Skip to content

Commit 3c184b9

Browse files
orestisflorestisfl
authored
Permissions required for stateful agentless integrations (#118644)
Closes elastic/security-team#11102 Closes elastic/security-team#11104 This allows agentless integrations (via elastic/beats#41446, elastic/kibana#203810) to write to agentless-* indices. Each index is created on-demand by the filebeat client and kibana conditionally extends the API key permissions to allow writing to the index.
1 parent 1e608dc commit 3c184b9

File tree

9 files changed

+128
-0
lines changed

9 files changed

+128
-0
lines changed

‎docs/reference/rest-api/security/get-service-accounts.asciidoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,21 @@ GET /_security/service/elastic/fleet-server
276276
"view_index_metadata"
277277
],
278278
"allow_restricted_indices": false
279+
},
280+
{
281+
"names": [
282+
"agentless-*",
283+
],
284+
"privileges": [
285+
"read",
286+
"write",
287+
"monitor",
288+
"create_index",
289+
"auto_configure",
290+
"maintenance",
291+
"view_index_metadata"
292+
],
293+
"allow_restricted_indices": false
279294
}
280295
],
281296
"applications": [

‎test/framework/src/main/java/org/elasticsearch/test/rest/ESRestTestCase.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -781,6 +781,7 @@ protected Set<String> preserveILMPolicyIds() {
781781
"profiling-60-days",
782782
"profiling-60-days@lifecycle",
783783
"synthetics",
784+
"agentless",
784785
"synthetics@lifecycle",
785786
"traces@lifecycle",
786787
"7-days-default",
@@ -2215,6 +2216,7 @@ protected static boolean isXPackTemplate(String name) {
22152216
case "metrics-tsdb-settings":
22162217
case "metrics-mappings":
22172218
case "synthetics":
2219+
case "agentless":
22182220
case "synthetics-settings":
22192221
case "synthetics-mappings":
22202222
case ".snapshot-blob-cache":

‎x-pack/plugin/core/template-resources/src/main/resources/[email protected]‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"template": {
3+
"mappings": {
4+
"properties": {
5+
"v": {
6+
"type": "object",
7+
"enabled": false
8+
},
9+
"updated_at": {
10+
"type": "date",
11+
"format": "strict_date_optional_time||epoch_millis"
12+
}
13+
}
14+
}
15+
},
16+
"_meta": {
17+
"description": "default mappings for the agentless index template installed by x-pack",
18+
"managed": true
19+
},
20+
"version": ${xpack.stack.template.version},
21+
"deprecated": ${xpack.stack.template.deprecated}
22+
}

‎x-pack/plugin/core/template-resources/src/main/resources/[email protected]‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"template": {
3+
"settings": {
4+
"index": {
5+
"hidden": true
6+
}
7+
}
8+
},
9+
"_meta": {
10+
"description": "default settings for the agentless index template installed by x-pack",
11+
"managed": true
12+
},
13+
"version": ${xpack.stack.template.version},
14+
"deprecated": ${xpack.stack.template.deprecated}
15+
}

‎x-pack/plugin/core/template-resources/src/main/resources/[email protected]‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"index_patterns": ["agentless-*-*"],
3+
"priority": 100,
4+
"composed_of": [
5+
"agentless@mappings",
6+
"agentless@settings"
7+
],
8+
"allow_auto_create": true,
9+
"_meta": {
10+
"description": "default agentless template installed by x-pack",
11+
"managed": true
12+
},
13+
"version": ${xpack.stack.template.version},
14+
"deprecated": ${xpack.stack.template.deprecated}
15+
}

‎x-pack/plugin/security/qa/service-account/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,21 @@ public class ServiceAccountIT extends ESRestTestCase {
316316
"view_index_metadata"
317317
],
318318
"allow_restricted_indices": false
319+
},
320+
{
321+
"names": [
322+
"agentless-*"
323+
],
324+
"privileges": [
325+
"read",
326+
"write",
327+
"monitor",
328+
"create_index",
329+
"auto_configure",
330+
"maintenance",
331+
"view_index_metadata"
332+
],
333+
"allow_restricted_indices": false
319334
}
320335
],
321336
"applications": [ {

