Starting with version 7.8.0, you can now run Elasticsearch on ARM-64 architectures

<p>One of Elastic’s guiding principles is to be where our users are. We publish our products for several platforms in a variety of formats, so that you can get up-and-running as quickly as possible.
</p><p>With the increasing popularity of ARM-based architectures, we wanted to make sure that our users could run Elasticsearch on ARM as well as x86-64. Starting from version 7.8.0, you can <a href="https://www.elastic.co/downloads/elasticsearch">download</a> Linux artifacts for <a href="https://en.wikipedia.org/wiki/AArch64" target="_blank">64-bit ARM architectures</a> (AArch64). The Docker image is&nbsp;now <a href="https://www.docker.com/blog/tag/multi-architecture/" target="_blank">multi-architecture</a>, meaning that you can pull and run Elasticsearch on ARM exactly as you would on an x86-64 system, either from <a href="https://hub.docker.com/_/elasticsearch" target="_blank">Docker Hub</a> or from Elastic’s Docker registry:
</p><pre>docker pull docker.elastic.co/elasticsearch/elasticsearch:7.8.0
</pre><p>While these ARM artifacts are not yet supported for production, we’re excited to make our ARM artifacts available to early adopters. We’d love for you to try running Elasticsearch on ARM and&nbsp;<a href="https://discuss.elastic.co/">give us feedback</a>. We’re working on publishing ARM artifacts for our other product offerings as well, and your input can help us get there faster.
</p>

