﻿---
title: Connect Elastic Cloud Enterprise deployments to Elastic Cloud on Kubernetes clusters
description: These steps describe how to configure remote clusters between an Elasticsearch cluster in Elastic Cloud Enterprise and an Elasticsearch cluster running...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/ece-enable-ccs-for-eck
products:
  - Elastic Cloud Enterprise
---

# Connect Elastic Cloud Enterprise deployments to Elastic Cloud on Kubernetes clusters
These steps describe how to configure remote clusters between an Elasticsearch cluster in Elastic Cloud Enterprise and an Elasticsearch cluster running within [Elastic Cloud on Kubernetes (ECK)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/deploy/cloud-on-k8s). Once that’s done, you’ll be able to [run CCS queries from Elasticsearch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/solutions/search/cross-cluster-search) or [set up CCR](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/tools/cross-cluster-replication/set-up-cross-cluster-replication).

## Establish trust between two clusters

The first step is to establish trust between the two clusters.

### Establish trust in the Elastic Cloud Enterprise cluster

1. Save the ECK CA certificate to a file. For a cluster named `quickstart`, run:
   ```sh
   kubectl get secret quickstart-es-transport-certs-public -o go-template='{{index .data "ca.crt" | base64decode}}' > eck.ca.crt
   ```
2. Update the trust settings for the Elastic Cloud Enterprise deployment. Follow the steps provided in [Access clusters of a self-managed environment](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/ece-remote-cluster-self-managed), and specifically the first three steps in **Specify the deployments trusted to be used as remote clusters** using TLS certificate as security model.
   - Use the certificate file saved in the first step.
- Select the Elastic Cloud pattern and enter `default.es.local` for the `Scope ID`.
3. Select `Save` and then download the CA Certificate and `trust.yml` file. These files can also be retrieved in the `Security` page of the deployment. You will use these files in the next set of steps.


### Establish trust in the ECK cluster

1. Upload the Elastic Cloud Enterprise certificate (that you downloaded in the last step of the previous section) as a Kubernetes secret.
   ```sh
   kubectl create secret generic ce-aws-cert --from-file=<path to certificate file>
   ```
2. Upload the `trust.yml` file (that you downloaded in the last step of the previous section) as a Kubernetes config map.
   ```sh
   kubectl create configmap quickstart-trust --from-file=<path to trust.yml>
   ```
3. Edit the Elasticsearch kubernetes resource to ensure the following sections are included. This assumes the Elasticsearch deployment is named `quickstart`. Make sure to replace the `CA-Certificate-Filename` placeholder with the correct value. Note that these configuration changes are required for all `nodeSets`. Applying this change requires all pods in all `nodeSets` to be deleted and recreated, which might take quite a while to complete.
   ```yaml
   spec:
     nodeSets:
     - config:
          xpack.security.transport.ssl.certificate_authorities:
          - /usr/share/elasticsearch/config/other/<CA-Certificate-Filename>
          xpack.security.transport.ssl.trust_restrictions.path:  /usr/share/elasticsearch/config/trust-filter/trust.yml
       podTemplate:
         spec:
           containers:
           - name: elasticsearch
              volumeMounts:
              - mountPath: /usr/share/elasticsearch/config/other
                 name: ce-aws-cert
              - mountPath: /usr/share/elasticsearch/config/trust-filter
                name: quickstart-trust
           volumes:
           - name: ce-aws-cert
              secret:
                secretName: ce-aws-cert
           - configMap:
                name: quickstart-trust
              name: quickstart-trust
   ```


## Set up CCS/R

Now that trust has been established, you can set up CCS/R from the ECK cluster to the Elastic Cloud Enterprise cluster or from the Elastic Cloud Enterprise cluster to the ECK cluster.

### ECK Cluster to Elastic Cloud Enterprise cluster

Configure the ECK cluster [using certificate based authentication](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/ece-remote-cluster-self-managed).

### Elastic Cloud Enterprise cluster to ECK Cluster

Follow the steps outlined in the [ECK documentation](/elastic/docs-content/pull/4067/deploy-manage/remote-clusters/eck-remote-clusters#k8s_configure_the_remote_cluster_connection_through_the_elasticsearch_rest_api).