[Task Manager] Use UIAM API Key for tasks in serverless by ersin-erdal · Pull Request #254315 · elastic/kibana

ersin-erdal · 2026-02-21T23:59:14Z

Related https://github.com/elastic/response-ops-team/issues/527

This PR adopts the UIAM APIKeys in the Task Manager plugin.

when security.authc?.apiKeys?.uiam is provided, we grant both the ES and UIAM APIKeys and persist in the task SO, so we can switch between two of them.
On task create -with a request- we grant ES and UIAM APIKeys.
On task update we grant ES and UIAM APIKeys and invalidate the old API Keys.
On task delete we invalidate the old API Keys.
If we don't use an api key after granting it - because of an error - invalidate the unused ones.

When xpack.task_manager.api_key_type is uiam we create the fakeRequest we use in the task with UIAM API Key.

To verify:

Add below configs to your serverless.dev.yml
xpack.task_manager.api_key_type: 'uiam'
xpack.task_manager.invalidate_api_key_task.removalDelay: '10s'
xpack.task_manager.invalidate_api_key_task.interval: '1m'
so we can see the invalidation task works without a problem.
Run Kibana and Elasticsearch with the below commands:
yarn es serverless --projectType observability --uiam
yarn start --serverless oblt --uiam --run-examples
Login with the system_indices_superuser user.
Go to: http://localhost:5601/app/triggersActionsUiExample/task_manager_with_api_key
Create task 1 and task 2
Use the below query to check if the task has both ES and UIAM API Keys

GET /.kibana_task_manager_*/_search
{
  "query": { 
    "bool": { 
      "must": [
        { "match": { "task.taskType":   "taskWithApiKey" }}
      ]
    }
  }
}

Remove one of the tasks, and check if both ES and UIAM API Keys to be queued to be invalidated.

GET /.kibana_task_manager_*/_search
{
  "query": {
    "match": {
      "type": {
        "query": "api_key_to_invalidate"
      }
    }
  }
}

Wait for a minute and do the same as above, the API Keys should be invalidated and removed from the index.
There shouldn't be any error on the console.
Add the task you removed again and do the same tests with Remove All Tasks which uses bulkDelete.

elasticmachine · 2026-02-23T19:39:39Z

Pinging @elastic/response-ops (Team:ResponseOps)

…tion_tests/ci_checks

afharo

SO changes LGTM

# Conflicts: # packages/kbn-check-saved-objects-cli/src/migrations/__fixtures__/task/10.8.0.json # src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts # x-pack/platform/plugins/shared/task_manager/server/integration_tests/managed_configuration.test.ts # x-pack/platform/plugins/shared/task_manager/server/metrics/create_aggregator.test.ts # x-pack/platform/plugins/shared/task_manager/server/monitoring/configuration_statistics.test.ts # x-pack/platform/plugins/shared/task_manager/server/plugin.test.ts # x-pack/platform/plugins/shared/task_manager/server/plugin.ts # x-pack/platform/plugins/shared/task_manager/server/saved_objects/model_versions/task_model_versions.ts # x-pack/platform/plugins/shared/task_manager/server/saved_objects/schemas/task.ts # x-pack/platform/plugins/shared/task_manager/server/task_store.test.ts # x-pack/platform/plugins/shared/task_manager/server/task_store.ts

…tion_tests/ci_checks

darnautov · 2026-03-17T12:15:40Z

+  | ApiKeyAndUserScopeBoth;
+
+export interface CreateApiKeyOptions {
+  shouldGrantUiam: boolean;


should we make it more generic and accept a list of api key types to generate?

Suggested change

shouldGrantUiam: boolean;

apiKeyTypes: ApiKeyType[];

IMO this should stay as it is, this is to check if uiam.grant is enabled or not. we use ApiKeyType when we decide which API Key to use.

This request led me to change the whole architecture of api key handling, had to switch to strategy pattern.
Created another PR: #259373
With this one we can add a new strategy as we have new apiKey types.

darnautov · 2026-03-17T12:20:34Z

-    if (apiKeyIdsToRemove.length) {
+    // after successful updates we should invalidate the old API keys (ES and/or UIAM)
+    const allSucceeded = updatedSavedObjects.every((so) => !so.error);
+    if (apiKeysToRemove.length && allSucceeded) {


The old behavior invalidated keys per-document for each individually successful update. The new code invalidates only when the entire batch succeeds. So if any from the batch failed, 0 old API keys get invalidated, and we end up with orphaned API keys.

