﻿---
title: Connect Elastic Cloud Hosted deployments to Elastic Cloud on Kubernetes clusters
description: These steps describe how to configure remote clusters between an Elasticsearch cluster in Elastic Cloud Hosted (ECH) and an Elasticsearch cluster running...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/ec-enable-ccs-for-eck
products:
  - Elastic Cloud Hosted
---

# Connect Elastic Cloud Hosted deployments to Elastic Cloud on Kubernetes clusters
These steps describe how to configure remote clusters between an Elasticsearch cluster in Elastic Cloud Hosted (ECH) and an Elasticsearch cluster running within [Elastic Cloud on Kubernetes (ECK)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/deploy/cloud-on-k8s). Once that’s done, you’ll be able to [run CCS queries from Elasticsearch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/solutions/search/cross-cluster-search) or [set up CCR](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication).

## Establish trust between the two clusters

The first step is to establish trust between the two clusters, by adding the CA certificate and trust details of each environment into the other.
This guide uses TLS certificates to secure remote cluster connections and follows a similar approach to [Access clusters of a self-managed environment](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/ec-remote-cluster-self-managed).

### Establish trust in the ECH cluster

To configure trust in the ECH deployment:
1. Save the Elasticsearch transport CA certificate of your ECK deployment. For an Elasticsearch cluster named `quickstart`, run:
   ```sh
   kubectl get secret quickstart-es-transport-certs-public -o go-template='{{index .data "ca.crt" | base64decode}}' > eck-ca.crt
   ```
   This command saves the certificate to `eck-ca.crt`.
2. Update the trust settings for the Elastic Cloud Hosted deployment:
   1. From the **Security** menu, select **Remote Connections > Add trusted environment**, choose **Self-managed**, and click **Next**.
2. Select **Certificates** as the authentication mechanism and click **Next**.
3. In **Add trusted CA certificate**, upload the `eck-ca.crt` file retrieved in the previous step.
4. In **Select trusted clusters**, configure the following:
   - Select **Trust clusters whose Common Name follows the Elastic pattern**.
- For **Scope ID**, enter `<kubernetes-namespace>.es.local`, replacing `<kubernetes-namespace>` with the namespace of your ECK cluster.
- In **Trust**, select **All deployments**.
5. In **Name the environment**, enter a name for the trusted environment. That name will appear in the trust summary of your deployment’s **Security** page.
6. Select **Create trust** to complete the configuration.
7. On the confirmation screen, when prompted **Have you already set up trust from the other environment?**, select **No, I have NOT set up trust from the other environment yet**. Download both the ECH deployment CA certificate and the `trust.yml` file. These files can also be retrieved from the **Security** page of the deployment. You’ll use these files to configure trust in the ECK deployment.


### Update the downloaded `trust.yml` file for ECK compatibility

The `trust.yml` file you downloaded from the Cloud UI includes a subject name pattern that isn't valid for your ECK cluster. Before using it in your ECK cluster, you need to update the file with the pattern that matches your cluster.
Replace the line corresponding to the `Scope ID` you entered when configuring trust in the ECH deployment:
```sh
"*.node.*.cluster.<kubernetes-namespace>.es.local.account"
```

Replace it with the correct subject name for your ECK cluster. The new subject name should use the following pattern:
```sh
"*.node.<cluster-name>.<kubernetes-namespace>.es.local"
```

<important>
  If you don’t update this entry, Elasticsearch nodes of your ECK deployment might fail to start or join the cluster due to failed trust validation.
</important>

For example, the original downloaded file might contain the following:
```yaml
trust.subject_name:
  - "*.node.2dc556bb4bd040e00d0135683b66a2f6.cluster.1075999151.account" 
  - "*.node.*.cluster.<kubernetes-namespace>.es.local.account" 
```

For an ECK cluster named `quickstart` in the `default` namespace, the updated file should look like the following:
```yaml
trust.subject_name:
  - "*.node.2dc556bb4bd040e89d0135683b66a2f6.cluster.1075708151.account"
  - "*.node.quickstart.default.es.local"
```

Apply the changes and save the `trust.yml` file.

### Establish trust in the ECK cluster

To configure trust in the ECK deployment:
1. In the same namespace as your Elasticsearch cluster, upload the ECH CA certificate that you downloaded from the Cloud UI as a Kubernetes secret:
   ```sh
   kubectl create secret generic remote-ech-ca --from-file=ca.crt=<path-to-CA-certificate-file> -n <namespace>
   ```
2. In the same namespace as your Elasticsearch cluster, upload the updated `trust.yml` file as a Kubernetes config map. For a cluster named `quickstart`, run the following command:
   ```sh
   kubectl create configmap quickstart-trust-ech --from-file=trust.yml=<path-to-trust.yml> -n <namespace>
   ```
3. Edit the Elasticsearch Kubernetes resource to reference the ECH CA certificate and trust.yml file. This example assumes that the Kubernetes secret and config map created in the previous steps are named `remote-ech-ca` and `quickstart-trust-ech`, respectively:
   <note>
   Apply these changes to all `nodeSets` of your cluster. Updating this configuration will restart all Elasticsearch pods, which might take some time to complete.
   </note>
   ```yaml
   spec:
     nodeSets:
     - config:
         xpack.security.transport.ssl.certificate_authorities:
           - /usr/share/elasticsearch/config/ech-ca/ca.crt
         xpack.security.transport.ssl.trust_restrictions.path: /usr/share/elasticsearch/config/trust-filter/trust.yml
       podTemplate:
         spec:
           containers:
           - name: elasticsearch
             volumeMounts:
               - mountPath: /usr/share/elasticsearch/config/ech-ca
                 name: remote-ech-ca
               - mountPath: /usr/share/elasticsearch/config/trust-filter
                 name: eck-ech-trust
           volumes:
             - name: remote-ech-ca
               secret:
                 secretName: remote-ech-ca 
             - name: eck-ech-trust
               configMap:
                 name: quickstart-trust-ech 
   ```


## Set up CCS/R

Now that trust has been established, you can set up CCS/R from the ECK cluster to the ECH cluster or from the ECH cluster to the ECK cluster.

### ECK Cluster to Elastic Cloud Hosted cluster

Configure the ECH deployment as a remote on your ECK cluster following [Connect Elastic Cloud Hosted deployments to self-managed clusters > Connect to the remote cluster](/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/ec-remote-cluster-self-managed#ec_connect_to_the_remote_cluster_4) steps.

### Elastic Cloud Hosted cluster to ECK Cluster

Follow the steps outlined in the [ECK documentation](/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/eck-remote-clusters#k8s_configure_the_remote_cluster_connection_through_the_elasticsearch_rest_api) to expose the transport layer of your ECK cluster, and configure the ECK cluster as a remote of your ECH deployment.