Skip to content

Create manage_connector privilege #110128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seanstory merged 6 commits into from
Jul 1, 2024
Merged

Create manage_connector privilege #110128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6e031f5
Create manage_seaech_connector privilege
jedrazb Jun 25, 2024
3e9d1c4
`manage_search_connector` -> `manage_connector` and exclude connector…
jedrazb Jun 26, 2024
af27b4e
Add `monitor_connector` privilege
jedrazb Jun 28, 2024
9410537
Update Kibana system privilege to monitor_connector for telemetry
jedrazb Jun 28, 2024
70b89ee
Rename privilege to 'manage_connector_state'
seanstory Jun 28, 2024
0ebb87f
Revert "Rename privilege to 'manage_connector_state'"
seanstory Jul 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/reference/rest-api/security/get-builtin-privileges.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ A successful call returns an object with "cluster", "index", and "remote_cluster
"manage_autoscaling",
"manage_behavioral_analytics",
"manage_ccr",
"manage_connector",
"manage_data_frame_transforms",
"manage_data_stream_global_retention",
"manage_enrich",
Expand All @@ -102,6 +103,7 @@ A successful call returns an object with "cluster", "index", and "remote_cluster
"manage_user_profile",
"manage_watcher",
"monitor",
"monitor_connector",
"monitor_data_frame_transforms",
"monitor_data_stream_global_retention",
"monitor_enrich",
Expand Down
37 changes: 31 additions & 6 deletions .../java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilegeResolver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@
import java.util.SortedMap;
import java.util.TreeMap;
import java.util.function.Predicate;
import java.util.stream.Collectors;
import java.util.stream.Stream;

/**
Expand Down Expand Up @@ -174,6 +175,23 @@ public class ClusterPrivilegeResolver {
);

private static final Set<String> MANAGE_SEARCH_APPLICATION_PATTERN = Set.of("cluster:admin/xpack/application/search_application/*");
private static final Set<String> MANAGE_CONNECTOR_PATTERN = Set.of("cluster:admin/xpack/connector/*");
private static final Set<String> MONITOR_CONNECTOR_PATTERN = Set.of(
"cluster:admin/xpack/connector/get",
"cluster:admin/xpack/connector/list",
"cluster:admin/xpack/connector/sync_job/get",
"cluster:admin/xpack/connector/sync_job/list"
);
private static final Set<String> READ_CONNECTOR_SECRETS_PATTERN = Set.of("cluster:admin/xpack/connector/secret/get");
private static final Set<String> WRITE_CONNECTOR_SECRETS_PATTERN = Set.of(
"cluster:admin/xpack/connector/secret/delete",
"cluster:admin/xpack/connector/secret/post",
"cluster:admin/xpack/connector/secret/put"
);
private static final Set<String> CONNECTOR_SECRETS_PATTERN = Stream.concat(
READ_CONNECTOR_SECRETS_PATTERN.stream(),
WRITE_CONNECTOR_SECRETS_PATTERN.stream()
).collect(Collectors.toSet());
private static final Set<String> MANAGE_SEARCH_QUERY_RULES_PATTERN = Set.of("cluster:admin/xpack/query_rules/*");
private static final Set<String> MANAGE_SEARCH_SYNONYMS_PATTERN = Set.of(
"cluster:admin/synonyms/*",
Expand Down Expand Up @@ -332,6 +350,15 @@ public class ClusterPrivilegeResolver {
"manage_search_application",
MANAGE_SEARCH_APPLICATION_PATTERN
);
public static final NamedClusterPrivilege MANAGE_CONNECTOR = new ActionClusterPrivilege(
"manage_connector",
MANAGE_CONNECTOR_PATTERN,
CONNECTOR_SECRETS_PATTERN
);
public static final NamedClusterPrivilege MONITOR_CONNECTOR = new ActionClusterPrivilege(
"monitor_connector",
MONITOR_CONNECTOR_PATTERN
);
public static final NamedClusterPrivilege MANAGE_SEARCH_SYNONYMS = new ActionClusterPrivilege(
"manage_search_synonyms",
MANAGE_SEARCH_SYNONYMS_PATTERN
Expand Down Expand Up @@ -362,16 +389,12 @@ public class ClusterPrivilegeResolver {

public static final NamedClusterPrivilege READ_CONNECTOR_SECRETS = new ActionClusterPrivilege(
"read_connector_secrets",
Set.of("cluster:admin/xpack/connector/secret/get")
READ_CONNECTOR_SECRETS_PATTERN
);

public static final NamedClusterPrivilege WRITE_CONNECTOR_SECRETS = new ActionClusterPrivilege(
"write_connector_secrets",
Set.of(
"cluster:admin/xpack/connector/secret/delete",
"cluster:admin/xpack/connector/secret/post",
"cluster:admin/xpack/connector/secret/put"
)
WRITE_CONNECTOR_SECRETS_PATTERN
);
public static final NamedClusterPrivilege MONITOR_GLOBAL_RETENTION = new ActionClusterPrivilege(
"monitor_data_stream_global_retention",
Expand All @@ -391,6 +414,7 @@ public class ClusterPrivilegeResolver {
NONE,
ALL,
MONITOR,
MONITOR_CONNECTOR,
MONITOR_INFERENCE,
MONITOR_ML,
MONITOR_TEXT_STRUCTURE,
Expand All @@ -400,6 +424,7 @@ public class ClusterPrivilegeResolver {
MONITOR_ROLLUP,
MONITOR_ENRICH,
MANAGE,
MANAGE_CONNECTOR,
MANAGE_INFERENCE,
MANAGE_ML,
MANAGE_TRANSFORM_DEPRECATED,
Expand Down
2 changes: 2 additions & 0 deletions ...org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,8 @@ static RoleDescriptor kibanaSystem(String name) {
// For Fleet package upgrade
"manage_pipeline",
"manage_ilm",
// For connectors telemetry
"monitor_connector",
// For the endpoint package that ships a transform
"manage_transform",
InvalidateApiKeyAction.NAME,
Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/privileges/11_builtin.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,5 @@ setup:
# This is fragile - it needs to be updated every time we add a new cluster/index privilege
# I would much prefer we could just check that specific entries are in the array, but we don't have
# an assertion for that
Comment on lines 15 to 17
Copy link
Copy Markdown
Member

@ioanatia ioanatia Jun 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unrelated to your changes, but I always wondered if this comment is still accurate and why couldn't we just assert the contents of the array

- length: { "cluster" : 59 }
- length: { "cluster" : 61 }
- length: { "index" : 22 }