Skip to content

Permissions required for stateful agentless integrations #118644

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 14 commits into from
Jan 10, 2025
Merged

Permissions required for stateful agentless integrations #118644

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
8a23a22
WIP: permissions required for stateful agentless integrations
orestisfl Dec 2, 2024
b528f7e
system-index
orestisfl Dec 16, 2024
bb19213
fix test
orestisfl Dec 16, 2024
06efb11
allowRestrictedIndices
orestisfl Dec 16, 2024
f5764ef
Allow dot-prefix agentless
orestisfl Dec 16, 2024
cc2a948
Revert elevated permissions
orestisfl Dec 23, 2024
50431a9
Merge commit 'bb0c34e7c3d5b73febcae29491fd030361c3d6ad' into agentles…
orestisfl Dec 23, 2024
a3a4261
Update index templates
orestisfl Jan 8, 2025
db8f1f6
add mappings
orestisfl Jan 8, 2025
e48fc0f
Fix tests
orestisfl Jan 8, 2025
7dba477
Merge branch 'main' into agentless-storage-permissions
orestisfl Jan 9, 2025
1b6420e
Fix StackTemplateRegistryTests
orestisfl Jan 9, 2025
79e5638
Omit default settings
orestisfl Jan 10, 2025
0ab0bab
Merge branch 'main' into agentless-storage-permissions
orestisfl Jan 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/reference/rest-api/security/get-service-accounts.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,21 @@ GET /_security/service/elastic/fleet-server
"view_index_metadata"
],
"allow_restricted_indices": false
},
{
"names": [
"agentless-*",
],
"privileges": [
"read",
"write",
"monitor",
"create_index",
"auto_configure",
"maintenance",
"view_index_metadata"
],
"allow_restricted_indices": false
}
],
"applications": [
Expand Down
2 changes: 2 additions & 0 deletions test/framework/src/main/java/org/elasticsearch/test/rest/ESRestTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -781,6 +781,7 @@ protected Set<String> preserveILMPolicyIds() {
"profiling-60-days",
"profiling-60-days@lifecycle",
"synthetics",
"agentless",
"synthetics@lifecycle",
"traces@lifecycle",
"7-days-default",
Expand Down Expand Up @@ -2215,6 +2216,7 @@ protected static boolean isXPackTemplate(String name) {
case "metrics-tsdb-settings":
case "metrics-mappings":
case "synthetics":
case "agentless":
case "synthetics-settings":
case "synthetics-mappings":
case ".snapshot-blob-cache":
Expand Down
22 changes: 22 additions & 0 deletions x-pack/plugin/core/template-resources/src/main/resources/[email protected]
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
{
"template": {
"mappings": {
"properties": {
"v": {
"type": "object",
"enabled": false
},
"updated_at": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
},
"_meta": {
"description": "default mappings for the agentless index template installed by x-pack",
"managed": true
},
"version": ${xpack.stack.template.version},
"deprecated": ${xpack.stack.template.deprecated}
}
17 changes: 17 additions & 0 deletions x-pack/plugin/core/template-resources/src/main/resources/[email protected]
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{
"template": {
"settings": {
"index": {
"hidden": true,
"number_of_shards": 1,
"number_of_replicas": 1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick: I would suggest to omit these (shard/replica) as they are the defaults.

