How to deploy Elastic Agents in air-gapped environments
Deploying Elastic Agents in air-gapped or highly restricted networks presents a significant challenge due to the inability to download components directly from the internet. This manual process involves repetitive downloads of binaries, endpoint artifacts, and security signatures for each release, leading to inefficiencies and potential errors. To address this, a tool called artifacts-bundler has been developed to automate the collection of these necessary files.The bundler offers two primary deployment strategies: creating a single tarball for distribution via a web server or building a self-contained Docker image. Both methods consolidate Elastic Agent binaries, security endpoint artifacts, APM server, Fleet Server, and manifest files into a manageable package. This package can then be transferred to the target environment either over the network or via physical media like USB drives.Once transferred, the tarball can be extracted and served by a web server like NGINX, with proper configuration for file access and ETag support crucial for endpoint updates. Alternatively, the Docker image can be loaded and run directly in containerized environments. For Kubernetes, provided manifests can be used for deployment.The key benefit is reconfiguring the Elastic Stack to point to this local artifact server. In Kibana, the Agent Binary Download URL is updated in Fleet settings. For Elastic Defend Endpoint security, the global artifact download source for each platform is similarly adjusted. This ensures all agent deployments, updates, and security signature fetches are served from the internal, accessible mirror. The tool and its source code are available on GitHub, providing a robust solution for offline Elastic deployments.