Use localhost:8221 for enroll request when bootstrapping fleet-server

[michel-laterman]

What does this PR do?

Use localhost:8221 for the enroll request the agent makes when enrolling into a local fleet-server. TLS verification is set to certificate mode if fleet-server isn't running as a plain HTTP server.

Why is it important?

Removes the assumption that DNS resolution to the external fleet address functions during install time.
This can allow something like an external load balancer to use fleet-server's status endpoint to route requests only to fleet-server instances that are online.

Checklist

• I have read and understood the pull request guidelines of this project.
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool
• I have added an integration test or an E2E test Covered by existing bootstrap test

Disruptive User Impact

N/A

How to test this PR locally

Bootstrap an elastic-agent instance with fleet-server; fleet-server should log the enroll request as one made to the internal port.

For example - install with the --develop option, and deebug logs set has the following output:

Elastic Agent will be installed at /Library/Elastic/Agent-Development and will run as a service. Do you want to continue? [Y/n]:y
...
{"log.level":"info","@timestamp":"2026-02-23T14:42:07.022-0800","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/enroll.EnrollWithBackoff","file.name":"enroll/enroll.go","file.line":86},"message":"Starting enrollment to URL: https://localhost:8221/","ecs.version":"1.6.0"}
...
Successfully enrolled the Elastic Agent.
[==  ] Done  [18s]

[mergify]

This pull request does not have a backport label. Could you fix it @michel-laterman? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b3a9a8b

History

• 💔 Build #35045 failed c0da9f3

cc @michel-laterman

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)