From 898801062e255d15bdbe82b0466dd97c1b63f665 Mon Sep 17 00:00:00 2001
From: Brandon Morelli <brandon.morelli@elastic.co>
Date: Fri, 28 May 2021 14:10:44 -0700
Subject: [PATCH] Document Agent/Fleet Server environment variables (#671)

Co-authored-by: DeDe Morton <dede.morton@elastic.co>
Co-authored-by: Chris Mark <chrismarkou92@gmail.com>
---
 .../configuration/env/container-envs.asciidoc | 155 +++++
 .../configuration/env/shared-env.asciidoc     | 543 ++++++++++++++++++
 elastic-agent/elastic-agent.asciidoc          |   2 +
 .../running-on-kubernetes-standalone.asciidoc |  41 +-
 elastic-agent/running-on-kubernetes.asciidoc  |  32 +-
 5 files changed, 760 insertions(+), 13 deletions(-)
 create mode 100644 elastic-agent/configuration/env/container-envs.asciidoc
 create mode 100644 elastic-agent/configuration/env/shared-env.asciidoc

diff --git a/elastic-agent/configuration/env/container-envs.asciidoc b/elastic-agent/configuration/env/container-envs.asciidoc
new file mode 100644
index 0000000000..cf6c581b5c
--- /dev/null
+++ b/elastic-agent/configuration/env/container-envs.asciidoc
@@ -0,0 +1,155 @@
+[[agent-environment-variables]]
+= {agent} environment variables
+
+++++
+<titleabbrev>Environment variables</titleabbrev>
+++++
+
+Use environment variables to configure {agent} when running in a containerized environment.
+Variables on this page are grouped by action type:
+
+* <<env-common-vars,Common variables>>
+* <<env-prepare-kibana-for-fleet,Configure {kib}:>> prepare the {fleet} plugin in {kib}
+* <<env-bootstrap-fleet-server,Configure {fleet-server}:>> bootstrap {fleet-server} on an {agent}
+* <<env-enroll-agent,Configure {agent} and {fleet}:>> enroll an {agent}
+
+[discrete]
+[[env-common-vars]]
+== Common variables
+
+// forces a unique ID so that settings can be included multiple times on the same page
+:type: common
+
+To limit the number of environment variables that need to be set,
+the following common variables are available.
+These variables can be used across all {agent} actions,
+but have a lower precedence than action-specific environment variables.
+
+These common variables are useful, for example, when using the same {es} and {kib} credentials
+to prepare the {fleet} plugin in {kib}, configure {fleet-server}, and enroll an {agent}.
+
+[cols="2*<a"]
+|===
+| Settings | Description
+
+include::shared-env.asciidoc[tag=elasticsearch-host]
+
+include::shared-env.asciidoc[tag=elasticsearch-username]
+
+include::shared-env.asciidoc[tag=elasticsearch-password]
+
+include::shared-env.asciidoc[tag=elasticsearch-ca]
+
+include::shared-env.asciidoc[tag=kibana-host]
+
+include::shared-env.asciidoc[tag=kibana-username]
+
+include::shared-env.asciidoc[tag=kibana-password]
+
+include::shared-env.asciidoc[tag=kibana-ca]
+
+|===
+
+[discrete]
+[[env-prepare-kibana-for-fleet]]
+== Prepare {kib} for {fleet}
+
+// forces a unique ID so that settings can be included multiple times on the same page
+:type: fleet-kib
+
+Settings used to prepare the {fleet} plugin in {kib}.
+
+[cols="2*<a"]
+|===
+| Settings | Description
+
+include::shared-env.asciidoc[tag=kibana-fleet-setup]
+
+include::shared-env.asciidoc[tag=kibana-fleet-host]
+
+include::shared-env.asciidoc[tag=kibana-fleet-username]
+
+include::shared-env.asciidoc[tag=kibana-fleet-password]
+
+include::shared-env.asciidoc[tag=kibana-fleet-ca]
+
+|===
+
+[discrete]
+[[env-bootstrap-fleet-server]]
+== Bootstrap {fleet-server}
+
+// forces a unique ID so that settings can be included multiple times on the same page
+:type: bootstrap-fleet
+
+Settings used to bootstrap {fleet-server} on this {agent}.
+At least one {fleet-server} is required in a deployment.
+
+[cols="2*<a"]
+|===
+| Settings | Description
+
+include::shared-env.asciidoc[tag=fleet-server-enable]
+
+include::shared-env.asciidoc[tag=fleet-server-elasticsearch-host]
+
+include::shared-env.asciidoc[tag=fleet-server-elasticsearch-username]
+
+include::shared-env.asciidoc[tag=fleet-server-elasticsearch-password]
+
+include::shared-env.asciidoc[tag=fleet-server-elasticsearch-ca]
+
