Skip to content

Comments

[Response Ops] Fix cases action owner on o11y serverless project#224537

Merged
jcger merged 18 commits intoelastic:mainfrom
jcger:issue-186270-case-action-creates-stack-cases-bug-o11y
Jun 27, 2025
Merged

[Response Ops] Fix cases action owner on o11y serverless project#224537
jcger merged 18 commits intoelastic:mainfrom
jcger:issue-186270-case-action-creates-stack-cases-bug-o11y

Conversation

@jcger
Copy link
Contributor

@jcger jcger commented Jun 19, 2025 •
edited by kibanamachine
Loading

Summary

Serverless observability project would throw when creating a rule with a system case action.

Action 'system-connector-.cases' failed: an error occurred while running the action: Failed to bulk create cases: Error: Unauthorized to create case with owners: "cases"

To fix it, we set the owner to be the serverless project type and if serverless but unknown, we default the owner to "cases"

How to test

  1. Start ES with cloud projectId flag like this: yarn es serverless --projectType=oblt -E xpack.cloud.serverless.project_id: test-123

  2. Go to management rules page by searching for rules in the top searchbar
    image

  3. Create a stack rule (index threshold) and add the cases action

  4. When an alert is triggered confirm you can view the case in the cases page

@jcger jcger marked this pull request as ready for review June 20, 2025 10:56
@jcger jcger requested review from a team as code owners June 20, 2025 10:56
@jcger jcger added backport:version Backport to applied version labels v9.1.0 v8.19.0 release_note:skip Skip the PR/issue when compiling release notes labels Jun 20, 2025
@cnasikas cnasikas added bug Fixes for quality problems that affect the customer experience ci:project-deploy-elasticsearch Create an Elasticsearch Serverless project ci:project-deploy-observability Create an Observability project ci:project-deploy-security Create a Security Serverless Project labels Jun 25, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Jun 25, 2025

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

cnasikas
cnasikas reviewed Jun 27, 2025
View reviewed changes
Copy link
Member

@cnasikas cnasikas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested and everything is working as expected! I left some comments.

x-pack/platform/plugins/shared/cases/common/constants/types.ts
*/

import type { OWNERS } from './owners';
import type { SERVERLESS_PROJECT_TYPES, OWNERS } from './owners';
Copy link
Member

@cnasikas cnasikas Jun 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting how this does not create circular dependencies. It also seems that this is only used to construct the types. Could we just create the union manually and add es and chat to the list?

Copy link
Contributor Author

@jcger jcger Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer this to be done in a follow-up PR, I'll create the GH issue

Copy link
Member

@cnasikas cnasikas Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Opening an issue only for adding two variables seems like an overkill. Either we do it know or we do not do it at all. Up to you!

Copy link
Contributor Author

@jcger jcger Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't know how to fill everything in

  [SECURITY_SOLUTION_OWNER]: {
    id: SECURITY_SOLUTION_OWNER,
    appId: 'securitySolutionUI',
    label: 'Security',
    iconType: 'logoSecurity',
    appRoute: '/app/security',
    validRuleConsumers: [AlertConsumers.SIEM],
    serverlessProjectType: SECURITY_PROJECT_TYPE_ID,
  },

for es and chat. Maybe you are talking about something else?

Copy link
Member

@cnasikas cnasikas Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see what you mean. I was only suggested to add them in SERVERLESS_PROJECT_TYPES. Not to fill the OWNER_INFO with the extra information. But you have a point, better to leave it as it is.

x-pack/platform/plugins/shared/cases/public/components/system_actions/cases/cases_params.tsx
Copy link
Member

@cnasikas cnasikas Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you please add a similar test such as renders security templates if the project is serverless security observability?

x-pack/platform/plugins/shared/cases/server/connectors/cases/index.ts
Copy link
Member

@cnasikas cnasikas Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you please add a similar test, such as correctly overrides the consumer and producer if the project is serverless security, for observability?

x-pack/platform/plugins/shared/cases/server/connectors/cases/index.ts Outdated

const owner = isServerlessSecurity
? SECURITY_SOLUTION_OWNER
const owner = serverlessProjectType
Copy link
Member

