agent}

  • Adds logging to the restart step of the {agent} upgrade rollback process. #3245

Bug fixes

{agent}

  • Correctly identify retryable errors when attempting to uninstall on Windows. #3317

{fleet} and {agent} 8.9.1

Review important information about the {fleet} and {agent} 8.9.1 release.

Security updates

{agent}

  • Updated Go version to 1.19.12. #3186

Known issues

PGP key download fails in an air-gapped environment

Details

Important
 If you’re using an air-gapped environment, we recommended waiting for this issue to be resolved before installing 8.9.x or any higher version, to avoid being unable to upgrade.

Starting from version 8.9.0, when {agent} tries to perform an upgrade, it first verifies the binary signature with the key bundled in the agent. This process has a backup mechanism that will use the key coming from https://artifacts.elastic.co/GPG-KEY-elastic-agent instead of the one it already has.

In an air-gapped environment, the agent won’t be able to download the remote key and therefore cannot be upgraded.

Impact

For the upgrade to succeed, the agent needs to download the remote key from a server accessible from the air-gapped environment. Two workarounds are available.

Option 1

If an HTTP proxy is available to be used by the {agents} in your {fleet}, add the proxy settings using environment variables as explained in Proxy Server connectivity using default host variables. Please note that you need to enable HTTP Proxy usage for artifacts.elastic.co to bypass this problem, so you can craft the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables to be used exclusively for it.

Option 2

As the upgrade URL is not customizable, we have to "trick" the system by pointing https://artifacts.elastic.co/ to another host that will have the file.

The following examples require a server in your air-gapped environment that will expose the key you will have downloaded from https://artifacts.elastic.co/GPG-KEY-elastic-agent`.

Example 1: Manual

Edit the {agent} server hosts file to add the following content:

<YOUR_HOST_IP> artifacts.elastic.co

The Linux hosts file path is /etc/hosts.

Windows hosts file path is C:\Windows\System32\drivers\etc\hosts.

Example 2: Puppet

host { 'elastic-artifacts':
  ensure       => 'present'
  comment      => 'Workaround for PGP check'
  ip           => '<YOUR_HOST_IP>'
}

Example 3: Ansible

- name  : 'elastic-artifacts'
  hosts : 'all'
  become: 'yes'

  tasks:
    - name: 'Add entry to /etc/hosts'
      lineinfile:
        path: '/etc/hosts'
        line: '<YOUR_HOST_IP> artifacts.elastic.co'

Bug fixes

{fleet}

  • Fixes for query error on Agents list in the UI. (#162816)

  • Remove duplicate path being pushed to package archive. (#162724)

{agent}

  • Improve two unclear error messages in the Upgrade Watcher #3093

  • Add default UTC timezone to synthetics agent Docker images to prevent navigation errors #3160 #36117

{fleet} and {agent} 8.9.0

Review important information about the {fleet} and {agent} 8.9.0 release.

Security updates

{fleet-server}

  • Use a verified base image for building Fleet Server binaries. #2339

Known issues

PGP key download fails in an air-gapped environment

Details

Important
 If you’re using an air-gapped environment, we recommended waiting for this issue to be resolved before installing 8.9.x or any higher version, to avoid being unable to upgrade.

Starting from version 8.9.0, when {agent} tries to perform an upgrade, it first verifies the binary signature with the key bundled in the agent. This process has a backup mechanism that will use the key coming from https://artifacts.elastic.co/GPG-KEY-elastic-agent instead of the one it already has.

In an air-gapped environment, the agent won’t be able to download the remote key and therefore cannot be upgraded.

Impact

For the upgrade to succeed, the agent needs to download the remote key from a server accessible from the air-gapped environment. Two workarounds are available.

Option 1

If an HTTP proxy is available to be used by the {agents} in your {fleet}, add the proxy settings using environment variables as explained in Proxy Server connectivity using default host variables. Please note that you need to enable HTTP Proxy usage for artifacts.elastic.co to bypass this problem, so you can craft the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables to be used exclusively for it.

