[UII] Restrict non-local ES output types for agentless integrations and policies by jen-huang · Pull Request #207296 · elastic/kibana

jen-huang · 2025-01-21T06:31:20Z

Summary

Resolves #202090.
Incidentally also fixes and unskips the failing test reported in #203346.

This PR makes it so that:

Agentless agent policies and package policies (those with supports_agentless: true set) cannot be directly set to use a non-local ES output for integration data
- This restriction applies to UI and API level
When a non-local ES output would be updated to be the global Fleet default integration data output, existing agentless policies without an explicit output set will have their output directly set to the current default output ID
- This is the same mechanism used today to ensure that Fleet Server and Synthetics integrations do not accidentally have their output set to non-ES as well

Testing

Apply patch to skip actual agentless creation
Create different types of outputs in addition to default local ES
Enable beta integrations
Add an agentless integration, for example Box Connector, observe that outputs list only shows ES outputs:

5. Switch to agent-based setup technology, observe that outputs list now shows all outputs 6. Create the agentless integration, go to its agent policy 7. Observe that outputs list only enables ES outputs:

8. Play around with setting global default outputs, it should be not possible to get into a state where an agentless policy is using a non-local ES output

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

…sticsearch` only

…cies

elasticmachine · 2025-01-21T22:14:03Z

Pinging @elastic/fleet (Team:Fleet)

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

…into feat/agentless-outputs

nchaulet · 2025-01-23T12:19:41Z

x-pack/platform/plugins/shared/fleet/common/services/limited_package.ts

  agentPolicy: AgentPolicy,
  packageName: string
 ): boolean => {
-  if (!agentPolicy.package_policies) {


I think we may want to keep that one, sometime we retrieve agent policy without package_policies so to be sure we pass the correct agent policy. In an ideal world it could be great to have two types one for AgentPolicy one for AgentPolicyWithPackagePolicies to avoid this kind of dynamic check

I reverted this change, it was trying to fix an issue I found with switching between agent-based/agentless and new hosts/existing hosts, but I fixed it elsewhere

nchaulet · 2025-01-23T12:20:37Z

x-pack/platform/plugins/shared/fleet/common/services/output_helpers.test.ts


-    expect(res).toContain('elasticsearch');
-    expect(res).toContain('logstash');
+    expect(res).toHaveLength(4);


nit: could be nice to test it contains all the expected

nchaulet · 2025-01-23T12:24:22Z

...ications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/index.tsx

                // agentless doesn't need system integration
                setWithSysMonitoring(value === SetupTechnology.AGENT_BASED);
+
+                // reset selected output if switching to agentless


It is not confusing for the user? especially as the order of these inputs in the UI is selecting output first before agentless right?

I removed this and moved the resetting logic elsewhere that only triggers if the selected output is not compatible

juliaElastic · 2025-01-23T12:27:29Z

x-pack/platform/plugins/shared/fleet/server/services/outputs/helpers.ts

+  const internalSoClientWithoutSpaceExtension =
+    appContextService.getInternalUserSOClientWithoutSpaceExtension();
+
+  const agentlessPolicies = await agentPolicyService.list(internalSoClientWithoutSpaceExtension, {


shouldn't we query policies from all spaces like this? https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/server/services/agent_policy.ts#L927-L938

I checked with Nicolas and when we query with SO client directly, it should be using namespaces: ['*'], but when using our services it should be with spaceId: '*'

here I am using agentPolicyService with a non-scoped soClient so the query looks correct to me

👍 the property is named namespaces in the saved object, but we expose it and the rest of kibana (and documentation) expose it to the end user as space id, and to add to the confusion we have another concept of namespace in fleet policies

nchaulet

LGTM 🚀

jen-huang · 2025-01-23T22:40:49Z

...ections/agent_policy/create_package_policy_page/single_page_layout/hooks/setup_technology.ts

 export function useSetupTechnology({
  setNewAgentPolicy,
  newAgentPolicy,
-  updateAgentPolicies,


@elastic/cloud-security-posture probably this file and the related test file is what triggered codeowners review. I removed the triggering of updateAgentPolicies, triggering setNewAgentPolicy suffices here from my testing. it was causing issues when switching between agent-based/agentless while also switching between new hosts/existing hosts

Thanks for the additional context!

