[8.18] [Fleet] Update frozen variables for preconfigured managed policies (#235306) (#236244)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Fleet] Update frozen variables for preconfigured managed policies
(#235306)](#235306)

<!--- Backport version: 10.0.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Nicolas
Chaulet","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-09-18T07:42:10Z","message":"[Fleet]
Update frozen variables for preconfigured managed policies
(#235306)","sha":"2738a40a6ec1dc07db5864bf309a54b430f2b57a","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Fleet","backport:version","v9.2.0","v8.18.8","v8.19.5","v9.0.8","v9.1.5"],"title":"[Fleet]
Update frozen variables for preconfigured managed
policies","number":235306,"url":"https://github.com/elastic/kibana/pull/235306","mergeCommit":{"message":"[Fleet]
Update frozen variables for preconfigured managed policies
(#235306)","sha":"2738a40a6ec1dc07db5864bf309a54b430f2b57a"}},"sourceBranch":"main","suggestedTargetBranches":["8.18","8.19","9.0","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235306","number":235306,"mergeCommit":{"message":"[Fleet]
Update frozen variables for preconfigured managed policies
(#235306)","sha":"2738a40a6ec1dc07db5864bf309a54b430f2b57a"}},{"branch":"8.18","label":"v8.18.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: kibanamachine <[email protected]>

Author: nchaulet

x-pack/platform/plugins/shared/fleet/common/types/models/preconfiguration.ts

@@ -11,6 +11,7 @@ import type {
   PackagePolicyPackage,
   NewPackagePolicy,
   NewPackagePolicyInput,
+  PackagePolicyConfigRecordEntry,
 } from './package_policy';
 import type { NewAgentPolicy } from './agent_policy';
 import type { Output } from './output';
@@ -22,22 +23,34 @@ export type InputsOverride = Partial<NewPackagePolicyInput> & {
   vars?: Array<NewPackagePolicyInput['vars'] & { name: string }>;
 };
 
+export type PreconfiguredVar = PackagePolicyConfigRecordEntry & { name: string };
+
+export type PreconfiguredInputs = Omit<NewPackagePolicy['inputs'][0], 'vars' | 'streams'> & {
+  vars?: PreconfiguredVar[];
+  streams?: Array<
+    Omit<NewPackagePolicy['inputs'][0]['streams'][0], 'vars'> & {
+      vars?: PreconfiguredVar[];
+    }
+  >;
+};
+
+export type PreconfiguredPackagePolicy =
+  | (Partial<Omit<NewPackagePolicy, 'inputs' | 'package'>> & {
+      id?: string | number;
+      name: string;
+      package: Partial<PackagePolicyPackage> & { name: string };
+      inputs?: PreconfiguredInputs[];
+    })
+  | (Omit<SimplifiedPackagePolicy, 'policy_id'> & {
+      id: string;
+      package: { name: string };
+    });
+
 export interface PreconfiguredAgentPolicy extends Omit<NewAgentPolicy, 'namespace' | 'id'> {
   id: string | number;
   space_id?: string;
   namespace?: string;
-  package_policies: Array<
-    | (Partial<Omit<NewPackagePolicy, 'inputs' | 'package'>> & {
-        id?: string | number;
-        name: string;
-        package: Partial<PackagePolicyPackage> & { name: string };
-        inputs?: InputsOverride[];
-      })
-    | (Omit<SimplifiedPackagePolicy, 'policy_id'> & {
-        id: string;
-        package: { name: string };
-      })
-  >;
+  package_policies: PreconfiguredPackagePolicy[];
 }
 
 export interface PreconfiguredPackage extends Omit<PackagePolicyPackage, 'title'> {

x-pack/platform/plugins/shared/fleet/server/services/package_policy.test.ts

@@ -50,6 +50,7 @@ import type {
   NewPackagePolicyInput,
   PackagePolicyPackage,
   DeletePackagePoliciesResponse,
+  PreconfiguredInputs,
 } from '../../common/types';
 import { packageToPackagePolicy } from '../../common/services';
 
