[Task Manager] Use strategy pattern for API key management

.buildkite/scout_ci_config.yml

@@ -45,6 +45,7 @@ plugins:
     - streams
     - streams_app
     - synthetics
+    - task_manager
     - transform
     - triggers_actions_ui
     - uptime

packages/kbn-check-saved-objects-cli/current_fields.json

@@ -1428,7 +1428,8 @@
     "status",
     "taskType",
     "userScope",
-    "userScope.apiKeyId"
+    "userScope.apiKeyId",
+    "userScope.uiamApiKeyId"
   ],
   "telemetry": [],
   "threshold-explorer-view": [],

packages/kbn-check-saved-objects-cli/current_mappings.json

@@ -4749,6 +4749,9 @@
         "properties": {
           "apiKeyId": {
             "type": "keyword"
+          },
+          "uiamApiKeyId": {
+            "type": "keyword"
           }
         }
       }

packages/kbn-check-saved-objects-cli/src/migrations/__fixtures__/task/10.9.0.json

@@ -0,0 +1,59 @@
+{
+  "10.8.0": [
+    {
+      "taskType": "string",
+      "scheduledAt": "string",
+      "startedAt": "string?|null",
+      "retryAt": "string?|null",
+      "runAt": "string",
+      "params": "string",
+      "state": "string",
+      "stateVersion": "number?",
+      "traceparent": "string",
+      "user": "string?",
+      "scope": "array?",
+      "ownerId": "string?|null",
+      "enabled": "boolean?",
+      "timeoutOverride": "string?",
+      "attempts": "number",
+      "status": "idle|claiming|running|failed|unrecognized|dead_letter",
+      "version": "string?",
+      "partition": "number?",
+      "priority": "number?",
+      "interval": "string",
+      "apiKey": "string?",
+      "userScope": "object?",
+      "schedule": "object?",
+      "cost": "tiny?|normal?|extralarge?"
+    }
+  ],
+  "10.9.0": [
+    {
+      "taskType": "string",
+      "scheduledAt": "string",
+      "startedAt": "string?|null",
+      "retryAt": "string?|null",
+      "runAt": "string",
+      "params": "string",
+      "state": "string",
+      "stateVersion": "number?",
+      "traceparent": "string",
+      "user": "string?",
+      "scope": "array?",
+      "ownerId": "string?|null",
+      "enabled": "boolean?",
+      "timeoutOverride": "string?",
+      "attempts": "number",
+      "status": "idle|claiming|running|failed|unrecognized|dead_letter",
+      "version": "string?",
+      "partition": "number?",
+      "priority": "number?",
+      "interval": "string",
+      "apiKey": "string?",
+      "uiamApiKey": "string?",
+      "userScope": "object?",
+      "schedule": "object?",
+      "cost": "tiny?|normal?|extralarge?"
+    }
+  ]
+}

src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts

@@ -184,7 +184,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "synthetics-private-location": "f5efabeefafbb12ed0809db3cd04f893ff9099ead8f526be82a9b0348e444f65",
         "synthetics-privates-locations": "42aebb3aa4f3710a3e270d54bf33718a4d1d7a983556a51f75bd96b1e4fdf048",
         "tag": "03a522e92aed789a4bbf1a5dd19159c3ec061cb052337df9270728def4b3bbe0",
-        "task": "52bb9355724d6546a8e485c161c7f039493acb79e913b31ce1d0b9839fe38117",
+        "task": "4e6f0a8e825e3159959f1dc0fd4d6c5d9b15707863a741905b183dc6d1144f44",
         "telemetry": "fb5e3ce0b2955f10aa8cd75fdafdd0559bf5d77eaf6e2c228079684f01f28fbd",
         "threshold-explorer-view": "9b0a770f5444531f92dd50832dcf655cb0c9cd7f18af205338e0c9d73c6df6a6",
         "trial-companion-nba-milestone": "83f29f99e2ffaf00ed8e05f3366ed0df1fb36a77193aeb151e13bae8b1d9692f",
@@ -1281,8 +1281,9 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "tag|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
         "=====================================================",
         "task|global: 8277e4031824bb161fa73897294701786c15eb9a",
-        "task|mappings: 02ff4224787d1516899101bacf1c411fa0149383",
+        "task|mappings: a4616c952ab46648bba6f807a339d76b1388078e",
         "task|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
+        "task|10.9.0: 2c8f74c9a9d07540f767ad8e99174474da9bec93ab858ae1e005a301f620c39b",
         "task|10.8.0: deed2eb105aa3f19fa1827868c6b5569523624614fb73a8fcb8600d86c0dface",
         "task|10.7.0: 6afacb50669e4a3ebd48d5790d1677c138885b1540acf5e832dbe8dc82e7cd5c",
         "task|10.6.0: a554a701424daf84a260b61390464deb9296c7372ac3438301c2fb046ded11f9",
@@ -1545,7 +1546,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "synthetics-private-location": "10.0.0",
         "synthetics-privates-locations": "10.1.0",
         "tag": "10.0.0",
-        "task": "10.8.0",
+        "task": "10.9.0",
         "telemetry": "10.0.0",
         "threshold-explorer-view": "10.0.0",
         "trial-companion-nba-milestone": "10.1.0",
@@ -1711,7 +1712,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "synthetics-private-location": "0.0.0",
         "synthetics-privates-locations": "10.1.0",
         "tag": "0.0.0",
-        "task": "10.8.0",
+        "task": "10.9.0",
         "telemetry": "0.0.0",
         "threshold-explorer-view": "0.0.0",
         "trial-companion-nba-milestone": "10.1.0",

