[Fleet] handle API key upgrade/renewal

[nchaulet]

Description

it's possible we add new permission to Fleet API keys (Like here #85761)

In this case we want:

• to be able to regenerate the fleet_enroll user, this need a user interaction:
• to generate a new set of output API keys for the agents. The old API keys should be invalidated when the agent do not use them anymore.

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[jalvz]

@nchaulet can you remind me the consequences of this? it is like an existing Elastic Agent would not work with an APM integration from a newer release?

[nchaulet]

@jalvz so the agent enrolled on a Kibana running a version < 7.11 and the user that used Fleet in kibana < 7.11 will not be able to use the APM integration as the api key will not have the trace-* permission

[jalvz]

got it, thanks.

[jalvz]

Just to make sure: this is still planned for 7.12, right?

[nchaulet]

We did not any work on that for 7.12, There still a few discussions on how this should and I am wondering if we should do the work in Kibana or wait Fleet Server for that, and for 7.12 document that you need to re-enroll your agent to have the correct permissions. cc @ruflin

[jalvz]

Ok, that is a bit unfortunate.
Can you update the label with the correct release target then?

Thanks

[ruflin]

We are in talks to the ES team about this issue and I hope we find a solution where we don't require to regenerate all API Keys. If we have to regenerate, agree it needs to be done in fleet-server.

[ruflin]

I'm wondering if we implement elastic/fleet-server#101 and #94058 this issue might get resolved.

[nchaulet]

I'm wondering if we implement elastic/fleet-server#101 and #94058 this issue might get resolved.

This would move the problem away from Kibana and move the API key upgrade/renewal part to elastic/fleet-server#101

[ph]

I think you are correct here, that would make it a single flow and really clear the responsibility:

• Fleet is responsible of listing the permissions based on the chosen integrations.
• Fleet-server is responsible of managing the permissions.

[ruflin]

There is an issue here we found: elastic/fleet-server#101 (comment) Currently Beats does not reload the output when a new API Key arrives.

[ruflin]

Going to close this issue as the solution here must happen in Beats / fleet-server and not Fleet.