User is unable to uninstall mac agent if x86_64 architecture agent is installed using Elastic Defend integration on mac with ARM architecture.

[amolnater-qasource]

Kibana Build details:

VERSION: 8.16.0 BC3
BUILD: 79556
COMMIT: f02d1303b5230c357ac7e4c49c8adadd5f66af38

Artifact Link: https://staging.elastic.co/8.16.0-485065f1/downloads/beats/elastic-agent/elastic-agent-8.16.0-darwin-x86_64.tar.gz

Preconditions:

1. 8.16.0-BC3 Kibana cloud environment should be available.

Steps to reproduce:

1. Install mac x86_64 architecture agent is installed using Elastic Defend integration on mac with ARM architecture.
2. Run agent uninstall command- sudo elastic-agent uninstall.
3. Observe user is not able to uninstall agent.

Expected Result:
User should be able to uninstall mac agent if x86_64 architecture agent is installed using Elastic Defend integration on mac with ARM architecture.

Screenshot:

Agent Logs:
[aarch uninstall]elastic-agent-diagnostics-2024-11-06T08-56-14Z-00.zip

What's working fine:

• On removing Elastic Defend integration user is able to uninstall elastic-agent.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[amolnater-qasource]

@muskangulati-qasource Please review.

[muskangulati-qasource]

Secondary review is Done for this ticket!

[ycombinator]

@amolnater-qasource Is this bug reproducible with Elastic Agent 8.15.3? Just wondering if it's a regression.

[amolnater-qasource]

Hi @ycombinator

We have revalidated this issue for Elastic Agent- v8.15.3 and found it reproducible there too.

Observations:

• User is unable to uninstall mac agent if x86_64 architecture agent is installed using Elastic Defend integration on mac with ARM architecture.

Logs:
elastic-agent-diagnostics-2024-11-12T04-33-14Z-00.zip

Screenshot:

Artifact Link:
https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.15.3-darwin-x86_64.tar.gz

Please let us know if anything else is required from our end.

Thanks!!

[cmacknz]

I don't think defend supports running x86 emulated binaries on arm, we probably should never have let defend install at all. Then we wouldn't have to deal with uninstalling it.