Unable to enroll fleet server as assinged policy does not have fleet server input

Hi,

I am setting up fleet-server in air-gap environment. However, I am unable to enroll the fleet-server to elasticsearch. I am having the below error.

2021-07-05T22:37:11.552+0800 INFO cmd/enroll_cmd.go:300 Generating self-signed certificate for Fleet Server
2021-07-05T22:37:12.847+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:18.895+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:24.951+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:31.001+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:37.045+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:43.104+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:44.110+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:37:46.125+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:47.134+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:37:51.171+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:52.172+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:37:58.189+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:59.199+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:05.227+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:07.227+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:08.228+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:14.238+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:15.238+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:21.243+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:23.244+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:24.246+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:30.258+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:31.262+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:37.271+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:39.280+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:40.283+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:46.289+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:47.292+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:53.305+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:54.308+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:55.308+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:56.310+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:39:02.420+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:39:03.420+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:39:06.447+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:39:07.453+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
Error: fleet-server never started by elastic-agent daemon: context canceled
Error: enroll command failed with exit code: 12021-07-05T22:37:11.552+0800 INFO cmd/enroll_cmd.go:300 Generating self-signed certificate for Fleet Server
2021-07-05T22:37:12.847+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:18.895+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:24.951+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:31.001+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:37.045+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:43.104+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Starting
2021-07-05T22:37:44.110+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:37:46.125+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:47.134+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:37:51.171+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:52.172+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:37:58.189+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:37:59.199+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:05.227+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:07.227+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:08.228+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:14.238+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:15.238+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:21.243+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:23.244+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:24.246+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:30.258+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:31.262+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:37.271+0800 INFO cmd/enroll_cmd.go:648 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:39.280+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:40.283+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:46.289+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:47.292+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:53.305+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:54.308+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:38:55.308+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:38:56.310+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:39:02.420+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:39:03.420+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
2021-07-05T22:39:06.447+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Starting
2021-07-05T22:39:07.453+0800 INFO cmd/enroll_cmd.go:643 Fleet Server - Error - assigned policy does not have fleet-server input
Error: fleet-server never started by elastic-agent daemon: context canceled
Error: enroll command failed with exit code: 1

May I know where I can add the server input?

I'm not sure if this error is related to the air-gapped environment. Did you run the Package Registry? Is it accessible?

Kibana should have added the fleet-server integration to the Default Fleet Server policy. Being air-gapped you will need to run the package registry as well (as @mtojek mentions).

You can manually add the integration by going to the Default Fleet Server policy and add the fleet-server integration.

yes. I am running it in an air-gap environment. May I know how I can setup the package registry? The kibana and elasticsearch version i am using is 7.13.2

Docs: GitHub - elastic/package-storage: Package storage for packages served through the package registry service

I have run the docker run -it docker.elastic.co/package-registry/distribution:production
below is the message generated
...
2021/07/11 17:31:19 zscaler 0.2.0 /packages/production/zscaler/0.2.0
2021/07/11 17:31:22 368 package manifests loaded.

However, I cannot connect to the port
curl -f http://127.0.0.1:8080
curl: (7) Failed to connect to 127.0.0.1 port 8080: Connection refused

May I know what is the error?

Hi I have managed to get my elastic package registry up and running. I have also changed the xpack.fleet.registryUrl: "http://package-registry.corp.net:8080" in kibana config. However, I am still getting the following error:
"Error connecting to package registry: request to https://epr.elastic.co/search?package=system&internal=true&experimental=true&kibana.version=7.13.2 failed, reason: getaddrinfo ENOTFOUND epr.elastic.co"

below is my kibana configmap file
kibana.yml: |-
server.host: 0.0.0.0
server.ssl.enabled: true
server.ssl.certificate: /usr/share/kibana/config/certs/kibana/tls.crt
server.ssl.key: /usr/share/kibana/config/certs/kibana/tls.key
xpack.encryptedSavedObjects.encryptionKey: ${ELASTICSEARCH_OBJECT_KEY}
xpack.security.enabled: true
xpack.fleet.enabled: true
xpack.fleet.registryUrl: ${REGISTRY_HOSTS}
xpack.fleet.agents.enabled: true
xpack.fleet.agents.tlsCheckDisabled: true
elasticsearch:
hosts: ${ELASTICSEARCH_HOSTS}
username: ${ELASTICSEARCH_USER}
password: ${ELASTICSEARCH_PASSWORD}
ssl:
key: /usr/share/kibana/config/certs/es/tls.key
certificate: /usr/share/kibana/config/certs/es/tls.crt

@nchaulet Any ideas on why that setting would not be picked up by Kibana? ^

@cheapsupps are you using an enterprise licence of Kibana? currently it's only possible to configure the registry url if you have an enterprise licence.