Fix observability UIAM config and add CPS observability variant by flash1293 · Pull Request #260485 · elastic/kibana

flash1293 · 2026-03-31T13:45:29Z

Summary

Adds observability_complete serverless config variant for cps_local
Fixes uiam_local/observability_complete to import from the observability base config instead of security
Adds cloud.id override for UIAM API key conversion in observability UIAM config
Fixes UIAM token project_type mismatch by normalizing CLI aliases (oblt→observability, es→search) in @kbn/mock-idp-utils

Test plan

Run node scripts/scout start-server --arch serverless --domain observability_complete --serverConfigSet cps_local and verify SAML auth succeeds
Run node scripts/scout start-server --arch serverless --domain security_complete --serverConfigSet cps_local and verify it still works

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flash1293 · 2026-03-31T15:04:45Z

@copilot Actually, it's way simpler, revert all the changes here and just add an observability variant of src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/cps_local/serverless/security_complete.serverless.config.ts to src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/cps_local/serverless

- Add observability_complete variant to cps_local serverless configs - Fix uiam_local observability config to import from observability base instead of security base - Add cloud.id override for UIAM API key conversion in observability config - Normalize CLI project type aliases (oblt→observability, es→search) in UIAM token creation to match ES serverless project types Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

azasypkin · 2026-03-31T17:19:58Z

👋 We're likely going to run into conflicts with #260546. Is this change time-critical for you, or can you wait until we enable UIAM for everyone by default in #260546 (1-2-3 days, if things go well)?

At that point, you likely won't need a custom Scout config at all.

flash1293 · 2026-03-31T17:53:44Z

Would that replace the full PR? I still need a config to start observability with local loopback csp right?

dmlemeshko · 2026-04-01T06:20:57Z

src/platform/packages/private/kbn-mock-idp-utils/src/utils.ts

+// Normalizes Kibana CLI project type aliases (e.g. 'oblt', 'es') to the canonical
+// ES project type names used in UIAM tokens and ES serverless configuration.
+const projectTypeAliases = new Map<string, string>([
+  ['oblt', 'observability'],
+  ['es', 'search'],
+]);


nit: we are doing the same conversion in mock-id-plugin:

kibana/packages/kbn-mock-idp-plugin/server/plugin.ts

Lines 42 to 48 in 56c9003

// BOOKMARK - List of Kibana project types

const projectToAlias = new Map<string, string>([

['observability', 'oblt'],

['security', 'security'],

['search', 'es'],

['workplaceai', 'workplaceai'],

]);

maybe we should import it in plugin from utils?

azasypkin · 2026-04-01T09:39:19Z

I still need a config to start observability with local loopback csp right?

Oh, this change won't be covered by my PR, as loopback CPS requires a custom configuration.

By the way, we added support for loopback CPS just to make quick local smoke testing easier, but I believe using this for anything serious, like automated tests or quality gates, is highly discouraged. It might break at any point without warning. @n1v0lg can keep me honest here.

Is there any reason you cannot rely on a proper CPS testing setup that @dmlemeshko has built recently? If that isn't possible yet, can we improve it so you can leverage it instead?

es → search

Learned the hard way that it should be es → elasticsearch to work with UIAM 🙂

flash1293 · 2026-04-01T09:42:41Z

The use case is local smoke testing here. @dmlemeshko suggested this is how it should be done - the first version of this PR was just a small bash script that did the same thing.

I really just want a handy oneliner to start a CPS setup for local testing, please let me merge a version 😁

azasypkin · 2026-04-01T09:51:34Z

I really just want a handy oneliner to start a CPS setup for local testing, please let me merge a version 😁

Haha, okay, but you've been warned (though please change ['es', 'search'] to ['es', 'elasticsearch'] before merging) 🙂 If you decide to use this config for any automated CPS tests, please let me know.

n1v0lg · 2026-04-01T10:05:33Z

By the way, we added support for loopback CPS just to make quick local smoke testing easier, but I believe using this for anything serious, like automated tests or quality gates, is highly discouraged. It might break at any point without warning. @n1v0lg can keep me honest here.

Yes, loopback definitely to be avoided 🙏

dmlemeshko

kbn/scout updates lgtm

Move projectTypeToAlias map from kbn-mock-idp-plugin into kbn-mock-idp-utils as the single source of truth, addressing review feedback. Also fix the UIAM normalization to map 'es' to 'elasticsearch' instead of 'search'. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flash1293 · 2026-04-01T15:49:09Z

Addressed review feedback:

@dmlemeshko: Consolidated the projectToAlias map — it's now defined once in kbn-mock-idp-utils as projectTypeToAlias and exported. The plugin imports it instead of maintaining its own copy.
@azasypkin: Fixed the UIAM normalization to map 'es' → 'elasticsearch' instead of 'search'. The projectTypeToAlias map still uses 'search' → 'es' since that's the Kibana solution name from the cloud plugin used for role file lookups.

