Skip to content

Add missing APM entitlements #123462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Mar 4, 2025
Merged

Add missing APM entitlements #123462

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a58dd34
Add missing APM entitlements
ldematte Feb 26, 2025
4738240
Moving all APM agent permissions to the agent policy
ldematte Feb 27, 2025
6828df0
Merge remote-tracking branch 'upstream/main' into entitlements/missin…
ldematte Feb 27, 2025
e5183d9
Unmute APM tests
ldematte Feb 27, 2025
c684a9d
Merge remote-tracking branch 'upstream/main' into entitlements/missin…
ldematte Mar 3, 2025
80defc5
removed jar/zip paths, added logs dir
ldematte Mar 3, 2025
56ecceb
Merge branch 'main' into entitlements/missing-policies-3
ldematte Mar 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions modules/apm/src/main/plugin-metadata/entitlement-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,3 +89,5 @@ elastic.apm.agent:
properties:
- AsyncProfiler.safemode
- load_native_libraries
- manage_threads
- outbound_network
Copy link
Contributor

@mosche mosche Feb 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wondering, why is elastic.apm.agent needed at all? shouldn't this be covered by the default agent policy?
a bit worrying is that we receive metrics from my QA projects despite not allowing outbound_network here or in the default agent policy 😱

Copy link
Contributor

@mark-vieira mark-vieira Feb 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Were they apm metrics or just generic container metrics provided by metricbeat on the host?

Copy link
Contributor Author

@ldematte ldematte Feb 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue about missing outbound_network but still working might be due to missing instrumentation to URLConnection & derived that we discovered.

why is elastic.apm.agent needed at all

Hypothesis (that I will try to confirm): in the plugin that jar/module is used kind of a client/an API to talk to the agent/to the server?

Copy link
Contributor Author

@ldematte ldematte Feb 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But I do wonder if we need these policies in both places, or just here, or just on the agentEntitlements fixed set.
I'll dig a bit more on this point too.

Copy link
Contributor Author

@ldematte ldematte Feb 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I moved these entitlements to the agentEntitlements policy; considering the dependency is runtimeOnly and the code using these entitlements is in the agent, seems like that is the right place for them.
Tests pass, even though APM tests are really limited - I tried to run ES with-apm-server too and no errors there.
Will also try a Serverless QA deployment before merging.