[Fleet] handle ESO errors in message signing key pair generation #170292
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
joeypoon
added
release_note:skip
joeypoon
force-pushed
the
fix/msg-signing-keys
branch
from
35d05f2 to
9c090d1
Compare
|
Pinging @elastic/fleet (Team:Fleet) |
💚 Build Succeeded
Metrics [docs]
To update your PR or re-run it, just comment with: |
kibanamachine
added
v8.12.0
backport:skip
delanni
pushed a commit
to delanni/kibana
that referenced
this pull request
Nov 6, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
If there was a transient error while fetching the key pair from ESO, the
MessageSigningServicewould generate brand new key pair. This would cause existing endpoints to stop working since the messages would be signed by the new key. This PR adds retry logic with backoff for fetching key pairs from ESO so that a new key isn't generated unless we know for sure there isn't an existing key pair. Key pairs can still be manually rotated using the rotate keys API.Checklist
For maintainers