Skip to content

Commit 7a764ba

Browse files
kibanamachineelena-shostak
kibanamachine
and
elena-shostak
authored
[9.0] [Authz]: added reason for authorization opt out for snapshot_restore routes (#213888) (#214727)
# Backport This will backport the following commits from `main` to `9.0`: - [[Authz]: added reason for authorization opt out for snapshot_restore routes (#213888)](#213888) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Elena Shostak","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-03-17T12:15:45Z","message":"[Authz]: added reason for authorization opt out for snapshot_restore routes (#213888)\n\n## Summary\n\nAdded reason for authorization opt out for `snapshot_restore` routes.\n\n\n### Checklist\n\n- [x] The PR description includes the appropriate Release Notes section,\nand the correct `release_note:*` label is applied per the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\nCo-authored-by: Elastic Machine <[email protected]>","sha":"59e606cdc49e6500bfd7a9a6e95c4e9d4174e775","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Feature:Security/Authorization","backport:prev-minor","backport:version","Authz: API migration","v9.1.0","v8.19.0"],"title":"[Authz]: added reason for authorization opt out for snapshot_restore routes","number":213888,"url":"https://github.com/elastic/kibana/pull/213888","mergeCommit":{"message":"[Authz]: added reason for authorization opt out for snapshot_restore routes (#213888)\n\n## Summary\n\nAdded reason for authorization opt out for `snapshot_restore` routes.\n\n\n### Checklist\n\n- [x] The PR description includes the appropriate Release Notes section,\nand the correct `release_note:*` label is applied per the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\nCo-authored-by: Elastic Machine <[email protected]>","sha":"59e606cdc49e6500bfd7a9a6e95c4e9d4174e775"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213888","number":213888,"mergeCommit":{"message":"[Authz]: added reason for authorization opt out for snapshot_restore routes (#213888)\n\n## Summary\n\nAdded reason for authorization opt out for `snapshot_restore` routes.\n\n\n### Checklist\n\n- [x] The PR description includes the appropriate Release Notes section,\nand the correct `release_note:*` label is applied per the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n\nCo-authored-by: Elastic Machine <[email protected]>","sha":"59e606cdc49e6500bfd7a9a6e95c4e9d4174e775"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Elena Shostak <[email protected]>
1 parent fd630b3 commit 7a764ba

File tree

4 files changed

+162
-12
lines changed

4 files changed

+162
-12
lines changed

‎x-pack/platform/plugins/private/snapshot_restore/server/routes/api/policy.ts‎

Lines changed: 92 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,16 @@ export function registerPolicyRoutes({
9595

9696
// Create policy
9797
router.post(
98-
{ path: addBasePath('policies'), validate: { body: policySchema } },
98+
{
99+
path: addBasePath('policies'),
100+
security: {
101+
authz: {
102+
enabled: false,
103+
reason: 'Relies on es client for authorization',
104+
},
105+
},
106+
validate: { body: policySchema },
107+
},
99108
license.guardApiRoute(async (ctx, req, res) => {
100109
const { client: clusterClient } = (await ctx.core).elasticsearch;
101110

@@ -134,6 +143,12 @@ export function registerPolicyRoutes({
134143
router.put(
135144
{
136145
path: addBasePath('policies/{name}'),
146+
security: {
147+
authz: {
148+
enabled: false,
149+
reason: 'Relies on es client for authorization',
150+
},
151+
},
137152
validate: { params: nameParameterSchema, body: policySchema },
138153
},
139154
license.guardApiRoute(async (ctx, req, res) => {
@@ -162,7 +177,16 @@ export function registerPolicyRoutes({
162177

163178
// Delete policy
164179
router.delete(
165-
{ path: addBasePath('policies/{name}'), validate: { params: nameParameterSchema } },
180+
{
181+
path: addBasePath('policies/{name}'),
182+
security: {
183+
authz: {
184+
enabled: false,
185+
reason: 'Relies on es client for authorization',
186+
},
187+
},
188+
validate: { params: nameParameterSchema },
189+
},
166190
license.guardApiRoute(async (ctx, req, res) => {
167191
const { client: clusterClient } = (await ctx.core).elasticsearch;
168192
const { name } = req.params as TypeOf<typeof nameParameterSchema>;
@@ -193,7 +217,16 @@ export function registerPolicyRoutes({
193217

