Fleet: Unable to decrypt attribute "fleet_enroll_username"

[BenB196]

Hi All,

I ran into this bug: Ingest Management: Failed to decrypt "fleet_enroll_username" attribute · Issue #68750 · elastic/kibana · GitHub, and was wondering if anyone knows how to fix this?

The encryption key changed at some point, I've since added a static encryption key but I was unable to find a way to properly fix this issue.

[nchaulet (Nicolas Chaulet)]

Hi @BenB196

If the encryption key changed you probably will have the delete the Saved Object that fleet use for settings (you will have the revisit the Fleet app in Kibana and reconfigure it after)

Probably something like

POST .kibana/_delete_by_query
{
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "type": [
              "ingest_manager_settings"
            ]
          }
        }
      ]
    }
  }
}

[BenB196]

@nchaulet I tried running the command you provided and got the following output:

#! this request accesses system indices: [.kibana_7.12.1_001], but in a future major version, direct access to system indices will be prevented by default
{
  "took" : 13,
  "timed_out" : false,
  "total" : 1,
  "deleted" : 1,
  "batches" : 1,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : [ ]
}

However, it doesn't appear to have worked, as when I go back to the fleet screen I continue to see the same error.

[nchaulet (Nicolas Chaulet)]

My bad the saved object to delete here is the output one, this should do the trick

POST .kibana/_delete_by_query
{
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "type": [
              "ingest-outputs"
            ]
          }
        }
      ]
    }
  }
}

[BenB196]

Thanks, that did it .