opauloh

LGTM

opauloh · 2025-01-23T22:44:17Z

...ections/agent_policy/create_package_policy_page/single_page_layout/hooks/setup_technology.ts

 export function useSetupTechnology({
  setNewAgentPolicy,
  newAgentPolicy,
-  updateAgentPolicies,


Thanks for the additional context!

kibanamachine · 2025-01-24T00:33:02Z

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12940778494

elasticmachine · 2025-01-24T00:33:16Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 8e8d4d9

Failed CI Steps

Fleet Cypress Tests #1

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	1.7MB	1.7MB	+42.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	172.5KB	172.6KB	+71.0B

History

cc @jen-huang

kibanamachine · 2025-01-24T00:38:23Z

💔 All backports failed

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts You might need to backport the following PRs to 8.x: - [Detection Engine][API Docs] Update request/response examples for value lists APIs (#205957) - [SecuritySolution] Update Entity Store Dashboard to prompt for Service Entity Type (#207336) - [Detection Engine][Docs] Added response and request descriptions for API docs (#205822) - [Core] [UA] Support API Deprecations (#196081)

Manual backport

To create the backport manually run:

node scripts/backport --pr 207296

Questions ?

Please refer to the Backport tool documentation

jen-huang · 2025-01-24T00:46:18Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…nd policies (elastic#207296) ## Summary Resolves elastic#202090. Incidentally also fixes and unskips the failing test reported in elastic#203346. This PR makes it so that: - Agentless agent policies and package policies (those with `supports_agentless: true` set) cannot be directly set to use a non-local ES output for integration data - This restriction applies to UI and API level - When a non-local ES output would be updated to be the global Fleet default integration data output, existing agentless policies without an explicit output set will have their output directly set to the current default output ID - This is the same mechanism used today to ensure that Fleet Server and Synthetics integrations do not accidentally have their output set to non-ES as well ## Testing 1. Apply [patch](https://gist.github.com/jen-huang/dfc3e02ceb63976ad54bd1f50c524cb4) to skip actual agentless creation 2. Create different types of outputs in addition to default local ES 3. Enable beta integrations 4. Add an agentless integration, for example Box Connector, observe that outputs list only shows ES outputs: <img width="1422" alt="image" src="https://github.com/user-attachments/assets/72e43220-702f-4bb7-8e37-8be69aa4e6ea" /> 5. Switch to agent-based setup technology, observe that outputs list now shows all outputs 6. Create the agentless integration, go to its agent policy 7. Observe that outputs list only enables ES outputs: <img width="1425" alt="image" src="https://github.com/user-attachments/assets/3bc5985f-07bf-407a-8b62-4248b28904a5" /> 8. Play around with setting global default outputs, it should be not possible to get into a state where an agentless policy is using a non-local ES output ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit d4cc532) # Conflicts: # oas_docs/bundle.json # oas_docs/bundle.serverless.json # oas_docs/output/kibana.yaml # x-pack/platform/plugins/shared/fleet/server/services/agent_policy.ts # x-pack/platform/plugins/shared/fleet/server/services/output.test.ts # x-pack/platform/plugins/shared/fleet/server/types/models/agent_policy.ts # x-pack/test/fleet_api_integration/apis/agent_policy/agent_policy.ts

…ions and policies (#207296) (#208131) # Backport This will backport the following commits from `main` to `8.x`: - [[UII] Restrict non-local ES output types for agentless integrations and policies (#207296)](#207296)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…nd policies (elastic#207296) ## Summary Resolves elastic#202090. Incidentally also fixes and unskips the failing test reported in elastic#203346. This PR makes it so that: - Agentless agent policies and package policies (those with `supports_agentless: true` set) cannot be directly set to use a non-local ES output for integration data - This restriction applies to UI and API level - When a non-local ES output would be updated to be the global Fleet default integration data output, existing agentless policies without an explicit output set will have their output directly set to the current default output ID - This is the same mechanism used today to ensure that Fleet Server and Synthetics integrations do not accidentally have their output set to non-ES as well ## Testing 1. Apply [patch](https://gist.github.com/jen-huang/dfc3e02ceb63976ad54bd1f50c524cb4) to skip actual agentless creation 2. Create different types of outputs in addition to default local ES 3. Enable beta integrations 4. Add an agentless integration, for example Box Connector, observe that outputs list only shows ES outputs: <img width="1422" alt="image" src="https://github.com/user-attachments/assets/72e43220-702f-4bb7-8e37-8be69aa4e6ea" /> 5. Switch to agent-based setup technology, observe that outputs list now shows all outputs 6. Create the agentless integration, go to its agent policy 7. Observe that outputs list only enables ES outputs: <img width="1425" alt="image" src="https://github.com/user-attachments/assets/3bc5985f-07bf-407a-8b62-4248b28904a5" /> 8. Play around with setting global default outputs, it should be not possible to get into a state where an agentless policy is using a non-local ES output ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