Good catch, fixed it.

darnautov · 2026-03-17T12:24:46Z

-        const { apiKey, userScope } = taskInstance;
-        if (apiKey && userScope) {
+        const { apiKey, uiamApiKey, userScope } = taskInstance;
+        if ((apiKey || uiamApiKey) && userScope && !userScope.apiKeyCreatedByUser) {


Previously when regenerateApiKey: true was passed, tasks with API keys created by user were still included and got new system-created keys (the old user key was preserved / not invalidated). Now they're excluded entirely. I agree it makes sense to exclude userScope.apiKeyCreatedByUser, but it's a (breaking) change in the behaviour, isn't it? I believe we should either document it as a fix, or preserve the old behaviour

Agreed, removed the extra check against apiKeyCreatedByUser

darnautov · 2026-03-17T12:25:34Z

+        : taskInstance.apiKey;
+
+    if (apiKeyType === ApiKeyType.UIAM && taskInstance.apiKey && !taskInstance.uiamApiKey) {
+      this.logger.error(


I think it should a warning, similar to alerting

Suggested change

this.logger.error(

this.logger.warn(

darnautov · 2026-03-17T12:26:23Z

-  private getFakeKibanaRequest(apiKey?: string, spaceId?: string): KibanaRequest | undefined {
-    if (apiKey) {
-      const requestHeaders: Headers = {};
+  private getFakeKibanaRequest(taskInstance: ConcreteTaskInstance): KibanaRequest | undefined {


shall we add some unit tests?

elasticmachine · 2026-03-20T16:32:17Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: f22890b

Failed CI Steps

affected Scout: [ security / entity_store ] plugin

Test Failures

[job] [logs] affected Scout: [ security / entity_store ] plugin / local-stateful-classic - Automated email resolution integration tests - Basic email matching — two entities with same email

Metrics [docs]

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`taskManager`	10	11	+1

Unknown metric groups

API count

id	before	after	diff
`taskManager`	122	123	+1

History

ersin-erdal · 2026-03-30T16:21:49Z

closing in favor of: #259373

Use UIAM API Key for tasks in serverless

1ecfda0

ersin-erdal changed the title ~~Use UIAM API Key for tasks in serverless~~ [Task Manager] Use UIAM API Key for tasks in serverless Feb 21, 2026

fix uiamApiKey value

0c51920

ersin-erdal marked this pull request as ready for review February 23, 2026 19:38

ersin-erdal requested a review from a team as a code owner February 23, 2026 19:38

ersin-erdal added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// labels Feb 23, 2026

ersin-erdal and others added 2 commits February 23, 2026 20:39

Merge branch 'main' into use-uiam-api-keys-in-tm

22fcc93

Changes from node scripts/check_mappings_update --fix

a37d43a

elastic-vault-github-plugin-prod Bot requested a review from a team as a code owner February 23, 2026 19:57

kibanamachine and others added 3 commits February 23, 2026 20:12

Changes from node scripts/regenerate_moon_projects.js --update

d933709

Changes from node scripts/jest_integration -u src/core/server/integra…

b63e0c7

…tion_tests/ci_checks

fix unit tests

73e5376

ersin-erdal requested a review from a team as a code owner February 24, 2026 00:23

ersin-erdal requested a review from elena-shostak February 24, 2026 00:23

ersin-erdal and others added 2 commits February 24, 2026 01:23

Merge branch 'main' into use-uiam-api-keys-in-tm

ce30c0d

add fixture

7b69011

afharo approved these changes Feb 24, 2026

View reviewed changes

darnautov self-requested a review February 25, 2026 08:00

ersin-erdal added the Feature:CPS label Feb 27, 2026

elena-shostak removed their request for review March 6, 2026 19:19

ersin-erdal and others added 7 commits March 14, 2026 14:10

Changes from node scripts/jest_integration -u src/core/server/integra…

c214ab9

…tion_tests/ci_checks

Changes from node scripts/eslint_all_files --no-cache --fix

7adef4f

fix types

2383a98

Forcing an empty commit.

49c3df1

fix SO types

5141d45

fix test

d645e66

ersin-erdal and others added 2 commits March 16, 2026 16:56

fix sample data and model version

f0f3f61

Changes from node scripts/jest_integration -u src/core/server/integra…

3511e10

…tion_tests/ci_checks

darnautov reviewed Mar 17, 2026

View reviewed changes

ersin-erdal and others added 5 commits March 17, 2026 17:45

fix invalidation in bulkUpdate

4be0c98

add unit tests for getFakeKibanaRequest

3cbc68c

remove obsolete test case

12c613a

Merge branch 'main' into use-uiam-api-keys-in-tm

019fa91

Merge branch 'main' into use-uiam-api-keys-in-tm

f22890b

Merge branch 'main' into use-uiam-api-keys-in-tm

71eed0f

ersin-erdal closed this Mar 30, 2026

Conversation

ersin-erdal commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

To verify:

Uh oh!

elasticmachine commented Feb 23, 2026

Uh oh!

afharo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 20, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing exports

API count

History

Uh oh!

ersin-erdal commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ersin-erdal commented Feb 21, 2026 •

edited

Loading