@@ -3776,7 +3777,7 @@ describe('Package policy service', () => {
           packageInfo,
           // TODO: Update this type assertion when the `InputsOverride` type is updated such
           // that it no longer causes unresolvable type errors when used directly
-          inputsOverride as InputsOverride[]
+          inputsOverride as PreconfiguredInputs[]
         );
         expect(result.inputs[0]?.vars?.path.value).toEqual('/var/log/new-logfile.log');
       });
@@ -3873,7 +3874,7 @@ describe('Package policy service', () => {
           packageInfo,
           // TODO: Update this type assertion when the `InputsOverride` type is updated such
           // that it no longer causes unresolvable type errors when used directly
-          inputsOverride as InputsOverride[]
+          inputsOverride as PreconfiguredInputs[]
         );
 
         expect(result.inputs[0]?.vars?.path_2.value).toEqual('/var/log/custom.log');
@@ -3971,7 +3972,7 @@ describe('Package policy service', () => {
           packageInfo,
           // TODO: Update this type assertion when the `InputsOverride` type is updated such
           // that it no longer causes unresolvable type errors when used directly
-          inputsOverride as InputsOverride[]
+          inputsOverride as PreconfiguredInputs[]
         );
 
         expect(result.inputs[0]?.vars?.path_2.value).toEqual('/var/log/custom.log');
@@ -4123,7 +4124,7 @@ describe('Package policy service', () => {
           packageInfo,
           // TODO: Update this type assertion when the `InputsOverride` type is updated such
           // that it no longer causes unresolvable type errors when used directly
-          inputsOverride as InputsOverride[]
+          inputsOverride as PreconfiguredInputs[]
         );
 
         expect(result.inputs).toHaveLength(2);
@@ -4343,7 +4344,7 @@ describe('Package policy service', () => {
           packageInfo,
           // TODO: Update this type assertion when the `InputsOverride` type is updated such
           // that it no longer causes unresolvable type errors when used directly
-          inputsOverride as InputsOverride[]
+          inputsOverride as PreconfiguredInputs[]
         );
 
         const template1Inputs = result.inputs.filter(
@@ -4455,7 +4456,7 @@ describe('Package policy service', () => {
           packageInfo,
           // TODO: Update this type assertion when the `InputsOverride` type is updated such
           // that it no longer causes unresolvable type errors when used directly
-          inputsOverride as InputsOverride[]
+          inputsOverride as PreconfiguredInputs[]
         );
         expect(result.inputs[0]?.vars?.path.value).toEqual('/var/log/new-logfile.log');
       });

x-pack/platform/plugins/shared/fleet/server/services/package_policy.ts

@@ -72,6 +72,7 @@ import type {
   PolicySecretReference,
   AssetsMap,
   AgentPolicy,
+  PreconfiguredInputs,
 } from '../../common/types';
 import {
   FleetError,
@@ -925,7 +926,12 @@ class PackagePolicyClientImpl implements PackagePolicyClient {
     esClient: ElasticsearchClient,
     id: string,
     packagePolicyUpdate: UpdatePackagePolicy,
-    options?: { user?: AuthenticatedUser; force?: boolean; skipUniqueNameVerification?: boolean }
+    options?: {
+      user?: AuthenticatedUser;
+      force?: boolean;
+      skipUniqueNameVerification?: boolean;
+      bumpRevision?: boolean;
+    }
   ): Promise<PackagePolicy> {
     const savedObjectType = await getPackagePolicySavedObjectType();
     auditLoggingService.writeCustomSoAuditLog({
@@ -1126,12 +1132,14 @@ class PackagePolicyClientImpl implements PackagePolicyClient {
         ((assignedInOldPolicy && !assignedInNewPolicy) ||
           (!assignedInOldPolicy && assignedInNewPolicy));
 