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/service/ElasticServiceAccounts.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,12 @@ final class ElasticServiceAccounts {
166166
RoleDescriptor.IndicesPrivileges.builder()
167167
.indices("content-*", ".search-acl-filter-*")
168168
.privileges("read", "write", "monitor", "create_index", "auto_configure", "maintenance", "view_index_metadata")
169+
.build(),
170+
// Custom permissions required for stateful agentless integrations
171+
RoleDescriptor.IndicesPrivileges.builder()
172+
.indices("agentless-*")
173+
.privileges("read", "write", "monitor", "create_index", "auto_configure", "maintenance", "view_index_metadata")
174+
.allowRestrictedIndices(false)
169175
.build(), },
170176
new RoleDescriptor.ApplicationResourcePrivileges[] {
171177
RoleDescriptor.ApplicationResourcePrivileges.builder()

‎x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,13 @@ public class StackTemplateRegistry extends IndexTemplateRegistry {
100100
public static final String SYNTHETICS_ILM_POLICY_NAME = "synthetics@lifecycle";
101101
public static final String SYNTHETICS_INDEX_TEMPLATE_NAME = "synthetics";
102102

103+
//////////////////////////////////////////////////////////
104+
// Agentless components (for matching agentless-*-* indices)
105+
//////////////////////////////////////////////////////////
106+
public static final String AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME = "agentless@mappings";
107+
public static final String AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME = "agentless@settings";
108+
public static final String AGENTLESS_INDEX_TEMPLATE_NAME = "agentless";
109+
103110
///////////////////////////////////
104111
// Kibana reporting template
105112
///////////////////////////////////
@@ -199,6 +206,20 @@ private Map<String, ComponentTemplate> loadComponentTemplateConfigs() {
199206
TEMPLATE_VERSION_VARIABLE,
200207
ADDITIONAL_TEMPLATE_VARIABLES
201208
),
209+
new IndexTemplateConfig(
210+
AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
211+
"/[email protected]",
212+
REGISTRY_VERSION,
213+
TEMPLATE_VERSION_VARIABLE,
214+
ADDITIONAL_TEMPLATE_VARIABLES
215+
),
216+
new IndexTemplateConfig(
217+
AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME,
218+
"/[email protected]",
219+
REGISTRY_VERSION,
220+
TEMPLATE_VERSION_VARIABLE,
221+
ADDITIONAL_TEMPLATE_VARIABLES
222+
),
202223
new IndexTemplateConfig(
203224
KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME,
204225
"/[email protected]",
@@ -287,6 +308,13 @@ protected Map<String, ComponentTemplate> getComponentTemplateConfigs() {
287308
TEMPLATE_VERSION_VARIABLE,
288309
ADDITIONAL_TEMPLATE_VARIABLES
289310
),
311+
new IndexTemplateConfig(
312+
AGENTLESS_INDEX_TEMPLATE_NAME,
313+
"/[email protected]",
314+
REGISTRY_VERSION,
315+
TEMPLATE_VERSION_VARIABLE,
316+
ADDITIONAL_TEMPLATE_VARIABLES
317+
),
290318
new IndexTemplateConfig(
291319
KIBANA_REPORTING_INDEX_TEMPLATE_NAME,
292320
"/[email protected]",

‎x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,6 +414,8 @@ public void testSameOrHigherVersionTemplateNotUpgraded() {
414414
versions.put(StackTemplateRegistry.METRICS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
415415
versions.put(StackTemplateRegistry.SYNTHETICS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
416416
versions.put(StackTemplateRegistry.SYNTHETICS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
417+
versions.put(StackTemplateRegistry.AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
418+
versions.put(StackTemplateRegistry.AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
417419
versions.put(StackTemplateRegistry.KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
418420
versions.put(StackTemplateRegistry.TRACES_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
419421
versions.put(StackTemplateRegistry.TRACES_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
@@ -472,6 +474,14 @@ public void testSameOrHigherVersionTemplateNotUpgraded() {
472474
StackTemplateRegistry.SYNTHETICS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
473475
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
474476
);
477+
versions.put(
478+
StackTemplateRegistry.AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME,
479+
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
480+
);
481+
versions.put(
482+
StackTemplateRegistry.AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
483+
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
484+
);
475485
versions.put(
476486
StackTemplateRegistry.KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME,
477487
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)

0 commit comments

Comments
 (0)