@azasypkin could you take another look when you get a chance? Thanks!

elasticmachine · 2026-04-01T17:14:06Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 96feb4e

Failed CI Steps

Jest Tests #4

Test Failures

[job] [logs] Jest Tests #4 / should call onSelectionChange on user selection

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/mock-idp-utils`	60	61	+1

Unknown metric groups

API count

id	before	after	diff
`@kbn/mock-idp-utils`	68	69	+1

History

💛 Build #420212 was flaky 9f490b6
💔 Build #419916 failed 2fa3121
💚 Build #419739 succeeded 9e5fd91

azasypkin

LGTM 👍

…heck * commit 'af66aadafa7470ca8ba3e3edd3793bde81fa4596': (31 commits) [Scout] Update test config manifests (elastic#260850) [SLO]: register alerts schema embeddable (elastic#256570) [Discover][Flyout] Update overview fields table with new prop headerVisibility set to false (elastic#260692) [AiButton/Security] Migrate ai-related buttons to use custom styles (elastic#259847) [One Workflow] Fix connector step icons falling back to generic plugs in YAML editor (elastic#260785) [Agent Builder] Dashboard skill: Guard against editing non-ESQL based panels (elastic#260714) Security quality gate Cypress cleanup - Periodic Pipeline (elastic#260820) [Search] Deprecate search indices in favour of index management (elastic#260210) Upgrade dependency @elastic/charts to v71.4.0 (elastic#260593) [Security Solution] [HDQ]: integration-based targeting and descriptor versioning (elastic#258418) docs(saved-objects): consolidate docs and document scoped vs system client (elastic#260743) Fix observability UIAM config and add CPS observability variant (elastic#260485) [Security Solution] Add "matched_indices_count" rule execution metric (elastic#259938) [SigEvents] Add callout with working promote action. (elastic#260433) [Alerting V2] Episode table actions (elastic#260195) [Automatic Migration] Add ability to skip Reference Set step in QRadar upload workflow (elastic#259959) [Rules] KQL-to-DSL conversion without data view produces incorrect queries for keyword fields for Metric threshold rule (elastic#260046) Update dependency lightningcss to v1.32.0 (main) (elastic#259017) Update postcss (main) (elastic#255420) Migrate server-side apm.addLabels to OTel dual-write helpers (elastic#259619) ...

…tic#260485) ## Summary - Adds `observability_complete` serverless config variant for `cps_local` - Fixes `uiam_local/observability_complete` to import from the observability base config instead of security - Adds `cloud.id` override for UIAM API key conversion in observability UIAM config - Fixes UIAM token `project_type` mismatch by normalizing CLI aliases (`oblt`→`observability`, `es`→`search`) in `@kbn/mock-idp-utils` ## Test plan - [ ] Run `node scripts/scout start-server --arch serverless --domain observability_complete --serverConfigSet cps_local` and verify SAML auth succeeds - [ ] Run `node scripts/scout start-server --arch serverless --domain security_complete --serverConfigSet cps_local` and verify it still works 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flash1293 and others added 2 commits March 31, 2026 15:44

Add CPS local environment setup script

b0053bc

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Clean up CPS env script: fix process management and simplify

9e5fd91

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flash1293 marked this pull request as ready for review March 31, 2026 14:12

flash1293 added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting v9.4.0 labels Mar 31, 2026

flash1293 requested review from a team as code owners March 31, 2026 17:09

flash1293 requested a review from elena-shostak March 31, 2026 17:09

Remove CPS env script — no longer needed

2fa3121

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flash1293 changed the title ~~Add CPS local environment setup script~~ Fix observability UIAM config and add CPS observability variant Mar 31, 2026

Merge branch 'main' into flash1293/cps-script

9f490b6

dmlemeshko reviewed Apr 1, 2026

View reviewed changes

dmlemeshko approved these changes Apr 1, 2026

View reviewed changes

azasypkin approved these changes Apr 1, 2026

View reviewed changes

flash1293 merged commit 88d8ec6 into elastic:main Apr 2, 2026
19 checks passed

	// BOOKMARK - List of Kibana project types
	const projectToAlias = new Map<string, string>([
	['observability', 'oblt'],
	['security', 'security'],
	['search', 'es'],
	['workplaceai', 'workplaceai'],
	]);

Conversation

flash1293 commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

flash1293 commented Mar 31, 2026

Uh oh!

azasypkin commented Mar 31, 2026

Uh oh!

flash1293 commented Mar 31, 2026

Uh oh!

dmlemeshko Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

azasypkin commented Apr 1, 2026

Uh oh!

flash1293 commented Apr 1, 2026

Uh oh!

azasypkin commented Apr 1, 2026

Uh oh!

n1v0lg commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dmlemeshko left a comment

Choose a reason for hiding this comment

Uh oh!

flash1293 commented Apr 1, 2026

Uh oh!

elasticmachine commented Apr 1, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

API count

History

Uh oh!

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

flash1293 commented Mar 31, 2026 •

edited

Loading

n1v0lg commented Apr 1, 2026 •

edited

Loading