jen-huang added 13 commits January 9, 2025 14:40

Add allowlist of output types for agentless

45a664e

Restrict list of outputs in policy editor when in agentless mode

2def436

Enable data output selection for agentless policies, restrict to `ela…

48e4613

…sticsearch` only

Merge remote-tracking branch 'upstream/main' into feat/agentless-outputs

fcb2687

Merge remote-tracking branch 'upstream/main' into feat/agentless-outputs

8da6fef

Check output type on update package policy API

bac1430

Prevent non-local ES outputs from being waterfalled to agentless poli…

935ad0f

…cies

Merge remote-tracking branch 'upstream/main' into feat/agentless-outputs

a032823

Minimize changes to allowed output type helpers, add tests

817c04b

Add UI test

4c619a5

Add tests for output service

2a91dfb

Merge remote-tracking branch 'upstream/main' into feat/agentless-outputs

87f4ffc

Add API integration tests

37dfbe8

jen-huang self-assigned this Jan 21, 2025

jen-huang added release_note:fix Team:Fleet Team label for Observability Data Collection Fleet team backport:prev-minor labels Jan 21, 2025

jen-huang marked this pull request as ready for review January 21, 2025 22:14

jen-huang requested a review from a team as a code owner January 21, 2025 22:14

jen-huang added 2 commits January 21, 2025 15:01

Fix navigation from create integration page

66b48ca

Block creating agentless integration if default output is non-local ES

4715640

nchaulet self-requested a review January 22, 2025 17:07

jen-huang and others added 7 commits January 22, 2025 12:24

Merge remote-tracking branch 'upstream/main' into feat/agentless-outputs

b7c1f58

Fix util test

c40f636

Fix api tests

739e053

Add logging to troubleshoot test

5de6feb

[CI] Auto-commit changed files from 'make api-docs'

08550a1

Adjust debugging, try setting up fleet server before

e64a6d0

Merge branch 'feat/agentless-outputs' of github.com:jen-huang/kibana …

0affeb3

…into feat/agentless-outputs

nchaulet reviewed Jan 23, 2025

View reviewed changes

juliaElastic reviewed Jan 23, 2025

View reviewed changes

jen-huang added 4 commits January 23, 2025 12:08

PR feedback, make reset output ID more specific

02d8e58

Fix switching between agent-based/agentless and new hosts/existing hosts

feb3ca5

Add more debugging for api test

1122242

Merge remote-tracking branch 'upstream/main' into feat/agentless-outputs

494e676

jen-huang requested a review from a team as a code owner January 23, 2025 20:27

jen-huang requested review from juliaElastic and nchaulet January 23, 2025 21:17

nchaulet approved these changes Jan 23, 2025

View reviewed changes

Fix bug and test

8e8d4d9

jen-huang commented Jan 23, 2025

View reviewed changes

opauloh approved these changes Jan 23, 2025

View reviewed changes

jen-huang enabled auto-merge (squash) January 23, 2025 22:45

jen-huang merged commit d4cc532 into elastic:main Jan 24, 2025

kibanamachine added the v9.0.0 label Jan 24, 2025

jen-huang deleted the feat/agentless-outputs branch January 24, 2025 00:33

jen-huang mentioned this pull request Jan 24, 2025

[8.x] [UII] Restrict non-local ES output types for agentless integrations and policies (#207296) #208131

Merged

kibanamachine added the v8.18.0 label Jan 24, 2025

Conversation

jen-huang commented Jan 21, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Checklist

Uh oh!

elasticmachine commented Jan 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nchaulet left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

opauloh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Jan 24, 2025

Uh oh!

elasticmachine commented Jan 24, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Async chunks

Page load bundle

History

Uh oh!

kibanamachine commented Jan 24, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

jen-huang commented Jan 24, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

jen-huang commented Jan 21, 2025 •

edited by kibanamachine

Loading