@cnasikas cnasikas Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here we assign the project type, which may not be the same as the owner's. Should we use the same logic as in x-pack/platform/plugins/shared/cases/common/utils/owner.ts?

jcger and others added 3 commits June 27, 2025 12:29
@jcger @cnasikas
Update x-pack/platform/plugins/shared/cases/common/utils/owner.test.ts
798cda5 
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
@jcger @cnasikas
Update x-pack/platform/plugins/shared/cases/common/utils/owner.test.ts
f2678ba 
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
@jcger @cnasikas
Update x-pack/platform/plugins/shared/cases/common/utils/owner.test.ts
fafe586 
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
@jcger
Merge branch 'issue-186270-case-action-creates-stack-cases-bug-o11y' …
e83f745 
…of github.com:jcger/kibana into issue-186270-case-action-creates-stack-cases-bug-o11y
@jcger jcger enabled auto-merge (squash) June 27, 2025 12:31
@cnasikas cnasikas removed ci:project-deploy-elasticsearch Create an Elasticsearch Serverless project ci:project-deploy-observability Create an Observability project ci:project-deploy-security Create a Security Serverless Project labels Jun 27, 2025
@jcger jcger added bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes backport:version Backport to applied version labels v9.1.0 v8.19.0 v9.2.0 and removed bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes backport:version Backport to applied version labels v9.1.0 v8.19.0 v9.2.0 labels Jun 27, 2025
@jcger jcger merged commit 1914673 into elastic:main Jun 27, 2025
10 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented Jun 27, 2025

Starting backport for target branches: 8.19, 9.1

https://github.com/elastic/kibana/actions/runs/15932247586

@elasticmachine
Copy link
Contributor

elasticmachine commented Jun 27, 2025

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
cases 1.3MB 1.3MB -23.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 135.3KB 135.5KB +145.0B

History

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 27, 2025
@jcger @cnasikas
[Response Ops] Fix cases action owner on o11y serverless project (ela…
addd224 
…stic#224537)

## Summary

Serverless observability project would throw when creating a rule with a
system case action.

`Action 'system-connector-.cases' failed: an error occurred while
running the action: Failed to bulk create cases: Error: Unauthorized to
create case with owners: "cases"`

To fix it, we set the owner to be the serverless project type and if
serverless but unknown, we default the owner to "cases"

### How to test

1. Start ES with cloud projectId flag like this: `yarn es serverless
--projectType=oblt -E xpack.cloud.serverless.project_id: test-123`
2. Go to management rules page by searching for `rules` in the top
searchbar

![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)

3. Create a stack rule (index threshold) and add the cases action
4. When an alert is triggered confirm you can view the case in the cases
page

---------

Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
(cherry picked from commit 1914673)
@kibanamachine kibanamachine mentioned this pull request Jun 27, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 27, 2025
@jcger @cnasikas
[Response Ops] Fix cases action owner on o11y serverless project (ela…
b92b1ae 
…stic#224537)

## Summary

Serverless observability project would throw when creating a rule with a
system case action.

`Action 'system-connector-.cases' failed: an error occurred while
running the action: Failed to bulk create cases: Error: Unauthorized to
create case with owners: "cases"`

To fix it, we set the owner to be the serverless project type and if
serverless but unknown, we default the owner to "cases"

### How to test

1. Start ES with cloud projectId flag like this: `yarn es serverless
--projectType=oblt -E xpack.cloud.serverless.project_id: test-123`
2. Go to management rules page by searching for `rules` in the top
searchbar

![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)

3. Create a stack rule (index threshold) and add the cases action
4. When an alert is triggered confirm you can view the case in the cases
page

