Read and apply mTLS config from policy

changelog/fragments/1711452432-accept-mTLS-configuration-from-the-policy.yaml

@@ -0,0 +1,36 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: feature
+
+# Change summary; a 80ish characters long description of the change.
+summary: accept mTLS configuration from the policy
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+description: |
+  The Elastic Agent accepts mTLS configuration from the policy.
+  The mTLS configuration from cli flags during install and enroll take precedence over the configuration defined in the policy.
+  As a consequence and empty mTLS configuration from the policy will not remove any configuration applied at install or enroll time.
+
+
+# Affected component; a word indicating the component this changeset affects.
+component:
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/elastic-agent/pull/4398
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234

internal/pkg/agent/application/actions/handlers/handler_action_policy_change.go

@@ -10,12 +10,14 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"slices"
 	"sort"
 	"time"
 
 	"gopkg.in/yaml.v2"
 
 	"github.com/elastic/elastic-agent-libs/transport/httpcommon"
+	"github.com/elastic/elastic-agent-libs/transport/tlscommon"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/actions"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator"
 	"github.com/elastic/elastic-agent/internal/pkg/agent/application/info"
@@ -25,7 +27,7 @@ import (
 	"github.com/elastic/elastic-agent/internal/pkg/config"
 	"github.com/elastic/elastic-agent/internal/pkg/fleetapi"
 	"github.com/elastic/elastic-agent/internal/pkg/fleetapi/acker"
-	"github.com/elastic/elastic-agent/internal/pkg/fleetapi/client"
+	fleetclient "github.com/elastic/elastic-agent/internal/pkg/fleetapi/client"
 	"github.com/elastic/elastic-agent/internal/pkg/remote"
 	"github.com/elastic/elastic-agent/pkg/core/logger"
 )
@@ -104,7 +106,7 @@ func (h *PolicyChangeHandler) Handle(ctx context.Context, a fleetapi.Action, ack
 	}
 
 	h.log.Debugf("handlerPolicyChange: emit configuration for action %+v", a)
-	err = h.handleFleetServerHosts(ctx, c)
+	err = h.handleFleetServerConfig(ctx, c)
 	if err != nil {
 		return err
 	}
@@ -118,11 +120,11 @@ func (h *PolicyChangeHandler) Watch() <-chan coordinator.ConfigChange {
 	return h.ch
 }
 
-func (h *PolicyChangeHandler) handleFleetServerHosts(ctx context.Context, c *config.Config) (err error) {
-	// do not update fleet-server host from policy; no setters provided with local Fleet Server
+func (h *PolicyChangeHandler) handleFleetServerConfig(ctx context.Context, c *config.Config) (err error) {
 	if len(h.setters) == 0 {
 		return nil
 	}
+
 	data, err := c.ToMapStr()
 	if err != nil {
 		return errors.New(err, "could not convert the configuration from the policy", errors.TypeConfig)
@@ -142,29 +144,22 @@ func (h *PolicyChangeHandler) handleFleetServerHosts(ctx context.Context, c *con
 		return nil
 	}
 
-	// only set protocol/hosts as that is all Fleet currently sends
 	prevProtocol := h.config.Fleet.Client.Protocol
 	prevPath := h.config.Fleet.Client.Path
 	prevHost := h.config.Fleet.Client.Host
 	prevHosts := h.config.Fleet.Client.Hosts
 	prevProxy := h.config.Fleet.Client.Transport.Proxy
-	h.config.Fleet.Client.Protocol = cfg.Fleet.Client.Protocol
-	h.config.Fleet.Client.Path = cfg.Fleet.Client.Path
-	h.config.Fleet.Client.Host = cfg.Fleet.Client.Host
-	h.config.Fleet.Client.Hosts = cfg.Fleet.Client.Hosts
-
-	// Empty proxies from fleet are ignored. That way a proxy set by --proxy-url
-	// it won't be overridden by an absent or empty proxy from fleet-server.
-	// However, if there is a proxy sent by fleet-server, it'll take precedence.
-	// Therefore, it's not possible to remove a proxy once it's set.
-	if cfg.Fleet.Client.Transport.Proxy.URL == nil ||
-		cfg.Fleet.Client.Transport.Proxy.URL.String() == "" {
-		h.log.Debug("proxy from fleet is empty or null, the proxy will not be changed")
+
+	var prevTLSNil bool
+	var prevCAs []string
+	var prevCertificateCfg tlscommon.CertificateConfig
+	if h.config.Fleet.Client.Transport.TLS != nil {
+		prevTLSNil = false
+		prevCAs = h.config.Fleet.Client.Transport.TLS.CAs
+		prevCertificateCfg = h.config.Fleet.Client.Transport.TLS.Certificate
 	} else {
-		h.config.Fleet.Client.Transport.Proxy = cfg.Fleet.Client.Transport.Proxy
-		h.log.Debug("received proxy from fleet, applying it")
+		prevTLSNil = true
 	}
-
 	// rollback on failure
 	defer func() {
 		if err != nil {
@@ -173,10 +168,19 @@ func (h *PolicyChangeHandler) handleFleetServerHosts(ctx context.Context, c *con
 			h.config.Fleet.Client.Host = prevHost
 			h.config.Fleet.Client.Hosts = prevHosts
 			h.config.Fleet.Client.Transport.Proxy = prevProxy
+			if prevTLSNil {
+				h.config.Fleet.Client.Transport.TLS = nil
+			} else {
+				h.config.Fleet.Client.Transport.TLS.CAs = prevCAs
+				h.config.Fleet.Client.Transport.TLS.Certificate = prevCertificateCfg
+			}
+			h.log.Debugf("an error happened, reverting fleet-server config")
 		}
 	}()
 
