Remove TLS requirement for alerting when security is enabled #115234

mikecote · 2021-10-15T17:13:13Z

With elastic/elasticsearch#76801 now merged, alerting now works without TLS being enabled. The remaining pieces for us to change are our documentation and UI messages whenever Kibana fails to create API keys.

Note that our logic is still necessary when xpack.security.authc.api_key.enabled: false is set. But this is less likely than TLS not being set up.

The PR does the following:

Update documentation to remove set up requirement of TLS
Update documentation to mention API keys cannot be disabled, otherwise alerting will not work
Update UI messages to mention API keys must be enabled (instead of TLS)

Follow ups:

TLS is no longer required for stack monitoring rules to work #115236

Previews:

Docs: https://kibana_115234.docs-preview.app.elstc.co/diff

API keys disabled message

API keys and encryption key message

Encription key message

Note: The messages are the same in the create rule flyout. To test, you'll need to access the flyout from an app.

Testing steps

Explicitly disabling API keys

yarn es snapshot -E xpack.security.authc.api_key.enabled: false and yarn start
Notice the new banners when navigating to the rules management page

Ephemeral encryption key + disabling API keys

Change https://github.com/elastic/kibana/blob/master/x-pack/plugins/encrypted_saved_objects/server/plugin.ts#L61 to const canEncrypt = false;
yarn es snapshot -E xpack.security.authc.api_key.enabled=false and yarn start
Notice the new banners when navigating to the rules management page

mikecote · 2021-10-15T20:01:23Z

docs/user/alerting/alerting-setup.asciidoc

@@ -17,8 +17,7 @@ If you are using an *on-premises* Elastic Stack deployment:

 If you are using an *on-premises* Elastic Stack deployment with <<using-kibana-with-security, *security*>>:

-* You must enable Transport Layer Security (TLS) for communication <<configuring-tls-kib-es, between {es} and {kib}>>. {kib} alerting uses <<api-keys, API keys>> to secure background rule checks and actions, and API keys require {ref}/configuring-tls.html#tls-http[TLS on the HTTP interface]. A proxy will not suffice.
-* If you have enabled TLS and are still unable to access Alerting, ensure that you have not {ref}/security-settings.html#api-key-service-settings[explicitly disabled API keys].
+* If you are unable to access Alerting, ensure that you have not {ref}/security-settings.html#api-key-service-settings[explicitly disabled API keys].


@gchaps to review this change. It was the following before:

If you have enabled TLS and are still unable to access Alerting, ensure that you have not {ref}/security-settings.html#api-key-service-settings[explicitly disabled API keys].

mikecote · 2021-10-15T20:01:39Z

x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx

-          id="xpack.triggersActionsUI.components.healthCheck.tlsErrorTitle"
-          defaultMessage="You must enable Transport Layer Security and API keys"
+          id="xpack.triggersActionsUI.components.healthCheck.apiKeysDisabledErrorTitle"
+          defaultMessage="You must enable API keys"


@gchaps to review this change. It was the following before:

You must enable Transport Layer Security and API keys

mikecote · 2021-10-15T20:01:45Z

x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx

-            defaultMessage:
-              'Alerting relies on API keys, which require TLS between Elasticsearch and Kibana. ',
+          {i18n.translate('xpack.triggersActionsUI.components.healthCheck.apiKeysDisabledError', {
+            defaultMessage: 'Alerting relies on API keys. ',


@gchaps to review this change. It was the following before:

Alerting relies on API keys, which require TLS between Elasticsearch and Kibana.

This text now just repeats the title. Is there something more you can add? Or can it simply be:

You must enable API keys to use Alerting
Learn how

I'm also wondering if we should make the two messages parallel:

Additional setup required
You must enable API keys to use Alerting. Learn how.

mikecote · 2021-10-15T20:01:52Z

x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx

+            {i18n.translate(
+              'xpack.triggersActionsUI.components.healthCheck.apiKeysDisabledErrorAction',
+              {
+                defaultMessage: 'Learn how to enable API keys.',


@gchaps to review this change. It was the following before:

Learn how to enable TLS.

mikecote · 2021-10-15T20:02:03Z

x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx

+          {i18n.translate(
+            'xpack.triggersActionsUI.components.healthCheck.apiKeysAndEncryptionError',
+            {
+              defaultMessage: 'You must enable API keys and configure an encryption key. ',


@gchaps to review this change. It was the following before:

You must enable Transport Layer Security between Kibana and Elasticsearch and configure an encryption key in your kibana.yml file.

elasticmachine · 2021-10-18T14:09:10Z

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

mikecote · 2021-10-18T14:09:37Z

@elasticmachine merge upstream

chrisronline

LGTM functionally!

gchaps · 2021-10-18T20:32:08Z

Here's the text to make the messages parallel:

Additional setup required
You must enable API keys to use Alerting. Learn more.

