Development agent gets unhealthy on adding Elastic Defend. when not added to the primary agent.

[amolnater-qasource]

Kibana Build details:

VERSION: 8.15.0 SNAPSHOT
BUILD: 75674
COMMIT: c47f4833230ac0c14af5c4669d68ab41ceac4dd6

Preconditions:

1. 8.15.0-SNAPSHOT Kibana cloud environment should be available.

Steps to reproduce:

1. Install a primary agent with Agent policy 1.
2. Install development agent with Agent policy 2.
3. Now add Elastic Defend to Agent policy 2.
4. Observe agent gets unhealthy on adding Elastic Defend to development agent.

Expected Result:
Development agent should remain healthy on adding Elastic Defend. when not added to the primary agent.

Screenshot:

Agent Logs:
elastic-agent-diagnostics-2024-06-26T09-29-38Z-00.zip

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[amolnater-qasource]

@manishgupta-qasource Please review.

[manishgupta-qasource]

Secondary Review for this ticket is Done

[amolnater-qasource]

JFI @pierrehilbert

[pierrehilbert]

As discussed earlier today I think this is an expected behavior (as Endpoint probably requires specific path to be able to work correctly) but @cmacknz will be able to confirm.

[cmacknz]

You should not be able to run Defend twice. You should be able to run Defend in the development agent when it is not in the primary agent.

[blakerouse]

@cmacknz I don't believe that is true, because the development Elastic Agent will be installed into a slightly different path. Endpoint requires that Elastic Agent be installed at a specific location any deviation from that path will cause it not to work.

[jlind23]

Hence I believe it validates #5007 (comment) and this is indeed an expected behaviour. @pierrehilbert @cmacknz do you think we should document this somewhere?

[cmacknz]

I will document this in the readme section for the development agent. Internal uses will have the primary agent running elastic agent all the time, so it wouldn't work because of that anyway.