mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 07:37:19 -04:00
2adeb4a666
Today's network config docs are split into "Network", "HTTP" and "Transport" pages, with unclear relationships between them. We often encounter users with weird configs that indicate they don't really understand how these settings all relate. In fact these pages are all very interrelated, and the HTTP and Transport pages are almost all only for advanced users. This commit brings these docs into a single page and rewords some things to try and guide users away from the advanced settings unless their configuration needs all the extra complexity. It also adds a section entitled "Binding and publishing" which clarifies the meanings of the `bind_host` and `publish_host` parameters. This is also a common source of confusion amongst users. It also clarifies that many of these settings accept a list of addresses, and warns that this may not be what you want. Closes #67956. Co-authored-by: Adam Locke <adam.locke@elastic.co>
79 lines
2.9 KiB
Text
79 lines
2.9 KiB
Text
[role="xpack"]
|
|
[[bootstrap-checks-xpack]]
|
|
== Bootstrap Checks for {xpack}
|
|
|
|
In addition to the <<bootstrap-checks,{es} bootstrap checks>>, there are
|
|
checks that are specific to {xpack} features.
|
|
|
|
[discrete]
|
|
=== Encrypt sensitive data check
|
|
//See EncryptSensitiveDAtaBootstrapCheck.java
|
|
|
|
If you use {watcher} and have chosen to encrypt sensitive data (by setting
|
|
`xpack.watcher.encrypt_sensitive_data` to `true`), you must also place a key in
|
|
the secure settings store.
|
|
|
|
To pass this bootstrap check, you must set the `xpack.watcher.encryption_key`
|
|
on each node in the cluster. For more information, see <<encrypting-data>>.
|
|
|
|
[discrete]
|
|
=== PKI realm check
|
|
//See PkiRealmBootstrapCheckTests.java
|
|
|
|
If you use {es} {security-features} and a Public Key Infrastructure (PKI) realm,
|
|
you must configure Transport Layer Security (TLS) on your cluster and enable
|
|
client authentication on the network layers (either transport or http). For more
|
|
information, see <<pki-realm>> and <<ssl-tls>>.
|
|
|
|
To pass this bootstrap check, if a PKI realm is enabled, you must configure TLS
|
|
and enable client authentication on at least one network communication layer.
|
|
|
|
[discrete]
|
|
=== Role mappings check
|
|
|
|
If you authenticate users with realms other than `native` or `file` realms, you
|
|
must create role mappings. These role mappings define which roles are assigned
|
|
to each user.
|
|
|
|
If you use files to manage the role mappings, you must configure a YAML file
|
|
and copy it to each node in the cluster. By default, role mappings are stored in
|
|
`ES_PATH_CONF/role_mapping.yml`. Alternatively, you can specify a
|
|
different role mapping file for each type of realm and specify its location in
|
|
the `elasticsearch.yml` file. For more information, see
|
|
<<mapping-roles-file>>.
|
|
|
|
To pass this bootstrap check, the role mapping files must exist and must be
|
|
valid. The Distinguished Names (DNs) that are listed in the role mappings files
|
|
must also be valid.
|
|
|
|
[discrete]
|
|
[[bootstrap-checks-tls]]
|
|
=== SSL/TLS check
|
|
//See TLSLicenseBootstrapCheck.java
|
|
|
|
If you enable {es} {security-features}, unless you have a trial license, you
|
|
must configure SSL/TLS for internode-communication.
|
|
|
|
NOTE: Single-node clusters that use a loopback interface do not have this
|
|
requirement. For more information, see
|
|
<<encrypting-communications>>.
|
|
|
|
To pass this bootstrap check, you must
|
|
<<ssl-tls,set up SSL/TLS in your cluster>>.
|
|
|
|
|
|
[discrete]
|
|
=== Token SSL check
|
|
//See TokenSSLBootstrapCheckTests.java
|
|
|
|
If you use {es} {security-features} and the built-in token service is enabled,
|
|
you must configure your cluster to use SSL/TLS for the HTTP interface. HTTPS is
|
|
required in order to use the token service.
|
|
|
|
In particular, if `xpack.security.authc.token.enabled` is
|
|
set to `true` in the `elasticsearch.yml` file, you must also set
|
|
`xpack.security.http.ssl.enabled` to `true`. For more information about these
|
|
settings, see <<security-settings>> and <<http-settings>>.
|
|
|
|
To pass this bootstrap check, you must enable HTTPS or disable the built-in
|
|
token service.
|