---------

Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
(cherry picked from commit 1914673)
@kibanamachine kibanamachine mentioned this pull request Jun 27, 2025
Merged
@kibanamachine
Copy link
Contributor

kibanamachine commented Jun 27, 2025

💚 All backports created successfully

Status Branch Result
✅ 8.19
✅ 9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jun 27, 2025
@kibanamachine @jcger @cnasikas
[9.1] [Response Ops] Fix cases action owner on o11y serverless project (
523374c 
#224537) (#225690)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Response Ops] Fix cases action owner on o11y serverless project
(#224537)](#224537)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Julian
Gernun","email":"17549662+jcger@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-06-27T17:25:52Z","message":"[Response
Ops] Fix cases action owner on o11y serverless project (#224537)\n\n##
Summary\n\nServerless observability project would throw when creating a
rule with a\nsystem case action.\n\n`Action 'system-connector-.cases'
failed: an error occurred while\nrunning the action: Failed to bulk
create cases: Error: Unauthorized to\ncreate case with owners:
\"cases\"`\n\nTo fix it, we set the owner to be the serverless project
type and if\nserverless but unknown, we default the owner to
\"cases\"\n\n### How to test\n\n1. Start ES with cloud projectId flag
like this: `yarn es serverless\n--projectType=oblt -E
xpack.cloud.serverless.project_id: test-123`\n2. Go to management rules
page by searching for `rules` in the
top\nsearchbar\n\n![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)\n\n\n3.
Create a stack rule (index threshold) and add the cases action\n4. When
an alert is triggered confirm you can view the case in the
cases\npage\n\n---------\n\nCo-authored-by: Christos Nasikas
<xristosnasikas@gmail.com>","sha":"1914673ca3b8e6f56148507a66a5add7071dda20","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Response
Ops] Fix cases action owner on o11y serverless
project","number":224537,"url":"https://github.com/elastic/kibana/pull/224537","mergeCommit":{"message":"[Response
Ops] Fix cases action owner on o11y serverless project (#224537)\n\n##
Summary\n\nServerless observability project would throw when creating a
rule with a\nsystem case action.\n\n`Action 'system-connector-.cases'
failed: an error occurred while\nrunning the action: Failed to bulk
create cases: Error: Unauthorized to\ncreate case with owners:
\"cases\"`\n\nTo fix it, we set the owner to be the serverless project
type and if\nserverless but unknown, we default the owner to
\"cases\"\n\n### How to test\n\n1. Start ES with cloud projectId flag
like this: `yarn es serverless\n--projectType=oblt -E
xpack.cloud.serverless.project_id: test-123`\n2. Go to management rules
page by searching for `rules` in the
top\nsearchbar\n\n![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)\n\n\n3.
Create a stack rule (index threshold) and add the cases action\n4. When
an alert is triggered confirm you can view the case in the
cases\npage\n\n---------\n\nCo-authored-by: Christos Nasikas
<xristosnasikas@gmail.com>","sha":"1914673ca3b8e6f56148507a66a5add7071dda20"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/224537","number":224537,"mergeCommit":{"message":"[Response
Ops] Fix cases action owner on o11y serverless project (#224537)\n\n##
Summary\n\nServerless observability project would throw when creating a
rule with a\nsystem case action.\n\n`Action 'system-connector-.cases'
failed: an error occurred while\nrunning the action: Failed to bulk
create cases: Error: Unauthorized to\ncreate case with owners:
\"cases\"`\n\nTo fix it, we set the owner to be the serverless project
type and if\nserverless but unknown, we default the owner to
\"cases\"\n\n### How to test\n\n1. Start ES with cloud projectId flag
like this: `yarn es serverless\n--projectType=oblt -E
xpack.cloud.serverless.project_id: test-123`\n2. Go to management rules
page by searching for `rules` in the
top\nsearchbar\n\n![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)\n\n\n3.
Create a stack rule (index threshold) and add the cases action\n4. When
an alert is triggered confirm you can view the case in the
cases\npage\n\n---------\n\nCo-authored-by: Christos Nasikas
<xristosnasikas@gmail.com>","sha":"1914673ca3b8e6f56148507a66a5add7071dda20"}}]}]
BACKPORT-->