blog-banner-green-acorns.jpg

blog-thumb-green-acorns.jpg

Running Elasticsearch on ARM

<p>We’re thrilled to announce that with the release of Elastic Cloud Enterprise (ECE) 2.3, role-based access control and authentication with external sources are now generally available. These features allow you to have multiple users whose access to the ECE platform is controlled by role. You can add users natively in ECE and connect your own directory servers or identity providers to give access to your existing users.
</p>
<p>We initially added beta support for these features in <a href="/blog/elastic-cloud-enterprise-2-2-0-released" target="_blank">ECE 2.2</a>. As well as ironing out bugs with 2.3, we’ve added support for Active Directory in addition to the existing LDAP and SAML options.
</p>
<h2>How does it work?</h2>
<p>Enabling RBAC for ECE adds a security deployment, which is a system deployment that manages all of the authentication configuration and permissions. When a user attempts to log in, ECE verifies the authentication using the security deployment, falling back to the system users if necessary. If the user successfully authenticates, ECE applies their assigned roles and translates them into fine-grained permissions that control what data each user can see and what actions they can take.
</p>
<p>Note that a user’s ECE roles are separate from whatever credentials the user holds for the deployments hosted in ECE. A user could have no access to ECE but administrative access to the hosted deployments, and vice versa.
</p>
<h2>What roles are available?</h2>
<p>ECE offers a rich set of operations, both at the platform and deployment level. In order to save administrators the effort of defining and maintaining their own role definitions, ECE provides a set of predefined roles that cover the most common use cases. These roles will be kept updated as more features are delivered, so you don’t need to worry about keeping your own definitions up to date.
</p>
<p>The roles are described below. Users can hold more than one role and combine them as needed — for example, a “Platform admin” can do anything, so there is no need to give them another role. However, a “Platform viewer” can see everything but cannot change anything, so you might choose to combine it with the “Deployments manager” role.
</p>
<h3>Platform admin</h3>
<p>This role allows a user to see all data and perform any operation in ECE in the same way as the system-level <code>admin</code> user (or <code>root</code> in ECE 1.x) that is created during the install process. This role would typically only be held by administrators that are responsible for the entire ECE platform. The “Platform” section in the UI is a good example, as it gives information about e.g. allocators and their deployments, and the ability to vacate an allocator or put it into maintenance mode.
</p>
<h3>Platform viewer</h3>
<p>This role gives view-only permission for the entire platform and hosted deployments. The associated permissions are the same as those held by the <code>readonly</code> system-level user. This is useful for automation, for example, monitoring ECE’s status.
</p>
<h3>Deployments manager</h3>
<p>This role allows a user to create and manage deployments on the platform. A user with this role can perform all actions on a deployment — scale up, scale down, configure snapshots, restart nodes, reset passwords, and more. This role does not allow a user to access any platform-level operations and resources such as deployment templates, instance configurations, allocators, system deployments, etc.
</p>
<p>This is a suitable role for anyone who has responsibility for managing deployments, but has no requirement to see platform-level information, such as development team leads.
</p>
<h3>Deployments viewer</h3>
<p>A user holding this role can view deployments, but cannot modify them in any way. This role is suitable for support staff or development team members.
</p>
<h2>Managing native users
</h2>
<p>The simplest way to get started with RBAC in ECE is to create native users. These are held in the security deployment, in the Elasticsearch native realm. They only support a limited number of attributes: username, full name, email, password, roles, and whether they are currently enabled.
</p>
<p>Click on "Users" in the navigation menu to view your authentication providers, one of which is the "Native users" profile. Opening the profile takes you to a list of all native users. The list includes the two system users that are created by the ECE installer. These users can’t be edited or deleted, and you can’t reset their passwords here — see the <a href="/guide/en/cloud-enterprise/current/ece-manage-system-passwords.html">documentation</a> for further instructions on how to reset passwords.
</p>
<p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt6263f031f9bbb57d/5d39c1b65cb66453b127ab26/rbac-ece-2-3-native-users-demo-blog.gif" data-sys-asset-uid="blt6263f031f9bbb57d" alt="Demo of creating native users" style="display: block; margin: auto;">
</p>
<p>From the "Native users" page you can create, edit, and delete native users. These users can log in to ECE just like the system users, and their access is controlled by the roles you assign to them.
</p>
<h2>User settings page
</h2>
<p>ECE 2.3 also adds a user settings page. Click on the user icon at the top-right of the page, and click "Settings". If you’re logged in as a native user, you can edit your name and email, or change your password. If you’re logged in with a user from an external authentication provider, you’ll see a read-only page with some basic information, the name and type of the authentication profile, and the roles you hold.
</p>
<p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt29033bf68c6711b2/5d39c1f1c3a6d753ac37c0b5/rbac-ece-2-3-user-settings-blog.gif" data-sys-asset-uid="blt29033bf68c6711b2" alt="Demo of editing user settings" style="display: block; margin: auto;">
</p>
<h2>External authentication providers
</h2>
<p>If you already have an LDAP, Active Directory, or SAML server, you can configure ECE to use them for authentication and authorization. You can even configure multiple servers, and authentication will be attempted in the order you set <a href="/guide/en/elastic-stack-overview/7.2/realm-chains.html" target="_blank">in the same way as Elasticsearch</a>. Using your existing authentication sources means that you only have to manage users in one place. The role mapping configuration for an external provider lets you map users’ attributes to roles in ECE, so any changes to users’ attributes, such as group membership, gets picked up by ECE automatically.