+include::shared-env.asciidoc[tag=fleet-server-service-token]
+
+include::shared-env.asciidoc[tag=fleet-server-policy-name]
+
+include::shared-env.asciidoc[tag=fleet-server-policy-id]
+
+include::shared-env.asciidoc[tag=fleet-server-host]
+
+include::shared-env.asciidoc[tag=fleet-server-port]
+
+include::shared-env.asciidoc[tag=fleet-server-cert]
+
+include::shared-env.asciidoc[tag=fleet-server-cert-key]
+
+include::shared-env.asciidoc[tag=fleet-server-insecure-http]
+
+|===
+
+[discrete]
+[[env-enroll-agent]]
+== Enroll {agent}
+
+// forces a unique ID so that settings can be included multiple times on the same page
+:type: enroll
+
+Settings used to enroll an {agent} into a {fleet-server}.
+
+[cols="2*<a"]
+|===
+| Settings | Description
+
+include::shared-env.asciidoc[tag=fleet-enroll]
+
+include::shared-env.asciidoc[tag=fleet-url]
+
+include::shared-env.asciidoc[tag=fleet-enrollment-token]
+
+include::shared-env.asciidoc[tag=fleet-token-name]
+
+include::shared-env.asciidoc[tag=fleet-token-policy-name]
+
+include::shared-env.asciidoc[tag=fleet-ca]
+
+include::shared-env.asciidoc[tag=fleet-insecure]
+
+include::shared-env.asciidoc[tag=kibana-fleet-host]
+
+include::shared-env.asciidoc[tag=kibana-fleet-username]
+
+include::shared-env.asciidoc[tag=kibana-fleet-password]
+
+include::shared-env.asciidoc[tag=kibana-fleet-ca]
+
+|===
diff --git a/elastic-agent/configuration/env/shared-env.asciidoc b/elastic-agent/configuration/env/shared-env.asciidoc
new file mode 100644
index 0000000000..15e2e489c3
--- /dev/null
+++ b/elastic-agent/configuration/env/shared-env.asciidoc
@@ -0,0 +1,543 @@
+// These env variables are shared across the docs. Copy and use
+// the following template to add a shared setting. Replace values in all caps.
+// Use an include statement // to pull the tagged region into your source file:
+// include::input-shared-settings.asciidoc[tag=NAME-setting]
+
+// tag::NAME-setting[]
+|
+[id="env-{type}-NAME"]
+`NAME`
+
+| (TYPE) DESCRIPTION.
+
+*Default:* `DEFAULT`
+
+OPTIONAL INFO AND EXAMPLE
+// end::NAME-setting[]
+
+// =============================================================================
+
+// tag::kibana-fleet-setup[]
+|
+[id="env-{type}-kibana-fleet-setup"]
+`KIBANA_FLEET_SETUP`
+
+| (int) Set to `1` to enable {fleet} setup.
+Enabling {fleet} is required before {fleet-server} will start.
+When this action is not performed, a user must manually log in to Kibana and visit the Fleet page to enable setup.
+
+*Default:* none
+
+NOTE: `FLEET_SETUP` has been deprecated and will be removed in v8.0.0.
+Use `KIBANA_FLEET_SETUP` instead.
+
+// end::kibana-fleet-setup[]
+
+// =============================================================================
+
+// tag::kibana-fleet-host[]
+|
+[id="env-{type}-kibana-fleet-host"]
+`KIBANA_FLEET_HOST`
+
+| (string) The {kib} host to enable {fleet} on.
+Overrides `FLEET_HOST` when set.
+
+*Default:* `http://kibana:5601`
+
+// end::kibana-fleet-host[]
+
+// =============================================================================
+
+// tag::kibana-fleet-username[]
+|
+[id="env-{type}-kibana-fleet-username"]
+`KIBANA_FLEET_USERNAME`
+
+| (string) The basic authentication username used to connect to {kib} and enable {fleet}.
+Overrides `KIBANA_USERNAME` when set.
+
+*Default:* `elastic`
+
+// end::kibana-fleet-username[]
+
+// =============================================================================
+
+// tag::kibana-fleet-password[]
+|
+[id="env-{type}-kibana-fleet-password"]
+`KIBANA_FLEET_PASSWORD`
+
+| (string) The basic authentication password used to connect to {kib} and enable {fleet}.
+Overrides `KIBANA_PASSWORD` when set.
+
+*Default:* `changeme`
+
+// end::kibana-fleet-password[]
+
+// =============================================================================
+
+// tag::kibana-fleet-ca[]
+|
+[id="env-{type}-kibana-fleet-ca"]
+`KIBANA_FLEET_CA`
+
+| (string) The path to a certificate authority. Overrides `KIBANA_CA` when set.
+
+By default, {agent} uses the list of trusted certificate authorities (CA) from the operating
+system where it is running.
