Override fleet.ssl.certificate_authorities from env vars in container mode#15427
Merged
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
lorienhu
added
bug
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment was marked as resolved.
This comment was marked as resolved.
ycombinator
reviewed
Jul 9, 2026
lorienhu
force-pushed
the
lhu-issue-15408
branch
from
7813bfd to
adcc236
Compare
This comment has been minimized.
This comment has been minimized.
swiatekm
reviewed
Jul 10, 2026
lorienhu
force-pushed
the
lhu-issue-15408
branch
from
91c4f59 to
ed6863b
Compare
💛 Build succeeded, but was flaky
Failed CI StepsHistory
cc @lorienhu |
ycombinator
approved these changes
Jul 11, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
Contributor
|
@Mergifyio backport 9.5 9.4 9.3 |
Contributor
✅ Backports have been createdDetails
|
This was referenced Jul 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
When in container mode, override
fleet.ssl.certificate_authoritiesfrom env varsFLEET_CA,KIBANA_CA, andELASTICSEARCH_CAinstead of using savedfleet.encvalues.Follows the same first-set-wins fallback chain used in setup_config.go.
Why is it important?
Without this override, an agent running in container mode will crash during startup if
fleet.encstill contains afleet.ssl.certificate_authoritiespath that no longer exists on disk.Checklist
[ ] I have made corresponding changes to the documentation[ ] I have made corresponding change to the default configuration files./changelog/fragmentsusing the changelog toolDisruptive User Impact
N/A
How to test this PR locally
Unit test: TestContainerEnvOverridesFleetTLSPaths
Integration test: TestContainerCMDTLSCertOverride
Manually: Using kind, deploy ECK cluster. Enroll an agent with FLEET_SERVER_CLIENT_AUTH=required and FLEET_CA pointing to a mounted CA bundle. Unmount the CA bundle, unset env vars, and verify that agent restarts healthy.
Related issues
Closes #15408
Relates #14408