Fleet Server client certificate authentication on ECK

Fleet Server can be configured to require client certificates from connecting Elastic Agents, providing mutual TLS (mTLS) on the Elastic Agent-to-Fleet Server connection. This is independent of, and can be combined with, Elasticsearch client certificate authentication.

Set spec.http.tls.client.authentication to true on the Fleet Server Agent resource:

apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
  name: fleet-server
spec:
  version: 9.4.4
  mode: fleet
  fleetServerEnabled: true
  http:
    tls:
      client:
        authentication: true
		

When enabled, ECK does the following:

• Sets the FLEET_SERVER_CLIENT_AUTH environment variable to required on Fleet Server pods.
• Automatically generates and manages client certificates for the Fleet Server's internal Elastic Agent process and for all Elastic Agents that reference this Fleet Server.

Connecting Elastic Agents require no additional configuration — ECK manages the full certificate lifecycle automatically.

To provide your own client certificate for an Elastic Agent connecting to a Fleet Server with client authentication enabled, set clientCertificateSecretName in the fleetServerRef. When you provide a custom certificate, ECK automatically configures Fleet Server to trust it — no additional trust configuration is required.

apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
  name: elastic-agent
spec:
  version: 9.4.4
  mode: fleet
  fleetServerRef:
    name: fleet-server
    clientCertificateSecretName: my-custom-client-cert
		

The referenced secret must contain tls.crt and tls.key entries:

apiVersion: v1
kind: Secret
metadata:
  name: my-custom-client-cert
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded certificate>
  tls.key: <base64-encoded private key>
		

To turn off client authentication, set spec.http.tls.client.authentication to false or remove it from the Fleet Server Agent resource:

apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
  name: fleet-server
spec:
  http:
    tls:
      client:
        authentication: false
		

ECK handles the transition gracefully.