update kibana_system to grant it access to .workflows-* system index (#134067)

Author: talboren

modules/kibana/src/main/java/org/elasticsearch/kibana/KibanaPlugin.java

@@ -60,12 +60,21 @@ public class KibanaPlugin extends Plugin implements SystemIndexPlugin {
         .setAllowedElasticProductOrigins(KIBANA_PRODUCT_ORIGIN)
         .build();
 
+    public static final SystemIndexDescriptor WORKFLOWS_INDEX_DESCRIPTOR = SystemIndexDescriptor.builder()
+        .setIndexPattern(".workflows-*")
+        .setDescription("Workflows system index")
+        .setType(Type.EXTERNAL_UNMANAGED)
+        .setAllowedElasticProductOrigins(KIBANA_PRODUCT_ORIGIN)
+        .setAllowsTemplates()
+        .build();
+
     @Override
     public Collection<SystemIndexDescriptor> getSystemIndexDescriptors(Settings settings) {
         return List.of(
             KIBANA_INDEX_DESCRIPTOR,
             REPORTING_INDEX_DESCRIPTOR,
             ONECHAT_INDEX_DESCRIPTOR,
+            WORKFLOWS_INDEX_DESCRIPTOR,
             APM_AGENT_CONFIG_INDEX_DESCRIPTOR,
             APM_CUSTOM_LINK_INDEX_DESCRIPTOR
         );

modules/kibana/src/test/java/org/elasticsearch/kibana/KibanaPluginTests.java

@@ -20,7 +20,7 @@ public class KibanaPluginTests extends ESTestCase {
     public void testKibanaIndexNames() {
         assertThat(
             new KibanaPlugin().getSystemIndexDescriptors(Settings.EMPTY).stream().map(SystemIndexDescriptor::getIndexPattern).toList(),
-            contains(".kibana_*", ".reporting-*", ".chat-*", ".apm-agent-configuration*", ".apm-custom-link*")
+            contains(".kibana_*", ".reporting-*", ".chat-*", ".workflows-*", ".apm-agent-configuration*", ".apm-custom-link*")
         );
     }
 }

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

@@ -109,7 +109,7 @@ static RoleDescriptor kibanaSystem(String name) {
             new RoleDescriptor.IndicesPrivileges[] {
                 // System indices defined in KibanaPlugin
                 RoleDescriptor.IndicesPrivileges.builder()
-                    .indices(".kibana*", ".reporting-*", ".chat-*")
+                    .indices(".kibana*", ".reporting-*", ".chat-*", ".workflows-*")
                     .privileges("all")
                     .allowRestrictedIndices(true)
                     .build(),