Skip to content

Conversation

@talboren
Copy link
Contributor

@talboren talboren commented Sep 3, 2025

@talboren talboren requested a review from a team as a code owner September 3, 2025 15:53
@elasticsearchmachine
Copy link
Collaborator

@talboren please enable the option "Allow edits and access to secrets by maintainers" on your PR. For more information, see the documentation.

@elasticsearchmachine elasticsearchmachine added needs:triage Requires assignment of a team area label v9.2.0 external-contributor Pull request authored by a developer outside the Elasticsearch team labels Sep 3, 2025
@talboren talboren added the Team:Security Meta label for security team label Sep 3, 2025
@elasticsearchmachine elasticsearchmachine removed the Team:Security Meta label for security team label Sep 3, 2025
@kc13greiner
Copy link
Contributor

Heya @talboren Would you provide some additional context about why all is needed for kibana_system on this index? Generally we don't want such high privileges on system indicies not owned by Kibana

@elasticsearchmachine elasticsearchmachine removed the needs:triage Requires assignment of a team area label label Sep 3, 2025
@talboren
Copy link
Contributor Author

talboren commented Sep 4, 2025

Heya @talboren Would you provide some additional context about why all is needed for kibana_system on this index? Generally we don't want such high privileges on system indicies not owned by Kibana

Brining in more details after talking with @kc13greiner over DMs:

This is all still being managed and owned by Kibana. As part of the One Workflow initiative, we're trying to build things as loosely coupled from Kibana as we can, so if the day comes and we decide to "migrate off" Kibana to a dedicated MT service (for example), the process will be easier (and trying to keep that as long as we can, and the sooner the better :D)
One Workflow will use Elasticsearch as it's database, but not via SavedObjects, same as we do for the execution engine, which is "stateless" and highly decoupled from Kibana.

This is the respective Kibana PR: elastic/kibana#233947

@talboren talboren added the Team:Security Meta label for security team label Sep 4, 2025
@kc13greiner
Copy link
Contributor

++ That sounds reasonable to me. Thank you for the additional context and discussion @talboren 🚀

Copy link
Contributor

@kc13greiner kc13greiner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@talboren talboren enabled auto-merge (squash) September 4, 2025 11:57
@talboren talboren merged commit 258f7fe into main Sep 4, 2025
33 of 34 checks passed
@talboren talboren deleted the 13848-remove-savedobject-dependency-for-workflow branch September 4, 2025 13:02
talboren added a commit to elastic/kibana that referenced this pull request Sep 9, 2025
…33947)

**Migrate workflows from SavedObjects to kbn-storage-adapter with
.workflows-\* system indices**

This PR migrates the workflows management plugin from Kibana
SavedObjects to direct Elasticsearch storage using kbn-storage-adapter,
replacing the SavedObject-based persistence with a hidden
.workflows-workflows index for workflow definitions. The change removes
all SavedObject references, updates CRUD operations to use the storage
adapter, and maintains full functionality while providing better
performance and flexibility for workflow data management.

_While this is all still maintained and managed by Kibana, it'll allow
us to easily migrate out, if and when needed._

Elasticsearch PR for indices permissions:
elastic/elasticsearch#134067

---------

Co-authored-by: kibanamachine <[email protected]>
eleonoramicozzi pushed a commit to eleonoramicozzi/kibana that referenced this pull request Sep 10, 2025
…astic#233947)

**Migrate workflows from SavedObjects to kbn-storage-adapter with
.workflows-\* system indices**

This PR migrates the workflows management plugin from Kibana
SavedObjects to direct Elasticsearch storage using kbn-storage-adapter,
replacing the SavedObject-based persistence with a hidden
.workflows-workflows index for workflow definitions. The change removes
all SavedObject references, updates CRUD operations to use the storage
adapter, and maintains full functionality while providing better
performance and flexibility for workflow data management.

_While this is all still maintained and managed by Kibana, it'll allow
us to easily migrate out, if and when needed._

Elasticsearch PR for indices permissions:
elastic/elasticsearch#134067

---------

Co-authored-by: kibanamachine <[email protected]>
KodeRad pushed a commit to KodeRad/kibana that referenced this pull request Sep 15, 2025
…astic#233947)

**Migrate workflows from SavedObjects to kbn-storage-adapter with
.workflows-\* system indices**

This PR migrates the workflows management plugin from Kibana
SavedObjects to direct Elasticsearch storage using kbn-storage-adapter,
replacing the SavedObject-based persistence with a hidden
.workflows-workflows index for workflow definitions. The change removes
all SavedObject references, updates CRUD operations to use the storage
adapter, and maintains full functionality while providing better
performance and flexibility for workflow data management.

_While this is all still maintained and managed by Kibana, it'll allow
us to easily migrate out, if and when needed._

Elasticsearch PR for indices permissions:
elastic/elasticsearch#134067

---------

Co-authored-by: kibanamachine <[email protected]>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Sep 24, 2025
…astic#233947)

**Migrate workflows from SavedObjects to kbn-storage-adapter with
.workflows-\* system indices**

This PR migrates the workflows management plugin from Kibana
SavedObjects to direct Elasticsearch storage using kbn-storage-adapter,
replacing the SavedObject-based persistence with a hidden
.workflows-workflows index for workflow definitions. The change removes
all SavedObject references, updates CRUD operations to use the storage
adapter, and maintains full functionality while providing better
performance and flexibility for workflow data management.

_While this is all still maintained and managed by Kibana, it'll allow
us to easily migrate out, if and when needed._

Elasticsearch PR for indices permissions:
elastic/elasticsearch#134067

---------

Co-authored-by: kibanamachine <[email protected]>
niros1 pushed a commit to elastic/kibana that referenced this pull request Sep 30, 2025
…33947)

**Migrate workflows from SavedObjects to kbn-storage-adapter with
.workflows-\* system indices**

This PR migrates the workflows management plugin from Kibana
SavedObjects to direct Elasticsearch storage using kbn-storage-adapter,
replacing the SavedObject-based persistence with a hidden
.workflows-workflows index for workflow definitions. The change removes
all SavedObject references, updates CRUD operations to use the storage
adapter, and maintains full functionality while providing better
performance and flexibility for workflow data management.

_While this is all still maintained and managed by Kibana, it'll allow
us to easily migrate out, if and when needed._

Elasticsearch PR for indices permissions:
elastic/elasticsearch#134067

---------

Co-authored-by: kibanamachine <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

external-contributor Pull request authored by a developer outside the Elasticsearch team >non-issue Team:One Workflow v9.2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants