Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extra kibana_system privileges for Fleet transform upgrades #91499

Merged

Conversation

droberts195
Copy link
Contributor

These changes go with those of elastic/kibana#142920.

As we formalize the process by which the Fleet package installer will upgrade transforms more operations are required for managing the transforms and the related destination index:

  1. Need to be able to add an alias on the transform destination index and adjust which indices it points to when upgrading the transform.
  2. Need to be able to remove a default ingest pipeline from the settings of an old transform destination index during an upgrade that deletes the ingest pipeline.

These changes go with those of elastic/kibana#142920.

As we formalize the process by which the Fleet package
installer will upgrade transforms more operations are
required for managing the transforms and the related
destination index:

1. Need to be able to add an alias on the transform
   destination index and adjust which indices it points
   to when upgrading the transform.
2. Need to be able to remove a default ingest pipeline
   from the settings of an old transform destination
   index during an upgrade that deletes the ingest
   pipeline.
@droberts195 droberts195 added >non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC v8.6.0 labels Nov 10, 2022
@droberts195
Copy link
Contributor Author

cc @qn895

@elasticsearchmachine elasticsearchmachine added the Team:Security Meta label for security team label Nov 10, 2022
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

@ywangd
Copy link
Member

ywangd commented Nov 14, 2022

Ping @elastic/kibana-security for awareness

@kingherc kingherc added v8.7.0 and removed v8.6.0 labels Nov 16, 2022
@azasypkin
Copy link
Member

Thanks for the ping @ywangd! Looks good from the Kibana Security perspective.

@ywangd
Copy link
Member

ywangd commented Nov 21, 2022

@droberts195 I think this should be >enhancement. Do you have a reason to label it as >non-issue?

@droberts195
Copy link
Contributor Author

Do you have a reason to label it as >non-issue?

I thought it best not to clutter the release notes with internal implementation details. (I'm assuming that we don't expect external users to use the kibana_system role directly.)

But I'm happy to make this >enhancement if that fits better with what the security team usually puts in the release notes.

@elasticsearchmachine
Copy link
Collaborator

Hi @droberts195, I've created a changelog YAML for you.

@droberts195
Copy link
Contributor Author

@elasticmachine update branch

Copy link
Member

@ywangd ywangd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@droberts195 droberts195 merged commit fbb300b into elastic:main Nov 22, 2022
@droberts195 droberts195 deleted the fleet_transform_upgrade_privileges branch November 22, 2022 08:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>enhancement :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team v8.7.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants