Skip to content

Commit 0f47cf3

Browse files
orestisflorestisfl
committed
Permissions required for stateful agentless integrations (#118644)
Closes elastic/security-team#11102 Closes elastic/security-team#11104 This allows agentless integrations (via elastic/beats#41446, elastic/kibana#203810) to write to agentless-* indices. Each index is created on-demand by the filebeat client and kibana conditionally extends the API key permissions to allow writing to the index. (cherry picked from commit 3c184b9) # Conflicts: # docs/reference/rest-api/security/get-service-accounts.asciidoc # x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java # x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/service/ElasticServiceAccounts.java
1 parent 2daacef commit 0f47cf3

File tree

9 files changed

+129
-1
lines changed

9 files changed

+129
-1
lines changed

‎docs/reference/rest-api/security/get-service-accounts.asciidoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,21 @@ GET /_security/service/elastic/fleet-server
244244
"auto_configure"
245245
],
246246
"allow_restricted_indices": false
247+
},
248+
{
249+
"names": [
250+
"agentless-*",
251+
],
252+
"privileges": [
253+
"read",
254+
"write",
255+
"monitor",
256+
"create_index",
257+
"auto_configure",
258+
"maintenance",
259+
"view_index_metadata"
260+
],
261+
"allow_restricted_indices": false
247262
}
248263
],
249264
"applications": [

‎test/framework/src/main/java/org/elasticsearch/test/rest/ESRestTestCase.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -808,6 +808,7 @@ protected Set<String> preserveILMPolicyIds() {
808808
"profiling-60-days",
809809
"profiling-60-days@lifecycle",
810810
"synthetics",
811+
"agentless",
811812
"synthetics@lifecycle",
812813
"traces@lifecycle",
813814
"7-days-default",
@@ -2260,6 +2261,7 @@ protected static boolean isXPackTemplate(String name) {
22602261
case "metrics-tsdb-settings":
22612262
case "metrics-mappings":
22622263
case "synthetics":
2264+
case "agentless":
22632265
case "synthetics-settings":
22642266
case "synthetics-mappings":
22652267
case ".snapshot-blob-cache":

‎x-pack/plugin/core/template-resources/src/main/resources/[email protected]‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"template": {
3+
"mappings": {
4+
"properties": {
5+
"v": {
6+
"type": "object",
7+
"enabled": false
8+
},
9+
"updated_at": {
10+
"type": "date",
11+
"format": "strict_date_optional_time||epoch_millis"
12+
}
13+
}
14+
}
15+
},
16+
"_meta": {
17+
"description": "default mappings for the agentless index template installed by x-pack",
18+
"managed": true
19+
},
20+
"version": ${xpack.stack.template.version},
21+
"deprecated": ${xpack.stack.template.deprecated}
22+
}

‎x-pack/plugin/core/template-resources/src/main/resources/[email protected]‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"template": {
3+
"settings": {
4+
"index": {
5+
"hidden": true
6+
}
7+
}
8+
},
9+
"_meta": {
10+
"description": "default settings for the agentless index template installed by x-pack",
11+
"managed": true
12+
},
13+
"version": ${xpack.stack.template.version},
14+
"deprecated": ${xpack.stack.template.deprecated}
15+
}

‎x-pack/plugin/core/template-resources/src/main/resources/[email protected]‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"index_patterns": ["agentless-*-*"],
3+
"priority": 100,
4+
"composed_of": [
5+
"agentless@mappings",
6+
"agentless@settings"
7+
],
8+
"allow_auto_create": true,
9+
"_meta": {
10+
"description": "default agentless template installed by x-pack",
11+
"managed": true
12+
},
13+
"version": ${xpack.stack.template.version},
14+
"deprecated": ${xpack.stack.template.deprecated}
15+
}

‎x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,21 @@ public class ServiceAccountIT extends ESRestTestCase {
284284
"auto_configure"
285285
],
286286
"allow_restricted_indices": false
287+
},
288+
{
289+
"names": [
290+
"agentless-*"
291+
],
292+
"privileges": [
293+
"read",
294+
"write",
295+
"monitor",
296+
"create_index",
297+
"auto_configure",
298+
"maintenance",
299+
"view_index_metadata"
300+
],
301+
"allow_restricted_indices": false
287302
}
288303
],
289304
"applications": [ {

