elastic-cloud-enterprise.sh set-install-password command

NAME

bash elastic-cloud-enterprise.sh set-install-password — Set, rotate, or remove the install password

SYNOPSIS

bash elastic-cloud-enterprise.sh set-install-password
[--pwd NEW_PASSWORD | --generate | --unset]
[--zookeeper-auth ROOT_AUTH] [--secrets PATH_TO_SECRETS_FILE]
[--host-docker-host "PATH_NAME/docker.sock"] [--host-storage-path PATH_NAME]
[--podman] [[--]help]
		

REQUIRED PRIVILEGES

To run this script, a user must be part of the docker group. The host that you run this script on must be the first host that you installed Elastic Cloud Enterprise on or a host that holds the director role, unless you pass the ZooKeeper authorization with --zookeeper-auth. With that parameter, the script can run on any host of the installation.

DESCRIPTION

Sets, rotates, or removes the install password of an Elastic Cloud Enterprise installation.

While an install password is set, the bootstrap secrets that a new host reads when it joins the installation are no longer readable without authentication, and every additional host must be installed with the same password, passed to elastic-cloud-enterprise.sh install with --install-password. Keep the password in a safe place, whether you choose it or let the command generate it. An installation without an install password does not restrict access to the bootstrap secrets, and hosts can join without providing a password.

The password itself is never written to disk or to ZooKeeper. Only a digest of it is kept on the permissions of the bootstrap secrets node. The current install password is therefore not needed to rotate or remove the password, and a lost password can always be replaced with this command.

Exactly one of --pwd, --generate, or --unset must be given. The command never acts on a default: a bare invocation stops with an error and changes nothing.

PARAMETERS

--pwd NEW_PASSWORD

Sets the given install password.

--generate

Sets a newly generated install password and prints it.

--unset

Removes the install password. The bootstrap secrets become readable without authentication again, and hosts can be added without --install-password.

--zookeeper-auth ROOT_AUTH

Specifies the ZooKeeper root authorization to use. With it, the command can run on any host of the installation. The value is the FOUND_ZK_READWRITE environment variable of the director container, which you can read on a coordinator host with docker exec frc-directors-director bash -c 'echo $FOUND_ZK_READWRITE'. Cannot be combined with --secrets.

--secrets PATH_TO_SECRETS_FILE

Specifies a path to a file with secrets, used to access ZooKeeper. The file is not modified. If not specified, the script uses HOST_STORAGE_PATH/bootstrap-state/bootstrap-secrets.json when that file exists, where HOST_STORAGE_PATH is the host storage path used by the Elastic Cloud Enterprise installation, and otherwise reads the credential from the director container on this host. Cannot be combined with --zookeeper-auth.

--host-docker-host /PATH_NAME/docker.sock

Specifies the location of the Docker socket used to communicate with the Docker daemon. Defaults to /var/run/docker.sock.

--host-storage-path PATH_NAME

Specifies the host storage path used by the Elastic Cloud Enterprise installation. Defaults to /mnt/data/elastic. Used for determining the default locations of the secrets file and log files.

Warning

This path cannot be the exact XFS volume mount point. It must be a subdirectory of the mount point. By default, the XFS volume should be mounted at /mnt/data.

--podman

Uses Podman as the container engine instead of Docker.

Set the install password of the installation. From now on, every additional host must be installed with --install-password NEW_PASSWORD:

bash elastic-cloud-enterprise.sh set-install-password --pwd NEW_PASSWORD
		

Set a generated install password. The command prints the password it set:

bash elastic-cloud-enterprise.sh set-install-password --generate
		

Rotate the install password from a host that holds neither the first host nor a director role, using the ZooKeeper authorization read from the director container of a coordinator host:

bash elastic-cloud-enterprise.sh set-install-password --pwd NEW_PASSWORD --zookeeper-auth root:ROOT_PASSWORD
		

Remove the install password, so that hosts can be added without --install-password again:

bash elastic-cloud-enterprise.sh set-install-password --unset
		

Add a host to an installation that has an install password:

bash elastic-cloud-enterprise.sh install --coordinator-host 192.168.50.10 --roles-token 'TOKEN' --install-password NEW_PASSWORD