Co-authored-by: Julian Gernun <17549662+jcger@users.noreply.github.com>
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
@kibanamachine kibanamachine mentioned this pull request Jun 27, 2025
Merged
kibanamachine added a commit that referenced this pull request Jun 27, 2025
@kibanamachine @jcger @cnasikas
[8.19] [Response Ops] Fix cases action owner on o11y serverless proje…
194ab1e 
…ct (#224537) (#225689)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Response Ops] Fix cases action owner on o11y serverless project
(#224537)](#224537)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Julian
Gernun","email":"17549662+jcger@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-06-27T17:25:52Z","message":"[Response
Ops] Fix cases action owner on o11y serverless project (#224537)\n\n##
Summary\n\nServerless observability project would throw when creating a
rule with a\nsystem case action.\n\n`Action 'system-connector-.cases'
failed: an error occurred while\nrunning the action: Failed to bulk
create cases: Error: Unauthorized to\ncreate case with owners:
\"cases\"`\n\nTo fix it, we set the owner to be the serverless project
type and if\nserverless but unknown, we default the owner to
\"cases\"\n\n### How to test\n\n1. Start ES with cloud projectId flag
like this: `yarn es serverless\n--projectType=oblt -E
xpack.cloud.serverless.project_id: test-123`\n2. Go to management rules
page by searching for `rules` in the
top\nsearchbar\n\n![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)\n\n\n3.
Create a stack rule (index threshold) and add the cases action\n4. When
an alert is triggered confirm you can view the case in the
cases\npage\n\n---------\n\nCo-authored-by: Christos Nasikas
<xristosnasikas@gmail.com>","sha":"1914673ca3b8e6f56148507a66a5add7071dda20","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Response
Ops] Fix cases action owner on o11y serverless
project","number":224537,"url":"https://github.com/elastic/kibana/pull/224537","mergeCommit":{"message":"[Response
Ops] Fix cases action owner on o11y serverless project (#224537)\n\n##
Summary\n\nServerless observability project would throw when creating a
rule with a\nsystem case action.\n\n`Action 'system-connector-.cases'
failed: an error occurred while\nrunning the action: Failed to bulk
create cases: Error: Unauthorized to\ncreate case with owners:
\"cases\"`\n\nTo fix it, we set the owner to be the serverless project
type and if\nserverless but unknown, we default the owner to
\"cases\"\n\n### How to test\n\n1. Start ES with cloud projectId flag
like this: `yarn es serverless\n--projectType=oblt -E
xpack.cloud.serverless.project_id: test-123`\n2. Go to management rules
page by searching for `rules` in the
top\nsearchbar\n\n![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)\n\n\n3.
Create a stack rule (index threshold) and add the cases action\n4. When
an alert is triggered confirm you can view the case in the
cases\npage\n\n---------\n\nCo-authored-by: Christos Nasikas
<xristosnasikas@gmail.com>","sha":"1914673ca3b8e6f56148507a66a5add7071dda20"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/224537","number":224537,"mergeCommit":{"message":"[Response
Ops] Fix cases action owner on o11y serverless project (#224537)\n\n##
Summary\n\nServerless observability project would throw when creating a
rule with a\nsystem case action.\n\n`Action 'system-connector-.cases'
failed: an error occurred while\nrunning the action: Failed to bulk
create cases: Error: Unauthorized to\ncreate case with owners:
\"cases\"`\n\nTo fix it, we set the owner to be the serverless project
type and if\nserverless but unknown, we default the owner to
\"cases\"\n\n### How to test\n\n1. Start ES with cloud projectId flag
like this: `yarn es serverless\n--projectType=oblt -E
xpack.cloud.serverless.project_id: test-123`\n2. Go to management rules
page by searching for `rules` in the
top\nsearchbar\n\n![image](https://github.com/user-attachments/assets/d0df7cf4-74e6-4e7d-86b0-3871614116d2)\n\n\n3.
Create a stack rule (index threshold) and add the cases action\n4. When
an alert is triggered confirm you can view the case in the
cases\npage\n\n---------\n\nCo-authored-by: Christos Nasikas
<xristosnasikas@gmail.com>","sha":"1914673ca3b8e6f56148507a66a5add7071dda20"}}]}]
BACKPORT-->

Co-authored-by: Julian Gernun <17549662+jcger@users.noreply.github.com>
Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cnasikas cnasikas cnasikas approved these changes

Assignees

No one assigned

Labels

backport:version Backport to applied version labels bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes v8.19.0 v9.1.0 v9.2.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jcger @kibanamachine @elasticmachine @cnasikas