}
}
},
"_meta": {
"description": "default settings for the agentless index template installed by x-pack",
"managed": true
},
"version": ${xpack.stack.template.version},
"deprecated": ${xpack.stack.template.deprecated}
}
15 changes: 15 additions & 0 deletions x-pack/plugin/core/template-resources/src/main/resources/[email protected]
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"index_patterns": ["agentless-*-*"],
"priority": 100,
"composed_of": [
"agentless@mappings",
"agentless@settings"
],
"allow_auto_create": true,
"_meta": {
"description": "default agentless template installed by x-pack",
"managed": true
},
"version": ${xpack.stack.template.version},
"deprecated": ${xpack.stack.template.deprecated}
}
15 changes: 15 additions & 0 deletions ...rc/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,6 +316,21 @@ public class ServiceAccountIT extends ESRestTestCase {
"view_index_metadata"
],
"allow_restricted_indices": false
},
{
"names": [
"agentless-*"
],
"privileges": [
"read",
"write",
"monitor",
"create_index",
"auto_configure",
"maintenance",
"view_index_metadata"
],
"allow_restricted_indices": false
}
],
"applications": [ {
Expand Down
6 changes: 6 additions & 0 deletions .../src/main/java/org/elasticsearch/xpack/security/authc/service/ElasticServiceAccounts.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,12 @@ final class ElasticServiceAccounts {
RoleDescriptor.IndicesPrivileges.builder()
.indices("content-*", ".search-acl-filter-*")
.privileges("read", "write", "monitor", "create_index", "auto_configure", "maintenance", "view_index_metadata")
.build(),
// Custom permissions required for stateful agentless integrations
RoleDescriptor.IndicesPrivileges.builder()
.indices("agentless-*")
.privileges("read", "write", "monitor", "create_index", "auto_configure", "maintenance", "view_index_metadata")
.allowRestrictedIndices(false)
.build(), },
new RoleDescriptor.ApplicationResourcePrivileges[] {
RoleDescriptor.ApplicationResourcePrivileges.builder()
Expand Down
28 changes: 28 additions & 0 deletions x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,13 @@ public class StackTemplateRegistry extends IndexTemplateRegistry {
public static final String SYNTHETICS_ILM_POLICY_NAME = "synthetics@lifecycle";
public static final String SYNTHETICS_INDEX_TEMPLATE_NAME = "synthetics";

//////////////////////////////////////////////////////////
// Agentless components (for matching agentless-*-* indices)
//////////////////////////////////////////////////////////
public static final String AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME = "agentless@mappings";
public static final String AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME = "agentless@settings";
public static final String AGENTLESS_INDEX_TEMPLATE_NAME = "agentless";

///////////////////////////////////
// Kibana reporting template
///////////////////////////////////
Expand Down Expand Up @@ -199,6 +206,20 @@ private Map<String, ComponentTemplate> loadComponentTemplateConfigs() {
TEMPLATE_VERSION_VARIABLE,
ADDITIONAL_TEMPLATE_VARIABLES
),
new IndexTemplateConfig(
AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
"/[email protected]",
REGISTRY_VERSION,
TEMPLATE_VERSION_VARIABLE,
ADDITIONAL_TEMPLATE_VARIABLES
),
new IndexTemplateConfig(
AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME,
"/[email protected]",
REGISTRY_VERSION,
TEMPLATE_VERSION_VARIABLE,
ADDITIONAL_TEMPLATE_VARIABLES
),
new IndexTemplateConfig(
KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME,
"/[email protected]",
Expand Down Expand Up @@ -287,6 +308,13 @@ protected Map<String, ComponentTemplate> getComponentTemplateConfigs() {
TEMPLATE_VERSION_VARIABLE,
ADDITIONAL_TEMPLATE_VARIABLES
),
new IndexTemplateConfig(
AGENTLESS_INDEX_TEMPLATE_NAME,
"/[email protected]",
REGISTRY_VERSION,
TEMPLATE_VERSION_VARIABLE,
ADDITIONAL_TEMPLATE_VARIABLES
),
new IndexTemplateConfig(
KIBANA_REPORTING_INDEX_TEMPLATE_NAME,
"/[email protected]",
Expand Down
10 changes: 10 additions & 0 deletions .../plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,6 +414,8 @@ public void testSameOrHigherVersionTemplateNotUpgraded() {
versions.put(StackTemplateRegistry.METRICS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
versions.put(StackTemplateRegistry.SYNTHETICS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
versions.put(StackTemplateRegistry.SYNTHETICS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
versions.put(StackTemplateRegistry.AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
versions.put(StackTemplateRegistry.AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
versions.put(StackTemplateRegistry.KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
versions.put(StackTemplateRegistry.TRACES_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
versions.put(StackTemplateRegistry.TRACES_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION);
Expand Down Expand Up @@ -472,6 +474,14 @@ public void testSameOrHigherVersionTemplateNotUpgraded() {
StackTemplateRegistry.SYNTHETICS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
);
versions.put(
StackTemplateRegistry.AGENTLESS_SETTINGS_COMPONENT_TEMPLATE_NAME,
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
);
versions.put(
StackTemplateRegistry.AGENTLESS_MAPPINGS_COMPONENT_TEMPLATE_NAME,
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
);
versions.put(
StackTemplateRegistry.KIBANA_REPORTING_COMPONENT_TEMPLATE_NAME,
StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000)
Expand Down
Loading