+If the certificate authority that signed your node certificates is not in the host system's
+trusted certificate authorities list, use this config to add the path to the `.pem` file that
+contains your CA's certificate.
+
+*Default:* `""`
+
+// end::kibana-fleet-ca[]
+
+// =============================================================================
+
+// tag::fleet-server-enable[]
+|
+[id="env-{type}-fleet-server-enable"]
+`FLEET_SERVER_ENABLE`
+
+| (int) Set to `1` to bootstrap {fleet-server} on this {agent}.
+When set to `1`, this automatically forces {fleet} enrollment as well.
+
+*Default:* none
+
+// end::fleet-server-enable[]
+
+// =============================================================================
+
+// tag::fleet-server-elasticsearch-host[]
+|
+[id="env-{type}-fleet-server-elasticsearch-host"]
+`FLEET_SERVER_ELASTICSEARCH_HOST`
+
+
+| (string) The {es} host for {fleet-server} to communicate with.
+Overrides `ELASTICSEARCH_HOST` when set.
+
+*Default:* `http://elasticsearch:9200`
+
+// end::fleet-server-elasticsearch-host[]
+
+// =============================================================================
+
+// tag::fleet-server-elasticsearch-username[]
+|
+[id="env-{type}-fleet-server-elasticsearch-username"]
+`FLEET_SERVER_ELASTICSEARCH_USERNAME`
+
+| (string) The basic authentication username used to connect to {es}.
+Overrides `ELASTICSEARCH_USERNAME` when set.
+This user needs the privileges required to publish events to {es}.
+
+// To do: link to required privileges
+
+*Default:* `elastic`
+
+// end::fleet-server-elasticsearch-username[]
+
+// =============================================================================
+
+// tag::fleet-server-elasticsearch-password[]
+|
+[id="env-{type}-fleet-server-elasticsearch-password"]
+`FLEET_SERVER_ELASTICSEARCH_PASSWORD`
+
+| (string) The basic authentication password used to connect to {es}.
+Overrides `ELASTICSEARCH_PASSWORD` when set.
+
+*Default:* `changeme`
+
+// end::fleet-server-elasticsearch-password[]
+
+// =============================================================================
+
+// tag::fleet-server-elasticsearch-ca[]
+|
+[id="env-{type}-fleet-server-elasticsearch-ca"]
+`FLEET_SERVER_ELASTICSEARCH_CA`
+
+| (string) The path to a certificate authority. Overrides `ELASTICSEARCH_CA` when set.
+
+By default, {agent} uses the list of trusted certificate authorities (CA) from the operating
+system where it is running.
+If the certificate authority that signed your node certificates is not in the host system's
+trusted certificate authorities list, use this config to add the path to the `.pem` file that
+contains your CA's certificate.
+
+*Default:* `""`
+
+// end::fleet-server-elasticsearch-ca[]
+
+// =============================================================================
+
+// tag::fleet-server-policy-name[]
+|
+[id="env-{type}-fleet-server-policy-name"]
+`FLEET_SERVER_POLICY_NAME`
+
+| (string) The name of the policy for {fleet-server} to use on itself.
+Overrides `FLEET_TOKEN_POLICY_NAME` when set.
+
+*Default:* none
+
+// end::fleet-server-policy-name[]
+
+// =============================================================================
+
+// tag::fleet-server-service-token[]
+|
+[id="env-{type}-fleet-server-service-token"]
+`FLEET_SERVER_SERVICE_TOKEN`
+
+| (string) Service token to use for communication with Elasticsearch.
+
+*Default:* none
+
+// end::fleet-server-service-token[]
+
+// =============================================================================
+
+// tag::fleet-server-policy-id[]
+|
+[id="env-{type}-fleet-server-policy-id"]
+`FLEET_SERVER_POLICY_ID`
+
+| (string) The policy ID for {fleet-server} to use on itself.
+
+*Default:* When undefined, the "Default Fleet Server policy" is used.
+
+// end::fleet-server-policy-id[]
+
+// =============================================================================
+
+// tag::fleet-server-host[]
+|
+[id="env-{type}-fleet-server-host"]
+`FLEET_SERVER_HOST`
+
+| (string) The binding host for {fleet-server} HTTP.
+Overrides the host defined in the policy.
+
+*Default:* none
+
