Stability of the Kibana Fleet API

Elastic Stack Kibana
1

Hi All,

I was wondering what the current stability of the Kibana Fleet API is? I see that it is still in tech preview and there is an open issue for it going GA, but was wonder if it is safe to start investing in building automation processes around it, or if I should hold off longer before investing in starting to use it?

2

Thanks for reaching out @BenB196. Can you articulate what kind of automation are you trying to build with fleet API and the outcomes you'd like to achieve using that automation?

3

Hi @MukeshG sure. Today, I use some standalone Elastic Agents that contain 500+ "integrations" (think a single agent with 500 synthetic ICMP integrations, pinging a whole bunch of stuff). These standalone agents currently are deployed on Kubernetes. The issue I'm running into is that Kubernetes has a 1MB limit on configuration file size, and because of the large number of integrations, I'm occasionally hitting this limit and having to do some hacky workarounds.

These agent configurations are automatically updated from various systems at various times, so manual intervention isn't required.

Instead of using standalone agents and using these hacks. I'd like to just have a script that builds a policy with the 500 integrations then use a fleet managed agent. This would also help in allowing others to easily visualize what the agent configuration looks like.

4

Thanks for explaining the use case and your approach. I think you should be able to use Fleet API to build that automation and rely on fleet to propagate the integration configuration whenever it is updated.
Question: Where would the agent be running in this case, in a K8s pod and docker container? if yes, I am assuming using these instructions: Run Elastic Agent in a container | Fleet and Elastic Agent Guide [master] | Elastic

The API has been experimental/preview stage for few releases and we absolutely want to enable these "infrastructure as a code" type of use cases via fleet API. Having said that we can't guarantee that there wouldn't be any breaking changes. So just make sure to test out the API integration before upgrading the newer versions of Elastic stack.

5

Thanks for the information @MukeshG. Regarding the deployment question:

Today with the standalone agents, they are k8s pod, deployed via: Run standalone Elastic Agent on ECK | Elastic Cloud on Kubernetes [2.1] | Elastic using the configRef method to point to a secret.

Switching to Fleet manage, I would switch to using: Run Fleet-managed Elastic Agent on ECK | Elastic Cloud on Kubernetes [2.1] | Elastic

6

gotcha. Makes sense to use ECK, if you are running on K8s.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.