Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Actionable error message when attempting to enroll an unprivileged Agent as a privileged user #4889

Open
1 task
kaanyalti opened this issue Jun 8, 2024 · 7 comments · May be fixed by #6038
Open
1 task

Actionable error message when attempting to enroll an unprivileged Agent as a privileged user #4889

kaanyalti opened this issue Jun 8, 2024 · 7 comments · May be fixed by #6038
Assignees
@kaanyalti
Labels
enhancement New feature or request good first issue Good for newcomers Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

Comments

@kaanyalti
Copy link
Contributor

kaanyalti commented Jun 8, 2024 •
edited by ycombinator
Loading

Version: 8.14.0
Operating System: Ubuntu 24.04 LTS
Platform: arm64

While working on this issue comparing root and unprivileged elastic agents, I encountered an error with the enroll command when using unprivileged agent.

Steps to Reproduce:

  1. Deploy ESS v8.14.0
  2. Create agent policy with system integration
  3. Install fleet managed agent with the unprivileged flag sudo ./elastic-agent install --unprivileged --url=<fleet url> --enrollment-token=<token>
  4. Unenroll the agent
  5. Enroll the agent sudo elastic-agent enroll --url=<fleet url> --enrollment-token=<token>
  6. Agent enrollment gets confirmed, but incoming data does not get confirmed
  7. Agent status in fleet ui is stuck in updating
  8. Running sudo elastic-agent status we get the following error
Error: failed to communicate with Elastic Agent daemon: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial unix /opt/Elastic/Agent/elastic-agent.sock: connect: connection refused"
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.14/fleet-troubleshooting.html

Definition of Done

Based on discussion in the comments:
@kaanyalti kaanyalti added the bug Something isn't working label Jun 8, 2024
@kaanyalti
Copy link
Contributor Author

cc: @ycombinator @cmacknz

@kaanyalti kaanyalti mentioned this issue Jun 8, 2024
Closed
@cmacknz cmacknz added the Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team label Jun 10, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

@blakerouse
Copy link
Contributor

If you installed the Elastic Agent with --unprivileged then running sudo elastic-agent enroll should fail as you are seeing. sudo is trying to run the command as root, but your Elastic Agent is not running as root.

You have a few options to make this work:

  1. sudo -u elastic-agent-user elastic-agent enroll ...
  2. Add your user to the elastic-agent group, create a new shell or use newgrp to ensure that the system knows that your user is now in that group. Then you can just call elastic-agent enroll.

@cmacknz
Copy link
Member

cmacknz commented Jun 10, 2024

When we are unprivileged, can we put that suggestion directly in the error here? I don't think this is the last time we'll see this problem from users otherwise.

@blakerouse blakerouse mentioned this issue Jun 10, 2024
Closed
@blakerouse
Copy link
Contributor

Updating the error message to have a standard message about permissions would be helpful. Pointing to documentation with more information on permissions in this mode would also be helpful.

@pierrehilbert
Copy link
Contributor

I have the same feeling than @cmacknz here.
In the same way we are having a warning message when we are not using sudo in privileged mode we should have a warning message when we are using sudo in unprivileged.
And of course, we should make it obvious in the unprivileged doc.

@ycombinator ycombinator changed the title Error enrolling unprivileged elastic agent [linux] Actionable error message when attempting to enroll an unprivileged Agent as a privileged user Jun 10, 2024
@ycombinator ycombinator mentioned this issue Jun 10, 2024
Merged
@ycombinator
Copy link
Contributor

I updated the title of this issue and added a Definition of Done to reflect the discussion about improving the error message. As for documentation, I've brought that to @kilfoyle's attention via elastic/ingest-docs#1087 (comment).

@ycombinator ycombinator changed the title Actionable error message when attempting to enroll an unprivileged Agent as a privileged user Actionable error message when attempting to enroll an unprivileged Agent as a privileged user Jun 10, 2024
@ycombinator ycombinator mentioned this issue Jun 10, 2024
Open
1 task
@ycombinator ycombinator added enhancement New feature or request and removed bug Something isn't working labels Jun 11, 2024
@ycombinator ycombinator added the good first issue Good for newcomers label Jul 8, 2024
@kaanyalti kaanyalti linked a pull request Nov 14, 2024 that will close this issue
Draft
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kaanyalti kaanyalti

Labels
enhancement New feature or request good first issue Good for newcomers Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

enhancement(4889): added check to abort enrolling if user is privileg… kaanyalti/elastic-agent
6 participants
@ycombinator @pierrehilbert @cmacknz @blakerouse @elasticmachine @kaanyalti