-      bumpPromises.push(
-        agentPolicyService.bumpRevision(soClient, esClient, policyId, {
-          user: options?.user,
-          removeProtection,
-        })
-      );
+      if (options?.bumpRevision !== false) {
+        bumpPromises.push(
+          agentPolicyService.bumpRevision(soClient, esClient, policyId, {
+            user: options?.user,
+            removeProtection,
+          })
+        );
+      }
     }
 
     const assetRemovePromise = removeOldAssets({
@@ -2961,7 +2969,7 @@ export function updatePackageInputs(
 export function preconfigurePackageInputs(
   basePackagePolicy: NewPackagePolicy,
   packageInfo: PackageInfo,
-  preconfiguredInputs?: InputsOverride[]
+  preconfiguredInputs?: PreconfiguredInputs[]
 ): NewPackagePolicy {
   if (!preconfiguredInputs) return basePackagePolicy;
 

x-pack/platform/plugins/shared/fleet/server/services/package_policy_service.ts

@@ -154,7 +154,12 @@ export interface PackagePolicyClient {
     esClient: ElasticsearchClient,
     id: string,
     packagePolicyUpdate: UpdatePackagePolicy,
-    options?: { user?: AuthenticatedUser; force?: boolean; skipUniqueNameVerification?: boolean },
+    options?: {
+      user?: AuthenticatedUser;
+      force?: boolean;
+      skipUniqueNameVerification?: boolean;
+      bumpRevision?: boolean;
+    },
     currentVersion?: string
   ): Promise<PackagePolicy>;
 

x-pack/platform/plugins/shared/fleet/server/services/preconfiguration.ts

@@ -13,7 +13,6 @@ import { DEFAULT_NAMESPACE_STRING } from '@kbn/core-saved-objects-utils-server';
 import apm from 'elastic-apm-node';
 
 import type {
-  NewPackagePolicy,
   AgentPolicy,
   Installation,
   Output,
@@ -22,6 +21,8 @@ import type {
   PreconfiguredPackage,
   PackagePolicy,
   PackageInfo,
+  PreconfiguredPackagePolicy,
+  PreconfiguredInputs,
 } from '../../common/types';
 import type { PreconfigurationError } from '../../common/constants';
 import { PRECONFIGURATION_LATEST_KEYWORD } from '../../common/constants';
@@ -39,10 +40,14 @@ import { getInstallation, getPackageInfo } from './epm/packages';
 import { ensurePackagesCompletedInstall } from './epm/packages/install';
 import { bulkInstallPackages } from './epm/packages/bulk_install_packages';
 import { agentPolicyService, addPackageToAgentPolicy } from './agent_policy';
-import { type InputsOverride, packagePolicyService } from './package_policy';
+import { packagePolicyService } from './package_policy';
 import { preconfigurePackageInputs } from './package_policy';
 import { appContextService } from './app_context';
 import type { UpgradeManagedPackagePoliciesResult } from './setup/managed_package_policies';
+import {
+  packagePolicyHasFrozenVariablesUpdate,
+  updateFrozenInputs,
+} from './preconfiguration/package_policy_frozen_variables';
 
 interface PreconfigurationResult {
   policies: Array<{ id: string; updated_at: string }>;
@@ -273,14 +278,62 @@ export async function ensurePreconfiguredPackagesAndPolicies(
         })
       );
 