+// end::fleet-server-host[]
+
+// =============================================================================
+
+// tag::fleet-server-port[]
+|
+[id="env-{type}-fleet-server-port"]
+`FLEET_SERVER_PORT`
+
+| (string) The binding port for {fleet-server} HTTP.
+Overrides the port defined in the policy.
+
+*Default:* none
+
+// end::fleet-server-port[]
+
+// =============================================================================
+
+// tag::fleet-server-cert[]
+|
+[id="env-{type}-fleet-server-cert"]
+`FLEET_SERVER_CERT`
+
+| (string) The path to the certificate to use for HTTPS.
+
+*Default:* none
+
+// end::fleet-server-cert[]
+
+// =============================================================================
+
+// tag::fleet-server-cert-key[]
+|
+[id="env-{type}-fleet-server-cert-key"]
+`FLEET_SERVER_CERT_KEY`
+
+| (string) The path to the private key for the certificate used for HTTPS.
+
+*Default:* none
+
+// end::fleet-server-cert-key[]
+
+// =============================================================================
+
+// tag::fleet-server-insecure-http[]
+|
+[id="env-{type}-fleet-server-insecure-http"]
+`FLEET_SERVER_INSECURE_HTTP`
+
+| (bool) When `true`, exposes {fleet-server} over HTTP (insecure).
+Setting this to `true` is not recommended.
+
+*Default:* `false`
+
+// end::fleet-server-insecure-http[]
+
+// =============================================================================
+
+// tag::fleet-enroll[]
+|
+[id="env-{type}-fleet-enroll"]
+`FLEET_ENROLL`
+
+| (bool) Set to `1` to enroll the {agent} into {fleet-server}.
+
+*Default:* `false`
+
+// end::fleet-enroll[]
+
+// =============================================================================
+
+// tag::fleet-url[]
+|
+[id="env-{type}-fleet-url"]
+`FLEET_URL`
+
+| (string) URL to enroll the {fleet-server} into.
+
+*Default:* `""`
+
+// end::fleet-url[]
+
+// =============================================================================
+
+// tag::fleet-enrollment-token[]
+|
+[id="env-{type}-fleet-enrollment-token"]
+`FLEET_ENROLLMENT_TOKEN`
+
+| (string) The token to use for enrollment.
+
+*Default:* `""`
+
+// end::fleet-enrollment-token[]
+
+// =============================================================================
+
+// tag::fleet-token-name[]
+|
+[id="env-{type}-fleet-token-name"]
+`FLEET_TOKEN_NAME`
+
+| (string) The token name to use to fetch the token from {kib}.
+
+*Default:* `""`
+
+// end::fleet-token-name[]
+
+// =============================================================================
+
+// tag::fleet-token-policy-name[]
+|
+[id="env-{type}-fleet-token-policy-name"]
+`FLEET_TOKEN_POLICY_NAME`
+
+| (string) The token policy name to use to fetch the token from {kib}.
+
+*Default:* `false`
+
+// end::fleet-token-policy-name[]
+
+// =============================================================================
+
+// tag::fleet-ca[]
+|
+[id="env-{type}-fleet-ca"]
+`FLEET_CA`
+
+| (string) The path to a certificate authority. Overrides `ELASTICSEARCH_CA` when set.
+
+By default, {agent} uses the list of trusted certificate authorities (CA) from the operating
+system where it is running.
+If the certificate authority that signed your node certificates is not in the host system's
+trusted certificate authorities list, use this config to add the path to the `.pem` file that
+contains your CA's certificate.
+
+*Default:* `false`
+
+// end::fleet-ca[]
+
+// =============================================================================
+
+// tag::fleet-insecure[]
+|
+[id="env-{type}-fleet-insecure"]
+`FLEET_INSECURE`
+
+| (bool) When `true`, {agent} communicates with {fleet-server} over insecure or unverified HTTP.
+Setting this to `true` is not recommended.
+
+*Default:* `false`
+
+// end::fleet-insecure[]
+
+// =============================================================================
+
+// tag::elasticsearch-host[]
+|
+[id="env-{type}-elasticsearch-host"]
+`ELASTICSEARCH_HOST`
+
+| (string) The {es} host to communicate with.
+
+*Default:* `http://elasticsearch:9200`
+
+// end::elasticsearch-host[]
+
