Skip to content

[Fleet] Fix dataset suffix in permissions for OTel policies#266101

Merged
jsoriano merged 2 commits intoelastic:mainfrom
jsoriano:fix-permissions-otel-integrations-suffix
Apr 28, 2026
Merged

[Fleet] Fix dataset suffix in permissions for OTel policies#266101
jsoriano merged 2 commits intoelastic:mainfrom
jsoriano:fix-permissions-otel-integrations-suffix

Conversation

@jsoriano
Copy link
Copy Markdown
Member

@jsoriano jsoriano commented Apr 28, 2026 •
edited by kibanamachine
Loading

Summary

Permissions added for data streams in OTel policies should include the .otel suffix in the dataset. Without this the permissions don't match and ingestion fails.

This is an issue with integration packages without dynamic_dataset: true. In the case of input packages this is not an issue because this parameter is always true.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

  • Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

@jsoriano jsoriano self-assigned this Apr 28, 2026
@jsoriano jsoriano requested a review from a team as a code owner April 28, 2026 14:00
@jsoriano jsoriano added Team:Fleet Team label for Observability Data Collection Fleet team backport:version Backport to applied version labels v9.4.0 labels Apr 28, 2026
@infra-vault-gh-plugin-prod
Copy link
Copy Markdown

infra-vault-gh-plugin-prod Bot commented Apr 28, 2026

Pinging @elastic/fleet (Team:Fleet)

@jsoriano jsoriano added the release_note:skip Skip the PR/issue when compiling release notes label Apr 28, 2026
@macroscopeapp
Copy link
Copy Markdown
Contributor

macroscopeapp Bot commented Apr 28, 2026

Approvability

Verdict: Needs human review

This PR modifies how agent index permissions are computed for OTel policies by appending .otel suffixes to dataset names. While gated behind a feature flag, this runtime behavior change affects permission generation and the changed files are owned by @elastic/fleet, not the PR author.

You can customize Macroscope's approvability policy. Learn more.

nchaulet
nchaulet approved these changes Apr 28, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@nchaulet nchaulet left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code LGTM 🚀

Just to be sure I get this correctly otel col append .otel to the dataset as we are using otel mapping mode?

teresaromero
teresaromero approved these changes Apr 28, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@teresaromero teresaromero left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tested integrated with elastic-package 👍🏻

@jsoriano
Copy link
Copy Markdown
Member Author

jsoriano commented Apr 28, 2026

Just to be sure I get this correctly otel col append .otel to the dataset as we are using otel mapping mode?

Yes, the elasticsearch exporter in the OTel collector appends .otel to the dataset, so we need to give permissions for it.

@jsoriano jsoriano added release_note:skip Skip the PR/issue when compiling release notes and removed release_note:skip Skip the PR/issue when compiling release notes labels Apr 28, 2026
@jsoriano jsoriano enabled auto-merge (squash) April 28, 2026 17:30
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Apr 28, 2026

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

cc @jsoriano

@jsoriano jsoriano merged commit 283d848 into elastic:main Apr 28, 2026
21 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Apr 28, 2026

Starting backport for target branches: 9.4

https://github.com/elastic/kibana/actions/runs/25070561455

@kibanamachine kibanamachine mentioned this pull request Apr 28, 2026
Merged
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Apr 28, 2026

💚 All backports created successfully

Status Branch Result
✅ 9.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Apr 28, 2026
@kibanamachine @jsoriano
[9.4] [Fleet] Fix dataset suffix in permissions for OTel policies (#2…
b60dd6f 
…66101) (#266206)

# Backport

This will backport the following commits from `main` to `9.4`:
- [[Fleet] Fix dataset suffix in permissions for OTel policies
(#266101)](#266101)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jaime Soriano
Pastor","email":"jaime.soriano@elastic.co"},"sourceCommit":{"committedDate":"2026-04-28T18:27:33Z","message":"[Fleet]
Fix dataset suffix in permissions for OTel policies
(#266101)\n\nPermissions added for data streams in OTel policies should
include the\n.otel suffix in the dataset. Without this the permissions
don't match\nand ingestion fails.\n\nThis is an issue with integration
packages without `dynamic_dataset:\ntrue`. In the case of input packages
this is not an issue because this\nparameter is always
true.","sha":"283d848b4e9f67b4b4354f51214c699c484a8a04","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Fleet","backport:version","v9.4.0","v9.5.0"],"title":"[Fleet]
Fix dataset suffix in permissions for OTel
policies","number":266101,"url":"https://github.com/elastic/kibana/pull/266101","mergeCommit":{"message":"[Fleet]
Fix dataset suffix in permissions for OTel policies
(#266101)\n\nPermissions added for data streams in OTel policies should
include the\n.otel suffix in the dataset. Without this the permissions
don't match\nand ingestion fails.\n\nThis is an issue with integration
packages without `dynamic_dataset:\ntrue`. In the case of input packages
this is not an issue because this\nparameter is always
true.","sha":"283d848b4e9f67b4b4354f51214c699c484a8a04"}},"sourceBranch":"main","suggestedTargetBranches":["9.4"],"targetPullRequestStates":[{"branch":"9.4","label":"v9.4.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/266101","number":266101,"mergeCommit":{"message":"[Fleet]
Fix dataset suffix in permissions for OTel policies
(#266101)\n\nPermissions added for data streams in OTel policies should
include the\n.otel suffix in the dataset. Without this the permissions
don't match\nand ingestion fails.\n\nThis is an issue with integration
packages without `dynamic_dataset:\ntrue`. In the case of input packages
this is not an issue because this\nparameter is always
true.","sha":"283d848b4e9f67b4b4354f51214c699c484a8a04"}}]}] BACKPORT-->

Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>
@jsoriano jsoriano mentioned this pull request Apr 29, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nchaulet nchaulet nchaulet approved these changes

@teresaromero teresaromero teresaromero approved these changes

Assignees

@jsoriano jsoriano

Labels

backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team v9.4.0 v9.5.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jsoriano @kibanamachine @nchaulet @teresaromero