Additional setup required
You must enable API keys and configure an encryption key to use Alerting. Learn more.

YulNaumenko

LGTM

gchaps

UI copy lgtm

kibanamachine · 2021-10-19T18:06:29Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`triggersActionsUi`	789.4KB	788.8KB	-668.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`core`	302.9KB	303.0KB	+81.0B

History

💔 Build #162771 failed 1e9c791
💔 Build #162766 failed b348b0a
💚 Build #162088 succeeded 8af8fa5
💚 Build #161615 succeeded a2cf6b1
💔 Build #161561 failed 65f3b1b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @mikecote

kibanamachine · 2021-10-19T18:11:14Z

💔 Backport failed

Status	Branch	Result
❌	7.x	Commit could not be cherrypicked due to conflicts

To backport manually run:
node scripts/backport --pr 115234

#115622) * Initial commit * Fix CI failures * Fix test label * Update messages * Cleanup translations * Fix type check Co-authored-by: Kibana Machine <[email protected]> # Conflicts: # docs/user/alerting/alerting-setup.asciidoc

Initial commit

65f3b1b

mikecote added release_note:enhancement v8.0.0 Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) v7.16.0 Feature:Alerting/RulesFramework Issues related to the Alerting Rules Framework labels Oct 15, 2021

mikecote self-assigned this Oct 15, 2021

mikecote mentioned this pull request Oct 15, 2021

TLS is no longer required for stack monitoring rules to work #115236

Closed

mikecote added 2 commits October 15, 2021 14:46

Fix CI failures

0626d4d

Fix test label

a2cf6b1

mikecote commented Oct 15, 2021

View reviewed changes

mikecote marked this pull request as ready for review October 18, 2021 14:09

mikecote requested review from a team as code owners October 18, 2021 14:09

Merge branch 'master' into alerting/remove-tls-requirement

8af8fa5

pgayvallet approved these changes Oct 18, 2021

View reviewed changes

chrisronline approved these changes Oct 18, 2021

View reviewed changes

YulNaumenko approved these changes Oct 19, 2021

View reviewed changes

mikecote added 3 commits October 19, 2021 11:04

Update messages

9a85150

Merge with master

b348b0a

Cleanup translations

1e9c791

gchaps approved these changes Oct 19, 2021

View reviewed changes

Fix type check

3f2bc32

mikecote added the auto-backport Deprecated - use backport:version if exact versions are needed label Oct 19, 2021

mikecote merged commit c1e9fc9 into elastic:master Oct 19, 2021

mikecote mentioned this pull request Oct 19, 2021

[7.x] Remove TLS requirement for alerting when security is enabled (#115234) #115622

Merged

Kerry350 mentioned this pull request Nov 5, 2021

[Stack Monitoring] Update security messaging around alerting #117505

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove TLS requirement for alerting when security is enabled #115234

Remove TLS requirement for alerting when security is enabled #115234

mikecote commented Oct 15, 2021 •

edited

Loading

mikecote Oct 15, 2021

mikecote Oct 15, 2021

mikecote Oct 15, 2021

gchaps Oct 18, 2021

mikecote Oct 15, 2021

mikecote Oct 15, 2021

elasticmachine commented Oct 18, 2021

mikecote commented Oct 18, 2021

chrisronline left a comment

gchaps commented Oct 18, 2021

YulNaumenko left a comment

gchaps left a comment

kibanamachine commented Oct 19, 2021

kibanamachine commented Oct 19, 2021

Remove TLS requirement for alerting when security is enabled #115234

Remove TLS requirement for alerting when security is enabled #115234

Conversation

mikecote commented Oct 15, 2021 • edited Loading

Testing steps

mikecote Oct 15, 2021

Choose a reason for hiding this comment

mikecote Oct 15, 2021

Choose a reason for hiding this comment

mikecote Oct 15, 2021

Choose a reason for hiding this comment

gchaps Oct 18, 2021

Choose a reason for hiding this comment

mikecote Oct 15, 2021

Choose a reason for hiding this comment

mikecote Oct 15, 2021

Choose a reason for hiding this comment

elasticmachine commented Oct 18, 2021

mikecote commented Oct 18, 2021

chrisronline left a comment

Choose a reason for hiding this comment

gchaps commented Oct 18, 2021

YulNaumenko left a comment

Choose a reason for hiding this comment

gchaps left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 19, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

History

kibanamachine commented Oct 19, 2021

💔 Backport failed

mikecote commented Oct 15, 2021 •

edited

Loading