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/service/ElasticServiceAccounts.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,13 @@ final class ElasticServiceAccounts {
156156
// Fleet Server needs "read" privilege to be able to retrieve multi-agent docs
157157
.privileges("read", "write", "create_index", "auto_configure")
158158
.allowRestrictedIndices(false)
159-
.build() },
159+
.build(),
160+
// Custom permissions required for stateful agentless integrations
161+
RoleDescriptor.IndicesPrivileges.builder()
162+
.indices("agentless-*")
163+
.privileges("read", "write", "monitor", "create_index", "auto_configure", "maintenance", "view_index_metadata")
164+
.allowRestrictedIndices(false)
165+
.build(), },
160166
new RoleDescriptor.ApplicationResourcePrivileges[] {
161167
RoleDescriptor.ApplicationResourcePrivileges.builder()
162168
.application("kibana-*")

‎x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,13 @@ public class StackTemplateRegistry extends IndexTemplateRegistry {
111111
public static final String SYNTHETICS_ILM_POLICY_NAME = "synthetics@lifecycle";
112112
public static final String SYNTHETICS_INDEX_TEMPLATE_NAME = "synthetics";
113113

114+
//////////////////////////////////////////////////////////
115+
// Agentless components (for matching agentless-*-* indices)
116+
//////////////////////////////////////////////////////////
117+
public static final String AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME = "agentless@mappings";
118+
public static final String AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME = "agentless@settings";
119+
public static final String AGENTLESS_INDEX_TEMPLATE_NAME = "agentless";
120+
114121
///////////////////////////////////
115122
// Kibana reporting template
116123
///////////////////////////////////
@@ -212,6 +219,20 @@ private Map<String, ComponentTemplate> loadComponentTemplateConfigs() {
212219
TEMPLATE_VERSION_VARIABLE,
213220
ADDITIONAL_TEMPLATE_VARIABLES
214221
),
222+
new IndexTemplateConfig(
223+
AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
224+
"/[email protected]",
225+
REGISTRY_VERSION,
226+
TEMPLATE_VERSION_VARIABLE,
227+
ADDITIONAL_TEMPLATE_VARIABLES
228+
),
229+
new IndexTemplateConfig(
230+
AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME,
231+
"/[email protected]",
232+
REGISTRY_VERSION,
233+
TEMPLATE_VERSION_VARIABLE,
234+
ADDITIONAL_TEMPLATE_VARIABLES
235+
),
215236
new IndexTemplateConfig(
216237
KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME,
217238
"/[email protected]",
@@ -300,6 +321,13 @@ protected Map<String, ComponentTemplate> getComponentTemplateConfigs() {
300321
TEMPLATE_VERSION_VARIABLE,
301322
ADDITIONAL_TEMPLATE_VARIABLES
302323
),
324+
new IndexTemplateConfig(
325+
AGENTLESS_INDEX_TEMPLATE_NAME,
326+
"/[email protected]",
327+
REGISTRY_VERSION,
328+
TEMPLATE_VERSION_VARIABLE,
329+
ADDITIONAL_TEMPLATE_VARIABLES
330+
),
303331
new IndexTemplateConfig(
304332
KIBANA_REPORTING_INDEX_TEMPLATE_NAME,
305333
"/[email protected]",

‎x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -430,6 +430,8 @@ public void testSameOrHigherVersionTemplateNotUpgraded() {
430430
versions.put(StackTemplateRegistry.METRICS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
431431
versions.put(StackTemplateRegistry.SYNTHETICS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
432432
versions.put(StackTemplateRegistry.SYNTHETICS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
433+
versions.put(StackTemplateRegistry.AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
434+
versions.put(StackTemplateRegistry.AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
433435
versions.put(StackTemplateRegistry.KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
434436
versions.put(StackTemplateRegistry.TRACES_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
435437
versions.put(StackTemplateRegistry.TRACES_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
@@ -488,6 +490,14 @@ public void testSameOrHigherVersionTemplateNotUpgraded() {
488490
StackTemplateRegistry.SYNTHETICS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
489491
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
490492
);
493+
versions.put(
494+
StackTemplateRegistry.AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME,
495+
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
496+
);
497+
versions.put(
498+
StackTemplateRegistry.AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
499+
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
500+
);
491501
versions.put(
492502
StackTemplateRegistry.KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME,
493503
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)

0 commit comments

Comments
 (0)