Skip to content

[Fleet] added privileges for fleet-synced-integrations #121753

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Feb 10, 2025
Merged

[Fleet] added privileges for fleet-synced-integrations #121753

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
76a013e
added privileges for fleet-synced-integrations
juliaElastic Feb 5, 2025
0bf64c5
Merge branch 'main' into fleet-synced-integrations
juliaElastic Feb 5, 2025
a2484cc
Merge branch 'main' into fleet-synced-integrations
juliaElastic Feb 7, 2025
b73bae8
Update index-templates.asciidoc
juliaElastic Feb 7, 2025
67f8d40
Revert "Update index-templates.asciidoc"
juliaElastic Feb 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions ...org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,11 @@ static RoleDescriptor kibanaSystem(String name) {
RoleDescriptor.IndicesPrivileges.builder().indices("metrics-fleet_server*").privileges("all").build(),
// Fleet reads output health from this index pattern
RoleDescriptor.IndicesPrivileges.builder().indices("logs-fleet_server*").privileges("read", "delete_index").build(),
// Fleet creates and writes this index for sync integrations feature
RoleDescriptor.IndicesPrivileges.builder()
.indices("fleet-synced-integrations")
Copy link
Contributor

@kc13greiner kc13greiner Feb 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heya @juliaElastic! Is there a reason to move away from the usual .fleet-* system indices? Making it a "data index" could have collisions with customer indices.

Copy link
Contributor Author

@juliaElastic juliaElastic Feb 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is because we are building a feature where this index has to be replicated with CCR to remote clusters, so it can't be a system index.

Copy link
Contributor

@kc13greiner kc13greiner Feb 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the delay!

To proceed with this change would you please update the PR description with a Reason section stating your requirement above.

And would you also be able to update this document to include this new index in the Avoid index pattern collisions section: https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html

Copy link
Contributor Author

@juliaElastic juliaElastic Feb 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the PR description.

Do you know where to update the documentation, or is there an elasticsearch docs team to reach out to?

Copy link
Contributor

@kc13greiner kc13greiner Feb 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for updating the description!

The docs are located in this (elasticsearch) repo: docs/reference/indices/index-templates.asciidoc

Copy link
Contributor Author

@juliaElastic juliaElastic Feb 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, updated here: https://github.com/elastic/elasticsearch/pull/121753/files#diff-a3c27c5107ae1f4a617a6f0006307d2b2d4092f844a1e256e7019ccfc5bc21f8

It seems there is a documentation freeze: #121753 (comment)
This feature is for 9.1 the earliest, what should we do?

Copy link
Contributor

@kc13greiner kc13greiner Feb 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's remove the docs from this PR and get these privileges merged to unblock the work.

Then create an issue to add the docs after the freeze is lifted in a few weeks.

Copy link
Contributor

@kc13greiner kc13greiner Feb 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry for the confusion 😵‍💫

Copy link
Contributor Author

@juliaElastic juliaElastic Feb 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, reverted
added as a task here elastic/kibana#206237

.privileges("create_index", "manage", "read", "write")
.build(),
// Legacy "Alerts as data" used in Security Solution.
// Kibana user creates these indices; reads / writes to them.
RoleDescriptor.IndicesPrivileges.builder()
Expand Down