src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/task_manager_uiam/serverless/observability_complete.serverless.config.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { servers as defaultConfig } from '../../default/serverless/observability_complete.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+// Enables the Task Manager UIAM rollout flag so the EsAndUiamApiKeyStrategy is
+// exercised. The flag is not yet enabled on MKI, so these tests run only on
+// Kibana CI (not on MKI).
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [
+      ...defaultConfig.kbnTestServer.serverArgs,
+      '--xpack.task_manager.grant_uiam_api_keys=true',
+    ],
+  },
+};

src/platform/plugins/private/ftr_apis/kibana.jsonc

@@ -12,6 +12,9 @@
     "server": true,
     "configPath": [
       "ftr_apis"
+    ],
+    "requiredPlugins": [
+      "taskManager"
     ]
   }
 }

src/platform/plugins/private/ftr_apis/moon.yml

@@ -19,6 +19,8 @@ project:
 dependsOn:
   - '@kbn/core'
   - '@kbn/config-schema'
+  - '@kbn/task-manager-plugin'
+  - '@kbn/response-ops-scheduling-types'
 tags:
   - plugin
   - prod

src/platform/plugins/private/ftr_apis/server/plugin.ts

@@ -7,23 +7,29 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-import type { CoreSetup, Plugin, PluginInitializerContext } from '@kbn/core/server';
+import type { CoreSetup, CoreStart, Plugin, PluginInitializerContext } from '@kbn/core/server';
+import type { TaskManagerStartContract } from '@kbn/task-manager-plugin/server';
 import { registerRoutes } from './routes';
 import type { ConfigType } from './config';
 
-export class FtrApisPlugin implements Plugin {
+export class FtrApisPlugin
+  implements Plugin<void, void, object, { taskManager: TaskManagerStartContract }>
+{
   private readonly config: ConfigType;
+  private taskManagerStart?: TaskManagerStartContract;
 
   constructor(initializerContext: PluginInitializerContext) {
     this.config = initializerContext.config.get<ConfigType>();
   }
 
-  public setup({ http, savedObjects }: CoreSetup) {
+  public setup({ http }: CoreSetup) {
     const router = http.createRouter();
     if (!this.config.disableApis) {
-      registerRoutes(router);
+      registerRoutes(router, () => this.taskManagerStart);
     }
   }
 
-  public start() {}
+  public start(_core: CoreStart, { taskManager }: { taskManager: TaskManagerStartContract }) {
+    this.taskManagerStart = taskManager;
+  }
 }

src/platform/plugins/private/ftr_apis/server/routes/index.ts

@@ -8,8 +8,14 @@
  */
 
 import type { IRouter } from '@kbn/core/server';
+import type { TaskManagerStartContract } from '@kbn/task-manager-plugin/server';
 import { registerKbnClientSoRoutes } from './kbn_client_so';
+import { registerTaskManagerRoutes } from './task_manager';
 
-export const registerRoutes = (router: IRouter) => {
+export const registerRoutes = (
+  router: IRouter,
+  getTaskManagerStart: () => TaskManagerStartContract | undefined
+) => {
   registerKbnClientSoRoutes(router);
+  registerTaskManagerRoutes(router, getTaskManagerStart);
 };

src/platform/plugins/private/ftr_apis/server/routes/task_manager/delete.ts

@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { schema } from '@kbn/config-schema';
+import type {
+  IRouter,
+  KibanaRequest,
+  KibanaResponseFactory,
+  RequestHandlerContext,
+} from '@kbn/core/server';
+import { SavedObjectsErrorHelpers } from '@kbn/core/server';
+import type { TaskManagerStartContract } from '@kbn/task-manager-plugin/server';
+
+export const registerTaskManagerDeleteRoute = (
+  router: IRouter,
+  getStartContract: () => TaskManagerStartContract | undefined
+) => {
+  router.delete(
+    {
+      path: '/internal/task_manager/tasks/{taskId}',
+      security: {
+        authz: {
+          requiredPrivileges: ['ftrApis'],
+        },
+      },
+      validate: {
+        params: schema.object({
+          taskId: schema.string(),
+        }),
+      },
+    },
+    async (_context: RequestHandlerContext, req: KibanaRequest, res: KibanaResponseFactory) => {
+      const startContract = getStartContract();
+      if (!startContract) {
+        return res.customError({
+          statusCode: 503,
+          body: { message: 'Task Manager has not started yet' },
+        });
+      }
+
+      const { taskId } = req.params as { taskId: string };
+
+      try {
+        await startContract.remove(taskId);
+      } catch (err) {
+        if (SavedObjectsErrorHelpers.isNotFoundError(err)) {
+          return res.notFound({ body: { message: `Task ${taskId} not found` } });
+        }
+        throw err;
+      }
+
+      return res.ok({ body: { deleted: true } });
+    }
+  );
+};

src/platform/plugins/private/ftr_apis/server/routes/task_manager/index.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { IRouter } from '@kbn/core/server';
+import type { TaskManagerStartContract } from '@kbn/task-manager-plugin/server';
+import { registerTaskManagerDeleteRoute } from './delete';
+import { registerTaskManagerScheduleRoute } from './schedule';
+
+export const registerTaskManagerRoutes = (
+  router: IRouter,
+  getStartContract: () => TaskManagerStartContract | undefined
+) => {
+  registerTaskManagerScheduleRoute(router, getStartContract);
+  registerTaskManagerDeleteRoute(router, getStartContract);
+};