+// =============================================================================
+
+// tag::es-host[]
+|
+[id="env-{type}-es-host"]
+`ES_HOST`
+
+| (string) The {es} host to communicate with.
+
+*Default:* `http://elasticsearch:9200`
+
+// end::es-host[]
+
+// =============================================================================
+
+// tag::elasticsearch-username[]
+|
+[id="env-{type}-elasticsearch-username"]
+`ELASTICSEARCH_USERNAME`
+
+| (string) The basic authentication username used to connect to {es}.
+This user needs the privileges required to publish events to {es}.
+
+// To do: link to required privileges
+
+*Default:* `elastic`
+
+// end::elasticsearch-username[]
+
+// =============================================================================
+
+// tag::es-username[]
+|
+[id="env-{type}-es-username"]
+`ES_USERNAME`
+
+| (string) The basic authentication username used to connect to {es}.
+This user needs the privileges required to publish events to {es}.
+
+// To do: link to required privileges
+
+*Default:* `elastic`
+
+// end::es-username[]
+
+// =============================================================================
+
+// tag::elasticsearch-password[]
+|
+[id="env-{type}-elasticsearch-password"]
+`ELASTICSEARCH_PASSWORD`
+
+| (string) The basic authentication password used to connect to {es}.
+
+*Default:* `changeme`
+
+// end::elasticsearch-password[]
+
+// =============================================================================
+
+// tag::es-password[]
+|
+[id="env-{type}-es-password"]
+`ES_PASSWORD`
+
+| (string) The basic authentication password used to connect to {es}.
+
+*Default:* `changeme`
+
+// end::es-password[]
+
+// =============================================================================
+
+// tag::elasticsearch-ca[]
+|
+[id="env-{type}-elasticsearch-ca"]
+`ELASTICSEARCH_CA`
+
+| (string) The path to a certificate authority.
+
+By default, {agent} uses the list of trusted certificate authorities (CA) from the operating
+system where it is running.
+If the certificate authority that signed your node certificates is not in the host system's
+trusted certificate authorities list, use this config to add the path to the `.pem` file that
+contains your CA's certificate.
+
+*Default:* `""`
+
+// end::elasticsearch-ca[]
+
+// =============================================================================
+
+// tag::kibana-host[]
+|
+[id="env-{type}-kibana-host"]
+`KIBANA_HOST`
+
+| (string) The {kib} host.
+
+*Default:* `http://kibana:5601`
+
+// end::kibana-host[]
+
+// =============================================================================
+
+// tag::kibana-username[]
+|
+[id="env-{type}-kibana-username"]
+`KIBANA_USERNAME`
+
+| (string) The basic authentication username used to connect to {kib}.
+
+*Default:* `elastic`
+
+// end::kibana-username[]
+
+// =============================================================================
+
+// tag::kibana-password[]
+|
+[id="env-{type}-kibana-password"]
+`KIBANA_PASSWORD`
+
+| (string) The basic authentication password used to connect to {kib}.
+
+*Default:* `changeme`
+
+// end::kibana-password[]
+
+// =============================================================================
+
+// tag::kibana-ca[]
+|
+[id="env-{type}-kibana-ca"]
+`KIBANA_CA`
+
+| (string) The path to a certificate authority.
+
+By default, {agent} uses the list of trusted certificate authorities (CA) from the operating
+system where it is running.
+If the certificate authority that signed your node certificates is not in the host system's
+trusted certificate authorities list, use this config to add the path to the `.pem` file that
+contains your CA's certificate.
+
+*Default:* `""`
+
+// end::kibana-ca[]
+
+// =============================================================================
diff --git a/elastic-agent/elastic-agent.asciidoc b/elastic-agent/elastic-agent.asciidoc
index 3bef7e2502..41baeb83dc 100644
--- a/elastic-agent/elastic-agent.asciidoc
+++ b/elastic-agent/elastic-agent.asciidoc
@@ -49,4 +49,6 @@ include::elastic-agent-dynamic-inputs.asciidoc[leveloffset=+1]
 
