Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Fleet] Custom permissions for connector package #192081

Merged
merged 9 commits into from
Sep 17, 2024
Merged

[Fleet] Custom permissions for connector package #192081

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
f431a32
[WIP] Connector-specific agent permissions
jedrazb Sep 4, 2024
febc1e6
[Fleet] Add special permissions to elastic_connectors package
jedrazb Sep 11, 2024
228b229
Merge branch 'main' into support-elastic-connectors-agent-permissions
elasticmachine Sep 11, 2024
8d6e206
oops
jedrazb Sep 11, 2024
e23a656
Merge branch 'support-elastic-connectors-agent-permissions' of github…
jedrazb Sep 11, 2024
b5c1ce1
Remove un-needed permissions, per review
seanstory Sep 16, 2024
f114b06
remove unneeded perms from test, too
seanstory Sep 16, 2024
0d9cc96
Merge branch 'main' into support-elastic-connectors-agent-permissions
seanstory Sep 16, 2024
91467eb
Merge branch 'main' into support-elastic-connectors-agent-permissions
artem-shelkovnikov Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions x-pack/plugins/fleet/common/constants/epm.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ export const FLEET_CLOUD_SECURITY_POSTURE_CSPM_POLICY_TEMPLATE = 'cspm';
export const FLEET_CLOUD_SECURITY_POSTURE_CNVM_POLICY_TEMPLATE = 'vuln_mgmt';
export const FLEET_CLOUD_DEFEND_PACKAGE = 'cloud_defend';
export const FLEET_CLOUD_BEAT_PACKAGE = 'cloudbeat';
export const FLEET_CONNECTORS_PACKAGE = 'elastic_connectors';

export const GLOBAL_DATA_TAG_EXCLUDED_INPUTS = new Set<string>([
FLEET_APM_PACKAGE,
Expand Down
1 change: 1 addition & 0 deletions x-pack/plugins/fleet/server/services/agent_policies/full_agent_policy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,6 +239,7 @@ export async function getFullAgentPolicy(
agentPolicy.namespace,
packagePolicies
);
console.log(dataPermissions);
dataPermissionsByOutputId[outputId] = {
_elastic_agent_checks: {
cluster: DEFAULT_CLUSTER_PERMISSIONS,
Expand Down
38 changes: 38 additions & 0 deletions x-pack/plugins/fleet/server/services/agent_policies/package_policies_to_agent_permissions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import type {

import {
FLEET_APM_PACKAGE,
FLEET_CONNECTORS_PACKAGE,
FLEET_UNIVERSAL_PROFILING_COLLECTOR_PACKAGE,
FLEET_UNIVERSAL_PROFILING_SYMBOLIZER_PACKAGE,
} from '../../../common/constants';
Expand Down Expand Up @@ -41,6 +42,16 @@ export const UNIVERSAL_PROFILING_PERMISSIONS = [
'view_index_metadata',
];

export const CONNECTOR_SERVICE_PERMISSIONS = [
jedrazb marked this conversation as resolved.
Show resolved Hide resolved
'auto_configure',
'read',
'create_doc',
'create',
'write',
'index',
'view_index_metadata',
];

export function storedPackagePoliciesToAgentPermissions(
packageInfoCache: Map<string, PackageInfo>,
agentPolicyNamespace: string,
Expand Down Expand Up @@ -79,6 +90,10 @@ export function storedPackagePoliciesToAgentPermissions(
return apmPermissions(packagePolicy.id);
}

if (pkg.name === FLEET_CONNECTORS_PACKAGE) {
return connectorServicePermissions(packagePolicy.id);
}

const dataStreams = getNormalizedDataStreams(pkg);
if (!dataStreams || dataStreams.length === 0) {
return [packagePolicy.name, undefined];
Expand Down Expand Up @@ -247,3 +262,26 @@ function apmPermissions(packagePolicyId: string): [string, SecurityRoleDescripto
},
];
}

function connectorServicePermissions(packagePolicyId: string): [string, SecurityRoleDescriptor] {
return [
packagePolicyId,
{
cluster: ['manage_connector'],
indices: [
{
names: ['traces-*', 'logs-*', 'metrics-*'],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not familiar with the connector but does it need to write to all of those logs, metrics, traces datastreams?

Copy link
Member Author

@jedrazb jedrazb Sep 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The connector component doesn't need to write to those indices.

IIRC when I was testing locally, I think that I could only access the connector component logs in Fleet UI after adding this to permissions. So, I think it does need to write to logs-* at least (could I be wrong here?). I'm not sure about traces-* and metrics-* honestly.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think logs will be send by elastic-agent if monitoring is enabled for the agent policy, this how it works for other components, so unless there is a specific need I think we probably not need those permissions

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nchaulet Actually after removing this bit we are no longer able to receive component-level logs, even with system logs + metrics collection enabled, I'm leaning towards adding:

{
  names: ['logs-elastic_agent*'],
  privileges: ['auto_configure', 'create_doc']
}

privileges: ['auto_configure', 'create_doc'],
},
seanstory marked this conversation as resolved.
Show resolved Hide resolved
{
names: ['.elastic-connectors*'],
privileges: ['manage', 'read', 'write'],
},
{
names: ['search-*'],
jedrazb marked this conversation as resolved.
Show resolved Hide resolved
privileges: ['manage', 'read', 'write'],
},
],
},
];
}