[Cloud Security] [Fleet] Add var_group components and validation

[seanrathier]

Parent: https://github.com/elastic/security-team/issues/15396

Summary

This PR implements var_groups recognition, add the VarGroupsSelector component, and persistence for var_group_selections at both the package level and stream level in Fleet package policies. Variable groups (var_groups) allow package authors to define mutually exclusive sets of variables, enabling users to choose between different configuration options (e.g., API Key vs OAuth authentication).

Blocked to merge by

• Adding var_groups spec package-spec#1059

Integration manifest example

var_groups:
  - name: credential_type
    required: true
    title: Setup Access
    selector_title: Preferred method
    description: Utilize AWS Access Keys or assume role to set up access for assessing your AWS environment's security posture. Refer to our Getting Started guide for details.
    options:
      - name: cloud_connectors
        title: Cloud Connector
        vars: [cloud_connector_account_type, cloud_connector_name, role_arn, external_id]
        hide_in_deployment_modes: [default]
      - name: direct_access_key
        title: Direct Access Keys
        vars: [access_key_id, secret_access_key]
      - name: temporary_access_key
        title: Temporary Access Keys
        vars: [access_key_id, secret_access_key, session_token]
      - name: assume_role
        title: Assume Role
        vars: [role_arn]
      - name: assume_role_external_id
        title: Assume Role with External ID
        vars: [role_arn, external_id]
      - name: shared_credentials
        title: Shared Credentials
        vars: [shared_credential_file, credential_profile_name]
        hide_in_deployment_modes: [agentless]

Fleet UI example

Screen.Recording.2026-01-23.at.10.06.07.AM.mov

Key changes:

• Added var_group_selections field to NewPackagePolicy and NewPackagePolicyInputStream types
• Package-level selections are stored in packagePolicy.var_group_selections
• Stream-level selections are stored in packagePolicyInputStream.var_group_selections
• Created useVarGroupSelections hook for consistent state management across both levels
• Implemented computeDefaultVarGroupSelections to initialize defaults based on deployment mode
• Added VarGroupSelector component for UI rendering of var_group options
• Server-side parsing already supports var_groups from package manifests

Validation enhancements (form validation):

• Added required?: boolean field to RegistryVarGroup type
• Added isVarRequiredByVarGroup helper function
• Updated validatePackagePolicy to skip validation for hidden vars and treat vars in required var_groups as required
• Updated hasInvalidButRequiredVar to support var_groups context
• Updated PackagePolicyInputVarField to show required indicator for var_group required fields

Related Issues

• Adding var_groups spec package-spec#1059
• https://github.com/elastic/security-team/issues/15346

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Low - Medium

[elasticmachine]

Pinging @elastic/contextual-security-apps (Team:Cloud Security)

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[Copilot]

Pull request overview

This PR implements persistence and validation for var_group_selections in Fleet package policies. Variable groups enable package authors to define mutually exclusive sets of variables, allowing users to select between different configuration options (e.g., API Key vs OAuth authentication). The implementation includes both package-level and stream-level selections, UI components for selection, and enhanced validation logic.

Changes:

• Added var_group_selections field to package policy types and schemas at both package and stream levels
• Implemented UI components (VarGroupSelector) and state management hooks (useVarGroupSelections) for selecting and persisting var group options
• Enhanced validation to skip hidden variables and treat variables in required var groups as required
• Added comprehensive test coverage for var group functionality including selection, validation, and visibility logic

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
server/types/so_attributes.ts	Added var_group_selections field to package policy saved object attributes
server/types/rest_spec/epm.ts	Added schema validation for var_groups in package manifest
server/services/package_policy.ts	Persisted var_group_selections during package policy updates
server/services/epm/archive/parse.ts	Added var_groups as optional package property for parsing
server/routes/package_policy/handlers.ts	Updated handlers to preserve var_group_selections during updates
public/types/index.ts	Exported var group types for public use
public/applications/.../edit_package_policy_page/index.tsx	Computed default var group selections for edit mode
public/applications/.../single_page_layout/index.tsx	Integrated var group selections into create flow
public/applications/.../has_invalid_but_required_var.ts	Enhanced validation to support var group required logic
public/applications/.../step_define_package_policy.tsx	Added var group selector UI and filtered variables by selection
public/applications/.../step_configure_package.tsx	Added input compatibility filtering based on var group selections
public/applications/.../var_group_selector.tsx	New component implementing var group selection UI and logic
public/applications/.../package_policy_input_var_field.tsx	Added support for var group required indicator
public/applications/.../package_policy_input_stream.tsx	Implemented stream-level var group selections and filtering
public/applications/.../package_policy_input_panel.tsx	Passed var group selections to input streams
public/applications/.../hooks.tsx	Added useVarGroupSelections hook for state management
common/types/models/package_spec.ts	Defined var group type interfaces
common/types/models/package_policy_schema.ts	Added schema for var group selections
common/types/models/package_policy.ts	Added var group selections to package policy types
common/types/models/epm.ts	Added var group support to registry types
common/services/validate_package_policy.ts	Enhanced validation to handle var group visibility and requirements
common/services/simplified_package_policy_helper.ts	Preserved var group selections in simplified format
oas_docs/bundle.serverless.json	Updated OpenAPI schema with var group selections
oas_docs/bundle.json	Updated OpenAPI schema with var group selections

[florent-leborgne]

LGTM for docs

[juliaElastic]

These bundle files were removed on main, should merge upstream: #249907

Should be ignored by git: https://github.com/elastic/kibana/pull/249907/files#diff-bc37d034bad564583790a46f19d807abfe519c5671395fd494d8cce506c42947

[juliaElastic]

Code changes look good, could you share some screenshots or steps to verify how var groups look like on the UI?

[juliaElastic]

LGTM

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: ec524b7
• Cloud Deployment

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
fleet	1389	1391	+2

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
fleet	1590	1611	+21

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
fleet	2.2MB	2.2MB	+4.8KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
fleet	181.8KB	182.6KB	+747.0B

Unknown metric groups

API count

id	before	after	diff
fleet	1725	1746	+21

History

• 💔 Build #386200 failed c537143
• 💔 Build #385619 failed e876b6f
• 💔 Build #385486 failed 81a0e48
• 💔 Build #385193 failed 816dc01
• 💔 Build #385031 failed 75fd9cb

cc @seanrathier