 include::elastic-agent-capabilities.asciidoc[leveloffset=+1]
 
+include::configuration/env/container-envs.asciidoc[leveloffset=+1]
+
 include::redirects.asciidoc[leveloffset=+1]
diff --git a/elastic-agent/running-on-kubernetes-standalone.asciidoc b/elastic-agent/running-on-kubernetes-standalone.asciidoc
index b61547d5f6..1e79a7aba5 100644
--- a/elastic-agent/running-on-kubernetes-standalone.asciidoc
+++ b/elastic-agent/running-on-kubernetes-standalone.asciidoc
@@ -2,7 +2,7 @@
 [role="xpack"]
 = Run {agent} standalone on Kubernetes
 
-Use {agent} https://www.docker.elastic.co/r/beats/elastic-agent[Docker images] on Kubernetes to
+You can use {agent} https://www.docker.elastic.co/r/beats/elastic-agent[Docker images] on Kubernetes to
 retrieve cluster metrics.
 
 TIP: Running {ecloud} on Kubernetes? See {eck-ref}/k8s-elastic-agent.html[Run {elastic-agent} on ECK].
@@ -37,7 +37,7 @@ deployment] docs)
 Everything is deployed under the `kube-system` namespace by default. To change
 the namespace, modify the manifest file.
 
-Download the manifest file by running:
+To download the manifest file, run:
 
 ["source", "sh", subs="attributes"]
 ------------------------------------------------
@@ -63,14 +63,37 @@ Set the Elasticsearch settings before deploying the manifest:
   value: "https://somesuperhostiduuid.europe-west1.gcp.cloud.es.io:443"
 ------------------------------------------------
 