-      const packagePoliciesToAdd = installedPackagePolicies.filter((installablePackagePolicy) => {
-        return !(agentPolicyWithPackagePolicies?.package_policies as PackagePolicy[]).some(
-          (packagePolicy) =>
-            (packagePolicy.id !== undefined &&
-              packagePolicy.id === installablePackagePolicy.packagePolicy.id) ||
-            packagePolicy.name === installablePackagePolicy.packagePolicy.name
-        );
-      });
+      const [packagePoliciesToAdd, packagePoliciesUpdates] = installedPackagePolicies.reduce(
+        (acc, installablePackagePolicy) => {
+          const isAdd = !(agentPolicyWithPackagePolicies?.package_policies as PackagePolicy[]).some(
+            (packagePolicy) =>
+              (packagePolicy.id !== undefined &&
+                packagePolicy.id === installablePackagePolicy.packagePolicy.id) ||
+              packagePolicy.name === installablePackagePolicy.packagePolicy.name
+          );
+
+          if (isAdd) {
+            acc[0].push(installablePackagePolicy);
+            return acc;
+          }
+
+          if (!agentPolicyWithPackagePolicies) {
+            return acc;
+          }
+
+          const existingPackagePolicy = agentPolicyWithPackagePolicies.package_policies?.find(
+            (packagePolicy) =>
+              packagePolicy.id === installablePackagePolicy.packagePolicy.id ||
+              packagePolicy.name === installablePackagePolicy.packagePolicy.name
+          );
+
+          if (!existingPackagePolicy) {
+            return acc;
+          }
+
+          const updatePackagePolicy = { ...existingPackagePolicy };
+          if (Array.isArray(installablePackagePolicy.packagePolicy.inputs)) {
+            if (
+              packagePolicyHasFrozenVariablesUpdate(
+                updatePackagePolicy,
+                installablePackagePolicy.packagePolicy.inputs
+              )
+            ) {
+              acc[1].push({
+                namespacedSoClient: installablePackagePolicy.namespacedSoClient,
+                packagePolicy: updatePackagePolicy,
+                inputs: installablePackagePolicy.packagePolicy.inputs,
+              });
+            }
+          }
+
+          return acc;
+        },
+        [
+          [] as Array<(typeof installedPackagePolicies)[0]>,
+          [] as Array<{
+            namespacedSoClient: SavedObjectsClientContract;
+            packagePolicy: PackagePolicy;
+            inputs: PreconfiguredInputs[];
+          }>,
+        ]
+      );
+
       logger.debug(
         () =>
           `Adding preconfigured package policies ${JSON.stringify(
@@ -300,6 +353,33 @@ export async function ensurePreconfiguredPackagesAndPolicies(
       );
       s?.end();
 
+      logger.debug(
+        () =>
+          `Updating preconfigured package policies ${JSON.stringify(
+            packagePoliciesUpdates.map((pol) => ({
+              name: pol.packagePolicy.name,
+              package: pol.packagePolicy.package?.name,
+            }))
+          )}`
+      );
+      const s2 = apm.startSpan('Update preconfigured package policies', 'preconfiguration');
+      for (const packagePolicyUpdate of packagePoliciesUpdates!) {
+        try {
+          await updateFrozenInputs(
+            esClient,
+            packagePolicyUpdate.namespacedSoClient,
+            packagePolicyUpdate.packagePolicy,
+            packagePolicyUpdate.inputs
+          );
+        } catch (error) {
+          logger.error(
+            `Error updating preconfigured variables for package policy ${packagePolicyUpdate.packagePolicy.name}: ${error.message}`,
+            { error }
+          );
+        }
+      }
+      s2?.end();
+
       // Add the is_managed flag after configuring package policies to avoid errors
       if (shouldAddIsManagedFlag) {
         await agentPolicyService.update(
@@ -312,6 +392,10 @@ export async function ensurePreconfiguredPackagesAndPolicies(
           }
         );
       }
+
+      if (packagePoliciesUpdates.length > 0) {
+        await agentPolicyService.bumpRevision(namespacedSoClient, esClient, policy!.id);
+      }
     }
   }
 
@@ -363,13 +447,7 @@ async function addPreconfiguredPolicyPackages(
   installedPackagePolicies: Array<{
     installedPackage: Installation;
     namespacedSoClient: SavedObjectsClientContract;
-    packagePolicy:
-      | (Partial<Omit<NewPackagePolicy, 'inputs'>> & {
-          id?: string | number;
-          name: string;
-          inputs?: InputsOverride[];
-        })
-      | (Omit<SimplifiedPackagePolicy, 'package' | 'policy_id'> & { id: string });
+    packagePolicy: Omit<PreconfiguredPackagePolicy, 'package'>;
   }>,
   defaultOutput: Output,
   bumpAgentPolicyRevison = false