194218
// Execute policy
195219
router.post(
196-
{ path: addBasePath('policy/{name}/run'), validate: { params: nameParameterSchema } },
220+
{
221+
path: addBasePath('policy/{name}/run'),
222+
security: {
223+
authz: {
224+
enabled: false,
225+
reason: 'Relies on es client for authorization',
226+
},
227+
},
228+
validate: { params: nameParameterSchema },
229+
},
197230
license.guardApiRoute(async (ctx, req, res) => {
198231
const { client: clusterClient } = (await ctx.core).elasticsearch;
199232
const { name } = req.params as TypeOf<typeof nameParameterSchema>;
@@ -212,7 +245,16 @@ export function registerPolicyRoutes({
212245

213246
// Get policy indices
214247
router.get(
215-
{ path: addBasePath('policies/indices'), validate: false },
248+
{
249+
path: addBasePath('policies/indices'),
250+
security: {
251+
authz: {
252+
enabled: false,
253+
reason: 'Relies on es client for authorization',
254+
},
255+
},
256+
validate: false,
257+
},
216258
license.guardApiRoute(async (ctx, req, res) => {
217259
const { client: clusterClient } = (await ctx.core).elasticsearch;
218260

@@ -243,7 +285,16 @@ export function registerPolicyRoutes({
243285

244286
// Get policy feature states
245287
router.get(
246-
{ path: addBasePath('policies/features'), validate: false },
288+
{
289+
path: addBasePath('policies/features'),
290+
security: {
291+
authz: {
292+
enabled: false,
293+
reason: 'Relies on es client for authorization',
294+
},
295+
},
296+
validate: false,
297+
},
247298
license.guardApiRoute(async (ctx, req, res) => {
248299
const { client: clusterClient } = (await ctx.core).elasticsearch;
249300

@@ -259,7 +310,16 @@ export function registerPolicyRoutes({
259310

260311
// Get retention settings
261312
router.get(
262-
{ path: addBasePath('policies/retention_settings'), validate: false },
313+
{
314+
path: addBasePath('policies/retention_settings'),
315+
security: {
316+
authz: {
317+
enabled: false,
318+
reason: 'Relies on es client for authorization',
319+
},
320+
},
321+
validate: false,
322+
},
263323
license.guardApiRoute(async (ctx, req, res) => {
264324
const { client: clusterClient } = (await ctx.core).elasticsearch;
265325
const { persistent, transient, defaults } =
@@ -288,6 +348,12 @@ export function registerPolicyRoutes({
288348
router.put(
289349
{
290350
path: addBasePath('policies/retention_settings'),
351+
security: {
352+
authz: {
353+
enabled: false,
354+
reason: 'Relies on es client for authorization',
355+
},
356+
},
291357
validate: { body: retentionSettingsSchema },
292358
},
293359
license.guardApiRoute(async (ctx, req, res) => {
@@ -314,7 +380,16 @@ export function registerPolicyRoutes({
314380

315381
// Execute retention
316382
router.post(
317-
{ path: addBasePath('policies/retention'), validate: false },
383+
{
384+
path: addBasePath('policies/retention'),
385+
security: {
386+
authz: {
387+
enabled: false,
388+
reason: 'Relies on es client for authorization',
389+
},
390+
},
391+
validate: false,
392+
},
318393
license.guardApiRoute(async (ctx, req, res) => {
319394
const { client: clusterClient } = (await ctx.core).elasticsearch;
320395
const response = await clusterClient.asCurrentUser.slm.executeRetention();
@@ -324,7 +399,16 @@ export function registerPolicyRoutes({
324399

325400
// Get snapshot lifecycle management status
326401
router.get(
327-
{ path: addBasePath('policies/slm_status'), validate: false },
402+
{
403+
path: addBasePath('policies/slm_status'),
404+
security: {
405+
authz: {
406+
enabled: false,
407+
reason: 'Relies on es client for authorization',
408+
},
409+
},
410+
validate: false,
411+
},
328412
license.guardApiRoute(async (ctx, req, res) => {
329413
const { client: clusterClient } = (await ctx.core).elasticsearch;
330414

‎x-pack/platform/plugins/private/snapshot_restore/server/routes/api/repositories.ts‎

Lines changed: 48 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,16 @@ export function registerRepositoriesRoutes({
172172

