Skip to content

Add connector permissions to fleet server service account #112556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seanstory merged 10 commits into from
Sep 17, 2024
Merged

Add connector permissions to fleet server service account #112556

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
e074953
Add connector permissions to fleet server service account
jedrazb Sep 5, 2024
d3e3223
[Security] Add permissions to manage connectors for fleet-server serv…
jedrazb Sep 11, 2024
1520d6d
Merge branch 'main' into add-connector-permissions-to-fleet
jedrazb Sep 11, 2024
363efab
Merge branch 'main' into add-connector-permissions-to-fleet
elasticmachine Sep 11, 2024
5c8b69e
Fix tests
jedrazb Sep 11, 2024
23802a0
Merge branch 'add-connector-permissions-to-fleet' of github.com:jedra…
jedrazb Sep 11, 2024
71023fc
Fix tests
jedrazb Sep 11, 2024
9d64cde
Fix typ again (tm)
jedrazb Sep 11, 2024
03fa3e6
switch to connector/* vs manage_connectors
seanstory Sep 16, 2024
0e68d99
Merge branch 'main' into add-connector-permissions-to-fleet
elasticmachine Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion docs/reference/rest-api/security/get-service-accounts.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,8 @@ GET /_security/service/elastic/fleet-server
"cluster": [
"monitor",
"manage_own_api_key",
"read_fleet_secrets"
"read_fleet_secrets",
"cluster:admin/xpack/connector/*"
],
"indices": [
{
Expand Down Expand Up @@ -238,6 +239,35 @@ GET /_security/service/elastic/fleet-server
"auto_configure"
],
"allow_restricted_indices": false
},
{
"names": [
".elastic-connectors*"
],
"privileges": [
"read",
"write",
"monitor",
"create_index",
"auto_configure",
"maintenance"
],
"allow_restricted_indices": false
},
{
"names": [
"content-*",
".search-acl-filter-*"
],
"privileges": [
"read",
"write",
"monitor",
"create_index",
"auto_configure",
"maintenance"
],
"allow_restricted_indices": false
}
],
"applications": [
Expand Down
32 changes: 31 additions & 1 deletion ...rc/javaRestTest/java/org/elasticsearch/xpack/security/authc/service/ServiceAccountIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,8 @@ public class ServiceAccountIT extends ESRestTestCase {
"cluster": [
"monitor",
"manage_own_api_key",
"read_fleet_secrets"
"read_fleet_secrets",
"cluster:admin/xpack/connector/*"
],
"indices": [
{
Expand Down Expand Up @@ -284,6 +285,35 @@ public class ServiceAccountIT extends ESRestTestCase {
"auto_configure"
],
"allow_restricted_indices": false
},
{
"names": [
".elastic-connectors*"
],
"privileges": [
"read",
"write",
"monitor",
"create_index",
"auto_configure",
"maintenance"
],
"allow_restricted_indices": false
},
{
"names": [
"content-*",
".search-acl-filter-*"
],
"privileges": [
"read",
"write",
"monitor",
"create_index",
"auto_configure",
"maintenance"
],
"allow_restricted_indices": false
}
],
"applications": [ {
Expand Down
14 changes: 12 additions & 2 deletions .../src/main/java/org/elasticsearch/xpack/security/authc/service/ElasticServiceAccounts.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ final class ElasticServiceAccounts {
"fleet-server",
new RoleDescriptor(
NAMESPACE + "/fleet-server",
new String[] { "monitor", "manage_own_api_key", "read_fleet_secrets" },
new String[] { "monitor", "manage_own_api_key", "read_fleet_secrets", "cluster:admin/xpack/connector/*" },
new RoleDescriptor.IndicesPrivileges[] {
RoleDescriptor.IndicesPrivileges.builder()
.indices(
Expand Down Expand Up @@ -156,7 +156,17 @@ final class ElasticServiceAccounts {
// Fleet Server needs "read" privilege to be able to retrieve multi-agent docs
.privileges("read", "write", "create_index", "auto_configure")
.allowRestrictedIndices(false)
.build() },
.build(),
// Custom permissions required for running Elastic connectors integration
RoleDescriptor.IndicesPrivileges.builder()
.indices(".elastic-connectors*")
.privileges("read", "write", "monitor", "create_index", "auto_configure", "maintenance")
.build(),
// Permissions for data indices and access control filters used by Elastic connectors integration
RoleDescriptor.IndicesPrivileges.builder()
.indices("content-*", ".search-acl-filter-*")
.privileges("read", "write", "monitor", "create_index", "auto_configure", "maintenance")
.build(), },
new RoleDescriptor.ApplicationResourcePrivileges[] {
RoleDescriptor.ApplicationResourcePrivileges.builder()
.application("kibana-*")
Expand Down