+// Begin collapsed section
+[%collapsible]
+.Configuration details
+====
+****
+
+[cols="2*<a"]
+|===
+| Setting | Description
+
+include::configuration/env/shared-env.asciidoc[tag=es-username]
+
+include::configuration/env/shared-env.asciidoc[tag=es-password]
+
+include::configuration/env/shared-env.asciidoc[tag=es-host]
+
+|===
+
+See <<agent-environment-variables>> for all available options.
+
+****
+====
+
 [discrete]
-=== Running {agent} on master nodes
+=== Run {agent} on master nodes
 
-Kubernetes master nodes use https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/[taints]
+Kubernetes master nodes can use https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/[taints]
 to limit the workloads that can run on them. The manifest for standalone {agent} defines
-tolerations to run on master nodes, which collects metrics from the control plane
-components of Kuberentes (scheduler, controller manager).
-To disable {agent} from running on master nodes remove the following part of the Daemonset spec:
+tolerations to run on master nodes. Agents running on master nodes collect metrics from the control plane
+components (scheduler, controller manager) of Kuberentes.
+To disable {agent} from running on master nodes, remove the following part of the Daemonset spec:
 
 [source,yaml]
 ------------------------------------------------
@@ -136,5 +159,5 @@ the following configuration should be added as an extra input in the Daemonset m
       condition: ${kubernetes.pod.labels.app} == 'redis'
 ------------------------------------------------
 
-Users can find more information about how to shape their dynamic inputs
-for autodiscover at <<kubernetes-provider,dynamic inputs and kubernetes provider>> docs.
+See <<kubernetes-provider,dynamic inputs and kubernetes provider>> for more information
+about shaping dynamic inputs for autodiscovery.
diff --git a/elastic-agent/running-on-kubernetes.asciidoc b/elastic-agent/running-on-kubernetes.asciidoc
index fe80e44349..f3cd2e4267 100644
--- a/elastic-agent/running-on-kubernetes.asciidoc
+++ b/elastic-agent/running-on-kubernetes.asciidoc
@@ -43,7 +43,7 @@ curl -L -O https://raw.githubusercontent.com/elastic/beats/{branch}/deploy/kuber
 == Settings
 
 By default, {agent} is enrolled to an existing Kibana deployment,
-if present using the specified credentials. FLEET_ENROLLMENT_TOKEN parameter is used to connect Agent to the
+if present using the specified credentials. The `FLEET_ENROLLMENT_TOKEN` parameter is used to connect Agent to the
 corresponding {agent} policy. It is suggested to connect Daemonset Agents to a node scope configuration
 and Deployment Agent to a cluster scope configuration. Then Kubernetes package will be deployed enabling cluster scope
 datasets using cluster scope configuration while node scope datasets will be enabled under node scope configuration.
@@ -63,11 +63,35 @@ change the following parameters in the manifest file:
   value: "changeme"
 ------------------------------------------------
 
+// Begin collapsed section
+[%collapsible]
+.Configuration details
+====
+****
+
+[cols="2*<a"]
+|===
+| Settings | Description
+
+include::configuration/env/shared-env.asciidoc[tag=fleet-enrollment-token]
+
+include::configuration/env/shared-env.asciidoc[tag=kibana-host]
+
+include::configuration/env/shared-env.asciidoc[tag=kibana-username]
+
+include::configuration/env/shared-env.asciidoc[tag=kibana-password]
+|===
+
+See <<agent-environment-variables>> for all available options.
+
+****
+====
+
 [discrete]
-=== Running {agent} on master nodes
+=== Run {agent} on master nodes
 
 Kubernetes master nodes can use https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/[taints]
-to limit the workloads that can run on them. To run {agent} on master nodes you may need to
+to limit the workloads that can run on them. To run {agent} on master nodes, you may need to
 update the Daemonset spec to include proper tolerations:
 
 [source,yaml]
@@ -106,4 +130,4 @@ agent-ingest-management-clusterscope-574dbfc48f-sfrdt   1/1     Running     3
 agent-ingest-management-nodescope-jt9zj                 1/1     Running     3        8d
 ------------------------------------------------
 
-Agents should be enrolled to Fleet and user should be able to deploy Kubernetes package accordingly.
+{agent}s should be enrolled to Fleet and user should be able to deploy Kubernetes package accordingly.