173173
// GET repository types
174174
router.get(
175-
{ path: addBasePath('repository_types'), validate: false },
175+
{
176+
path: addBasePath('repository_types'),
177+
security: {
178+
authz: {
179+
enabled: false,
180+
reason: 'Relies on es client for authorization',
181+
},
182+
},
183+
validate: false,
184+
},
176185
license.guardApiRoute(async (ctx, req, res) => {
177186
const { client: clusterClient } = (await ctx.core).elasticsearch;
178187
// module repo types are available everywhere out of the box
@@ -212,6 +221,12 @@ export function registerRepositoriesRoutes({
212221
router.get(
213222
{
214223
path: addBasePath('repositories/{name}/verify'),
224+
security: {
225+
authz: {
226+
enabled: false,
227+
reason: 'Relies on es client for authorization',
228+
},
229+
},
215230
validate: { params: nameParameterSchema },
216231
},
217232
license.guardApiRoute(async (ctx, req, res) => {
@@ -246,6 +261,12 @@ export function registerRepositoriesRoutes({
246261
router.post(
247262
{
248263
path: addBasePath('repositories/{name}/cleanup'),
264+
security: {
265+
authz: {
266+
enabled: false,
267+
reason: 'Relies on es client for authorization',
268+
},
269+
},
249270
validate: { params: nameParameterSchema },
250271
},
251272
license.guardApiRoute(async (ctx, req, res) => {
@@ -289,7 +310,16 @@ export function registerRepositoriesRoutes({
289310

290311
// Create repository
291312
router.put(
292-
{ path: addBasePath('repositories'), validate: { body: repositorySchema } },
313+
{
314+
path: addBasePath('repositories'),
315+
security: {
316+
authz: {
317+
enabled: false,
318+
reason: 'Relies on es client for authorization',
319+
},
320+
},
321+
validate: { body: repositorySchema },
322+
},
293323
license.guardApiRoute(async (ctx, req, res) => {
294324
const { client: clusterClient } = (await ctx.core).elasticsearch;
295325
const { name = '', type = '', settings = {} } = req.body as TypeOf<typeof repositorySchema>;
@@ -328,6 +358,12 @@ export function registerRepositoriesRoutes({
328358
router.put(
329359
{
330360
path: addBasePath('repositories/{name}'),
361+
security: {
362+
authz: {
363+
enabled: false,
364+
reason: 'Relies on es client for authorization',
365+
},
366+
},
331367
validate: { body: repositorySchema, params: nameParameterSchema },
332368
},
333369
license.guardApiRoute(async (ctx, req, res) => {
@@ -362,7 +398,16 @@ export function registerRepositoriesRoutes({
362398

363399
// Delete repository
364400
router.delete(
365-
{ path: addBasePath('repositories/{name}'), validate: { params: nameParameterSchema } },
401+
{
402+
path: addBasePath('repositories/{name}'),
403+
security: {
404+
authz: {
405+
enabled: false,
406+
reason: 'Relies on es client for authorization',
407+
},
408+
},
409+
validate: { params: nameParameterSchema },
410+
},
366411
license.guardApiRoute(async (ctx, req, res) => {
367412
const { client: clusterClient } = (await ctx.core).elasticsearch;
368413
const { name } = req.params as TypeOf<typeof nameParameterSchema>;

‎x-pack/platform/plugins/private/snapshot_restore/server/routes/api/restore.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,12 @@ export function registerRestoreRoutes({
104104
router.post(
105105
{
106106
path: addBasePath('restore/{repository}/{snapshot}'),
107+
security: {
108+
authz: {
109+
enabled: false,
110+
reason: 'Relies on es client for authorization',
111+
},
112+
},
107113
validate: { body: restoreSettingsSchema, params: restoreParamsSchema },
108114
},
109115
license.guardApiRoute(async (ctx, req, res) => {

‎x-pack/platform/plugins/private/snapshot_restore/server/routes/api/snapshots.ts‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,12 @@ export function registerSnapshotsRoutes({
182182
router.get(
183183
{
184184
path: addBasePath('snapshots/{repository}/{snapshot}'),
185+
security: {
186+
authz: {
187+
enabled: false,
188+
reason: 'Relies on es client for authorization',
189+
},
190+
},
185191
validate: { params: getOneParamsSchema },
186192
},
187193
license.guardApiRoute(async (ctx, req, res) => {
@@ -239,7 +245,16 @@ export function registerSnapshotsRoutes({
239245

240246
// DELETE one or multiple snapshots
241247
router.post(
242-
{ path: addBasePath('snapshots/bulk_delete'), validate: { body: deleteSchema } },
248+
{
249+
path: addBasePath('snapshots/bulk_delete'),
250+
security: {
251+
authz: {
252+
enabled: false,
253+
reason: 'Relies on es client for authorization',
254+
},
255+
},
256+
validate: { body: deleteSchema },
257+
},
243258
license.guardApiRoute(async (ctx, req, res) => {
244259
const { client: clusterClient } = (await ctx.core).elasticsearch;
245260

0 commit comments

Comments
 (0)