Title: Fleet Server on External Ubuntu VM Fails to Bootstrap with ECK Deployment
Dear Community,
I hope you are doing well.
I am trying to deploy a standalone Fleet Server on an Ubuntu VM and connect it to my Elastic Stack, which is deployed on Kubernetes using the ECK Operator.
The Ubuntu VM has full connectivity to my Kubernetes environment, and I have generated all the required certificates for the Fleet Server. I can successfully install and enroll a regular Elastic Agent (with only the System integration) on the VM without any issues. However, when I install the same agent as a Fleet Server, the installation completes successfully, but the Fleet Server remains in the Updating state for some time before eventually going Offline.
While reviewing the Elastic Agent logs, I noticed that Fleet Server attempts to communicate with Elasticsearch using http://localhost:9200. This is unexpected because the installation command specifies my external Elasticsearch HTTPS endpoint, which is reachable from the VM. The Fleet Server policy in Kibana is also configured with the correct Elasticsearch output.
From what I can see:
-
The Fleet Server installation command points to the correct Elasticsearch endpoint.
-
The Elasticsearch endpoint is reachable from the Ubuntu VM.
-
The Fleet Server policy is assigned correctly.
-
The Fleet Server enrolls successfully but fails during the bootstrap/configuration stage.
Another behavior that seems unusual is that, after installing Fleet Server:
-
No
elastic-agent.sockfile is created. -
No local YAML configuration file is generated.
-
The Fleet Server eventually goes offline after remaining in the Updating state.
By comparison, installing the Elastic Agent without the Fleet Server role works perfectly, and the agent stays healthy.
Has anyone encountered a similar issue or knows why Fleet Server would fall back to http://localhost:9200 instead of using the configured Elasticsearch output? Any guidance on what to investigate next would be greatly appreciated.
Thank you.