</p>
<p>From the auth providers overview page, click "Add provider" and pick a type. On the next page you’ll configure the provider. Let’s walk through the configuration options for a basic LDAP setup.
</p>
<h2></h2>
<p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltb2810d6c8646f88f/5d39c2291f2f0457e07e3c9a/rbac-ece-2-3-create-ldap-provider-blog.gif" data-sys-asset-uid="bltb2810d6c8646f88f" alt="Demo of creating an LDAP provider" style="display: block; margin: auto;">
</p>
<h3>LDAP auth provider
</h3>
<p>General settings:
</p>
<ol>
	<li>Every profile has a name. Besides using it to label the profile, the name is also used to generate a realm ID. Note that once a profile is created, the realm ID never changes.</li>
	<li>At least one LDAP server must be set, including the <code>ldap:</code> or <code>ldaps:</code> protocol at the start. If you choose a DNS-based load-balancing strategy, you can only specify a single server.</li>
	<li>Choose a load-balancing strategy, keeping in mind the above restriction.</li>
</ol>
<p>Trusted certificates:
</p>
<ol start="4">
	<li>If your LDAP server is secured in such a way that clients need to hold particular SSL/TLS certificates, you’ll need to prepare a bundle file and make it available to ECE via a URL. See the <a href="/guide/en/cloud-enterprise/current/ece-create-ldap-profiles.html#ece-prepare-ldap-certificates" target="_blank">documentation</a> for more details.</li>
	<li>If your bundle is password protected, supply the password here.</li>
</ol>
<p>Bind credentials:
</p>
<ol start="6">
	<li>If credentials are required to bind to the LDAP server, you can set them here.</li>
	<li>Alternatively, if credentials are not required then click the “Bind anonymously” toggle.</li>
</ol>
<p>Search mode settings:
</p>
<ol start="8">
	<li>You can specify each of the details for a user search. See the <a href="/guide/en/cloud-enterprise/current/ece-create-ldap-profiles.html#ece-ldap-search-mode" target="_blank">documentation</a> for information on these fields. At a minimum, you’ll probably want to set the “Base DN for users”, for example “cn=users,dc=example,dc=com”.</li>
	<li>Alternatively, if you need to use a template to perform LDAP queries instead, click the “Template” radio button, and supply one or more templates.</li>
</ol>
<p>Group search settings:
</p>
<ol start="10">
	<li>Much like the search mode settings, you can configure how ECE should search for a user’s groups. You’ll probably want to set the “Base DN for groups”, for example “ou=groups,dc=example,dc=com”.</li>
</ol>
<p>Role mappings:
</p>
<ol start="11">
	<li>A user needs to hold one or more roles in order to do anything with ECE. You can specify default roles, which will be assigned to all users that successfully authenticate. For example, you could grant all users the “Deployments viewer” role, so that they could see all the deployments that are hosted in ECE, without being able to edit anything.</li>
	<li>The other method of assigning roles is through role mapping. These are simply rules that say if the user DN or group DN matches some value, then the specified role or roles are assigned. You can have as many mappings as you require — for example, a mapping that give IT Ops users “Deployment viewer”, a mapping that gives all developers “Deployment manager”, and a mapping that gives all administrators “Platform viewer”.</li>
</ol>
<p>When you’re done, click <strong>Create profile</strong>, and ECE reconfigures the security deployment. You should now log in with a variety of LDAP users in order to check that they can authenticate and that their roles are correct. You can explicitly check the roles from the user settings page, as well as by navigating through the UI and ensuring that what they are able to see and do is what you expect.
</p>
<h3>Active Directory and SAML auth providers
</h3>
<p>From a high level, the process is similar to LDAP from ECE’s perspective. You create a SAML or Active Directory auth provider, name it, specify how ECE should communicate with the server, and define the mappings that should be applied.
</p>
<p>See the documentation for a full description of configuring a <a href="/guide/en/cloud-enterprise/current/ece-create-saml-profiles.html" target="_blank">SAML auth provider</a> or an <a href="/guide/en/cloud-enterprise/current/ece-create-ad-profiles.html" target="_blank">Active Directory auth provider</a>.
</p>
<h3>REST API support
</h3>
<p>All of the above operations can also be carried out using the <a href="/guide/en/cloud-enterprise/current/ece-restful-api.html" target="_blank">REST API</a>. For example, to fetch a list of all users, even those that are currently disabled:
</p>
<pre class="prettyprint">GET /api/v1/users?include_disabled=true
</pre>
<p>Let’s say you need to give access to a new sysadmin, Sarah. You could create a new native user for her as follows:
</p>
<pre class="prettyprint">POST /api/v1/users
{
  "user_name": "sarah",
  "security": {
    "roles": ["ece_platform_admin"],
    "password": "deadb33f"
  }
}
</pre>
<p>If you then wanted to change Sarah’s access, you could send a PATCH request with just the field you want to change, in this case the roles:
</p>
<pre class="prettyprint">PATCH /api/v1/users/sarah
{
  "security": {
    "roles": ["ece_platform_viewer"]
  }
}
</pre>
<p>Finally, you could remove Sarah’s account with a DELETE request:
</p>
<pre class="prettyprint">DELETE /api/v1/users/sarah
</pre>
<p>See the <a href="/guide/en/cloud-enterprise/current/Platform_-_Configuration_-_Security_Realms.html" target="_blank">REST API documentation</a> for details and examples of the auth provider endpoints.
</p>
<h3 style="background-color: rgb(255, 255, 255);">Get started today</h3>
<p style="background-color: rgb(255, 255, 255);">For a complete list of the changes in ECE 2.3, be sure to check out the <a href="/guide/en/cloud-enterprise/2.3/index.html" target="_blank">release notes</a>, and if you want to try it out yourself, get started today with a <a href="/downloads/enterprise" target="_blank">free 30-day trial</a>.
</p>