Option 2

As the upgrade URL is not customizable, we have to "trick" the system by pointing https://artifacts.elastic.co/ to another host that will have the file.

The following examples require a server in your air-gapped environment that will expose the key you will have downloaded from https://artifacts.elastic.co/GPG-KEY-elastic-agent`.

Example 1: Manual

Edit the {agent} server hosts file to add the following content:

<YOUR_HOST_IP> artifacts.elastic.co

The Linux hosts file path is /etc/hosts.

Windows hosts file path is C:\Windows\System32\drivers\etc\hosts.

Example 2: Puppet

host { 'elastic-artifacts':
  ensure       => 'present'
  comment      => 'Workaround for PGP check'
  ip           => '<YOUR_HOST_IP>'
}

Example 3: Ansible

- name  : 'elastic-artifacts'
  hosts : 'all'
  become: 'yes'

  tasks:
    - name: 'Add entry to /etc/hosts'
      lineinfile:
        path: '/etc/hosts'
        line: '<YOUR_HOST_IP> artifacts.elastic.co'

Breaking changes

Breaking changes can prevent your application from optimal operation and performance. Before you upgrade, review the breaking changes, then mitigate the impact to your application.

Status command has been changed.

Details
The {agent} status command has been changed so that the default human output now uses a list format and summaries output.

Impact
Full human output can be obtained with the new full option. For for information, refer to #2890.

API default error code is now 500.

Details
Previously, when {fleet-server} encountered an unexpected error it resulted in a Bad Request response.

Impact
Now, any unexpected error returns an Internal Server Error response while keeping most of the current behavior unchanged. On expected failure paths (for example, Agent Inactive, Missing Agent ID, Missing Auth Header) a Bad Request response is returned. For more information, refer to #2531.

host.name field changed to ECS lowercase format.

Details
In {agent} output the host.name field has been changed to lowercase to match Elastic Common Schema (ECS) guidelines. The agent name is also reported in lowercase (AGENT-name becomes agent-name).

Impact
After upgrading {agent} to version 8.9.0 or higher, any case-sensitive searches may result in false-positive alerts. For example, a case-sensitive search based on the upper-case AGENT-name could result in an alert such as system.load.1 reported no data in the last 5m for AGENT-name. After upgrading, you may need to manually clear alerts and adjust some searches to match the new host.name format.

New features

The 8.9.0 release Added the following new and notable features.

{fleet}

  • Adds CloudFormation install method to CSPM. #159994

  • Adds flags to give permissions to write to any dataset and namespace. #157897

  • Disables Agent ID verification for Observability projects. #157400

  • Setup ignore_malformed in {fleet}. #157184

{fleet-server}

  • A new elastic-api version header is added, allow versioning of the {fleet-server} APIs. #2677

  • Support delivery of user-uploaded files to integrations. #2666

{agent}

  • Add the logs subcommand to the agent CLI. #2745 #114

  • Support upgrading to specific snapshots by specifying the build ID. #2752

Enhancements

{fleet}

  • Adds agent integration health reporting in the Fleet UI. #158826

{fleet-server}

  • Expose Prometheus metrics on metrics listener (when enabled). Ship Prometheus metrics with apm.Tracer when tracer is enabled. #2610

{agent}

  • Add additional elements to support the Universal Profiling integration. #2881

Bug fixes

{fleet}

  • Fixes a bug that prevented index.mapping settings to be propagated into component templates from default settings. #157289

{fleet-server}

  • Fixes a bug during {agent} upgrades where action_seq_no was overwritten with 0 if the ackToken was not provided. #2582

  • Fixes an issue that caused {fleet-server} to go offline after reboot. #2697 #2431

{agent}

  • Change monitoring socket to use a hash of the ID instead of the actual ID. #2912

  • Fix the drop processor for monitoring component logs to use the component.id instead of the dataset. #2982 #2388

  • Update Node version to 18.16.0. #2696