-	client, err := client.NewAuthWithConfig(
+	h.applyConfigWithPrecedence(cfg.Fleet.Client)
+
+	client, err := fleetclient.NewAuthWithConfig(
 		h.log, h.config.Fleet.AccessAPIKey, h.config.Fleet.Client)
 	if err != nil {
 		return errors.New(
@@ -220,21 +224,83 @@ func (h *PolicyChangeHandler) handleFleetServerHosts(ctx context.Context, c *con
 	return nil
 }
 
-func clientEqual(k1 remote.Config, k2 remote.Config) bool {
-	if k1.Protocol != k2.Protocol {
+// applyConfigWithPrecedence applies Proxy and TLS configs, but ignores empty or
+// absent ones.
+// That way a proxy or TLS config set during install/enroll using cli flags
+// won't be overridden by an absent or empty proxy from fleet-server.
+// However, if there is a proxy or TLS config sent by fleet-server, it'll take
+// precedence. Therefore, it's not possible to remove a proxy or TLS config once
+// it's set.
+func (h *PolicyChangeHandler) applyConfigWithPrecedence(cfg remote.Config) {
+	defaultcfg := configuration.DefaultFleetAgentConfig()
+
+	if cfg.Protocol != defaultcfg.Client.Protocol ||
+		cfg.Host != defaultcfg.Client.Host ||
+		!slices.Equal(cfg.Hosts, defaultcfg.Client.Hosts) ||
+		cfg.Path != defaultcfg.Client.Path {
+		h.config.Fleet.Client.Protocol = cfg.Protocol
+		h.config.Fleet.Client.Path = cfg.Path
+		h.config.Fleet.Client.Host = cfg.Host
+		h.config.Fleet.Client.Hosts = cfg.Hosts
+	}
+
+	if cfg.Transport.Proxy.URL == nil ||
+		cfg.Transport.Proxy.URL.String() == "" {
+		h.log.Debugw("proxy from fleet is empty or null, the proxy will not be changed")
+	} else {
+		if h.config.Fleet.Client.Transport.Proxy.URL != nil {
+			h.log.Debugw("received proxy from fleet, applying it",
+				"old_proxy_url", h.config.Fleet.Client.Transport.Proxy.URL.String(),
+				"new_proxy_url", cfg.Transport.Proxy.URL.String())
+		} else {
+			h.log.Debugw("received proxy from fleet, applying it",
+				"old_proxy_url", "nil",
+				"new_proxy_url", cfg.Transport.Proxy.URL.String())
+		}
+		h.config.Fleet.Client.Transport.Proxy = cfg.Transport.Proxy
+	}
+
+	emptyCertificate := tlscommon.CertificateConfig{}
+	if cfg.Transport.TLS != nil {
+		if h.config.Fleet.Client.Transport.TLS == nil {
+			h.config.Fleet.Client.Transport.TLS = &tlscommon.Config{}
+		}
+
+		// client certificate
+		if cfg.Transport.TLS.Certificate == emptyCertificate {
+			h.log.Debug("TLS certificate/key from fleet are empty or null, the TLS config will not be changed")
+		} else {
+			h.config.Fleet.Client.Transport.TLS.Certificate = cfg.Transport.TLS.Certificate
+			h.log.Debug("received TLS certificate/key from fleet, applying it")
+		}
+
+		// CA
+		if len(cfg.Transport.TLS.CAs) == 0 {
+			h.log.Debug("TLS CAs from fleet are empty or null, the TLS config will not be changed")
+		} else {
+			h.config.Fleet.Client.Transport.TLS.CAs = cfg.Transport.TLS.CAs
+			h.log.Debug("received TLS CAs from fleet, applying it")
+		}
+	}
+}
+
+func clientEqual(current remote.Config, new remote.Config) bool {
+	if new.Protocol != "" &&
+		current.Protocol != new.Protocol {
 		return false
 	}
-	if k1.Path != k2.Path {
+	if new.Path != "" &&
+		current.Path != new.Path {
 		return false
 	}
 
-	sort.Strings(k1.Hosts)
-	sort.Strings(k2.Hosts)
-	if len(k1.Hosts) != len(k2.Hosts) {
+	sort.Strings(current.Hosts)
+	sort.Strings(new.Hosts)
+	if len(current.Hosts) != len(new.Hosts) {
 		return false
 	}
-	for i, v := range k1.Hosts {
-		if v != k2.Hosts[i] {
+	for i, v := range current.Hosts {
+		if v != new.Hosts[i] {
 			return false
 		}
 	}
@@ -255,9 +321,24 @@ func clientEqual(k1 remote.Config, k2 remote.Config) bool {
 	}
 
 	// different proxy
-	if k1.Transport.Proxy.URL != k2.Transport.Proxy.URL ||
-		k1.Transport.Proxy.Disable != k2.Transport.Proxy.Disable ||
-		!headersEqual(k1.Transport.Proxy.Headers, k2.Transport.Proxy.Headers) {
+	if new.Transport.Proxy.URL != nil &&
+		current.Transport.Proxy.URL != new.Transport.Proxy.URL ||
+		current.Transport.Proxy.Disable != new.Transport.Proxy.Disable ||
+		!headersEqual(current.Transport.Proxy.Headers, new.Transport.Proxy.Headers) {
+		return false
+	}
+
+	// different TLS config
+	if new.Transport.TLS != nil &&
+		len(new.Transport.TLS.CAs) > 0 &&
+		!slices.Equal(current.Transport.TLS.CAs, new.Transport.TLS.CAs) {
+		return false
+	}
+
+	emptyCert := tlscommon.CertificateConfig{}
+	if new.Transport.TLS != nil &&
+		new.Transport.TLS.Certificate != emptyCert &&
+		current.Transport.TLS.Certificate != new.Transport.TLS.Certificate {
 		return false
 	}