pile-of-old-keys-full-bleed.jpg

pile-of-old-keys-thumbnail.jpg

Role-based access control and external authentication is GA in ECE 2.3

Learn how to get an overview of your clusters' status and recent changes made to them with Elastic Cloud Enterprise.

<p><a href="/cloud">Elastic Cloud</a> is our hosted service that lets you deploy and manage Elasticsearch and Kibana with ease. Now <a href="/cloud/enterprise">Elastic Cloud Enterprise (ECE)</a> brings that same proven platform to your own datacenter. Since ECE shares the same code, it benefits from all the experience that Elastic has gained for more than 2 years of running clusters at scale, from handling node failures through to a streamlined UI.
</p><p>At Elastic we manage thousands of clusters in our Cloud service using the same UI that's now part of ECE. Over time, we found that sometimes it was hard to tell what was happening at any given moment, simply due to the number of hosts, clusters and nodes involves. For example, if a host is starting to fail and it holds 50 nodes of 50 different clusters, all those nodes need to be migrated before we decommission the host.
</p><p>To help us understand the current state of the system, we developed the Activity Feed and Cluster Activity view, both of which feature in <a href="/cloud/enterprise">Elastic Cloud Enterprise (ECE)</a>.
</p><h2>Activity Feed</h2><p>When we're dealing with thousands of clusters, we can't simply display them all on a page and expect our software engineers and site reliability engineers (SREs) to deal with all the data - it simply doesn't scale. Instead, the UI shared by Elastic Cloud and ECE has the Activity Feed. It's a kind of an event log, showing what has happened recently to clusters and what actions are currently pending. Take this example:<br><br>
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt5f5b91476d42ddf2/5fa9892065bdd35303e00a4c/blog-activity-in-ece-1.png" width="840">
</p><p>An SRE looking at this can tell at a glance that one cluster is in the process of being updated, one is being created, one has recently been stopped, and a number of other clusters have finished being created recently.
</p><h2>Cluster Activity</h2><p>When it comes to understanding why a cluster is in a particular state, sometimes our engineers need to know the backstory, and they don't want to go hunting through logs, trying to piece together what changed. This is where the Cluster Activity view comes in:
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt59f9164d0c3c43b0/5fa989204e40cf53001f5083/blog-activity-in-ece-2.png" width="840">
</p><p>This view lists all the attempted changes to a cluster, and what those changes were. It includes attempted changes that didn't succeed - for example, attempting to grow a cluster when there isn't enough disk space to accommodate it. This gives our SREs a complete history of a cluster.
</p><p>They can even drill right down and see diffs of the cluster's configuration, and how long each step of a reconfiguration took.<br>
</p><p><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt2c7e6a0c514743ba/5fa98920faf76f509e12e967/blog-activity-in-ece-3.png" width="840">
</p><h2>Future Improvements</h2><p>We're always looking for ways to streamline our UIs and help our SREs do their job. For example, we're trialling ways to make the cluster history more visual and quicker to digest.
</p><h2>Find Out More</h2><p>Learn more about Elastic Cloud Enterprise at <a href="/cloud/enterprise">elastic.co/cloud/enterprise</a>. You can also <a href="/guide/en/cloud-enterprise/current/index.html">read the documentation online</a>.
</p><p><i>Banner image credit: <a href="http://musicoomph.com">MusicOomph.com</a></i>
</p>

blog-viewing-activity-fb.jpg

blog-viewing-activity-thumb.jpg

​Viewing Activity in Elastic Cloud Enterprise

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Rory Hunter

Register to Attend

Register to Watch

<p>Надсилаючи цю форму ви погоджуєтеся з <a href="/legal/terms-of-use">Умовами надання послуг Elastic</a>. Ваші особисті дані будуть опрацьовані відповідно з <a href="/legal/privacy-statement">Положеннями про конфіденційність Elastic</a>.</p>

Newsletter GDPR Text - Ukrainian

<p>By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.</p>

Communication Preferences - ONLY for /communication-preferences

<p>By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.</p>

Cloud Trial GDPR Text

Intentionally Blank

<p>By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.</p>

Serverless GDPR Text

<p>提交即表示您確認已詳閱並同意我們的<a href="/legal/elastic-cloud-account-terms" target="_blank">服務條款</a>，且同意 Elastic 使用您在上方提供的個人資料<a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">與您聯絡</a>，為您提供相關產品和服務的資訊。如需詳細說明或隨時想停止收到產品和服務資訊，請參閱 <a href="/legal/privacy-statement/" target="_blank">Elastic 的隱私聲明</a>。</p>

Newsletter GDPR Text - TW

<p>By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.</p><p>By submitting this form, I agree to Elastic sharing my contact information with Google Cloud. I also agree to Elastic giving my information to the vendor for the purpose of shipping my food package.</p>

GDPR Text + Google Cloud

<p>Inviando la registrazione (1) esprimi il consenso ai <a href="/legal/terms-of-use">termini e condizioni di Elastic</a> e <a href="/legal/privacy-statement">all’informativa sulla privacy</a>, nonché (2) a ricevere saltuarie e-mail.</p>

Newsletter GDPR Text - Italian

<p>By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.</p>

Newsletter GDPR Text

Load more

Overview

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content.

You'll also receive an email with related content.

You'll also receive an email with related content

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

Author

Articles by Rory Hunter

Running Elasticsearch on ARM

Role-based access control and external authentication is GA in ECE 2.3

Viewing Activity in Elastic Cloud Enterprise

Author

Articles by Rory Hunter

Running Elasticsearch on ARM

Role-based access control and external authentication is GA in ECE 2.3

​Viewing Activity in Elastic Cloud Enterprise

Sign up for Elastic Cloud free trial

Viewing Activity in Elastic Cloud Enterprise