Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS] User Attestation for kubernetes installation with Endpoint #2456

Closed
qcorporation opened this issue Sep 14, 2022 · 3 comments
Closed

Comments

@qcorporation
Copy link
Contributor

qcorporation commented Sep 14, 2022

For the 8.5 Release, we will release User Attestation for Endpoint installations in a Kubernetes cluster. The product impact and epic definition are outlined here:
https://github.com/elastic/security-team/issues/3798
[after reading the ticket]

Assumptions

With the 8.4 release, Elastic has public documentation on guiding the user to installing and setting up Endpoint within a Kubernetes cluster.

What's needed

  • A new YAML file will be needed alongside the existing YAML. This new YAML file will include a new container within the pod called elastic-sec-identity. The location of the file should exist here: https://github.com/elastic/endpoint/tree/main/releases/8.5.0/kubernetes/deploy (doesn't exist right now)
  • A description of what is User Attestation and how does it benefit the infosec/devsecops user by having users identify enriched within process events
  • Step by step process of how to deploy the new yaml file (should be the same as the existing Endpoint k8s deployment
  • Document the index of Endpoint
  • Document the new fields populated with the new attestation fields
    process.attested_group, process.attested_user.*
    PR: Add attested user and groups to process ecs#2050
@qcorporation
Copy link
Contributor Author

@qcorporation
Copy link
Contributor Author

@m-sample : Provide two YAML files, 1 as the base yaml and elastic-sec-identity will be additive to the base

@benironside
Copy link
Contributor

Closing this for now since the feature has been pushed indefinitely

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants