Skip to content

Commit 1779d33

Browse files
ycombinatorycombinator
authored
APM server monitoring (#32515)
* Adding new MonitoredSystem for APM server * Teaching Monitoring template utils about APM server monitoring indices * Documenting new monitoring index for APM server * Adding monitoring index template for APM server * Copy pasta typo * Removing metrics.libbeat.config section from mapping * Adding built-in user and role for APM server user * Actually define the role :) * Adding missing import * Removing index template and system ID for apm server * Shortening line lengths * Updating expected number of built-in users in integration test * Removing "system" from role and user names * Rearranging users to make tests pass
1 parent f1f6d4e commit 1779d33

File tree

15 files changed

+106
-21
lines changed

15 files changed

+106
-21
lines changed

‎docs/reference/commands/setup-passwords.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
== elasticsearch-setup-passwords
55

66
The `elasticsearch-setup-passwords` command sets the passwords for the built-in
7-
`elastic`, `kibana`, `logstash_system`, and `beats_system` users.
7+
`elastic`, `kibana`, `logstash_system`, `beats_system`, and `apm_system` users.
88

99
[float]
1010
=== Synopsis

‎docs/reference/monitoring/exporters.asciidoc‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -105,12 +105,12 @@ route monitoring data:
105105

106106
[options="header"]
107107
|=======================
108-
| Template | Purpose
109-
| `.monitoring-alerts` | All cluster alerts for monitoring data.
110-
| `.monitoring-beats` | All Beats monitoring data.
111-
| `.monitoring-es` | All {es} monitoring data.
112-
| `.monitoring-kibana` | All {kib} monitoring data.
113-
| `.monitoring-logstash` | All Logstash monitoring data.
108+
| Template | Purpose
109+
| `.monitoring-alerts` | All cluster alerts for monitoring data.
110+
| `.monitoring-beats` | All Beats monitoring data.
111+
| `.monitoring-es` | All {es} monitoring data.
112+
| `.monitoring-kibana` | All {kib} monitoring data.
113+
| `.monitoring-logstash` | All Logstash monitoring data.
114114
|=======================
115115

116116
The templates are ordinary {es} templates that control the default settings and

‎x-pack/docs/en/security/configuring-es.asciidoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ help you get up and running. The +elasticsearch-setup-passwords+ command is the
5555
simplest method to set the built-in users' passwords for the first time.
5656

5757
For example, you can run the command in an "interactive" mode, which prompts you
58-
to enter new passwords for the `elastic`, `kibana`, `beats_system`, and
59-
`logstash_system` users:
58+
to enter new passwords for the `elastic`, `kibana`, `beats_system`,
59+
`logstash_system`, and `apm_system` users:
6060

6161
[source,shell]
6262
--------------------------------------------------

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/esnative/ClientReservedRealm.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ public static boolean isReserved(String username, Settings settings) {
1919
case UsernamesField.KIBANA_NAME:
2020
case UsernamesField.LOGSTASH_NAME:
2121
case UsernamesField.BEATS_NAME:
22+
case UsernamesField.APM_NAME:
2223
return XPackSettings.RESERVED_REALM_ENABLED_SETTING.get(settings);
2324
default:
2425
return AnonymousUser.isAnonymousUsername(username, settings);

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,8 @@ private static Map<String, RoleDescriptor> initializeReservedRoles() {
112112
null, MetadataUtils.DEFAULT_RESERVED_METADATA))
113113
.put(UsernamesField.BEATS_ROLE, new RoleDescriptor(UsernamesField.BEATS_ROLE,
114114
new String[] { "monitor", MonitoringBulkAction.NAME}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA))
115+
.put(UsernamesField.APM_ROLE, new RoleDescriptor(UsernamesField.APM_ROLE,
116+
new String[] { "monitor", MonitoringBulkAction.NAME}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA))
115117
.put("machine_learning_user", new RoleDescriptor("machine_learning_user", new String[] { "monitor_ml" },
116118
new RoleDescriptor.IndicesPrivileges[] { RoleDescriptor.IndicesPrivileges.builder().indices(".ml-anomalies*",
117119
".ml-notifications").privileges("view_index_metadata", "read").build() },

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/user/APMSystemUser.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.user;
7+
8+
import org.elasticsearch.Version;
9+
import org.elasticsearch.protocol.xpack.security.User;
10+
import org.elasticsearch.xpack.core.security.support.MetadataUtils;
11+
12+
/**
13+
* Built in user for APM server internals. Currently used for APM server monitoring.
14+
*/
15+
public class APMSystemUser extends User {
16+
17+
public static final String NAME = UsernamesField.APM_NAME;
18+
public static final String ROLE_NAME = UsernamesField.APM_ROLE;
19+
public static final Version DEFINED_SINCE = Version.V_6_5_0;
20+
public static final BuiltinUserInfo USER_INFO = new BuiltinUserInfo(NAME, ROLE_NAME, DEFINED_SINCE);
21+
22+
public APMSystemUser(boolean enabled) {
23+
super(NAME, new String[]{ ROLE_NAME }, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, enabled);
24+
}
25+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/user/UsernamesField.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ public final class UsernamesField {
2020
public static final String LOGSTASH_ROLE = "logstash_system";
2121
public static final String BEATS_NAME = "beats_system";
2222
public static final String BEATS_ROLE = "beats_system";
23+
public static final String APM_NAME = "apm_system";
24+
public static final String APM_ROLE = "apm_system";
2325

2426
private UsernamesField() {}
2527
}

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@
9494
import org.elasticsearch.xpack.core.security.authz.permission.Role;
9595
import org.elasticsearch.xpack.core.security.authz.privilege.ApplicationPrivilege;
9696
import org.elasticsearch.xpack.core.security.authz.privilege.ApplicationPrivilegeDescriptor;
97+
import org.elasticsearch.xpack.core.security.user.APMSystemUser;
9798
import org.elasticsearch.xpack.core.security.user.BeatsSystemUser;
9899
import org.elasticsearch.xpack.core.security.user.LogstashSystemUser;
99100
import org.elasticsearch.xpack.core.security.user.SystemUser;
@@ -147,6 +148,7 @@ public void testIsReserved() {
147148
assertThat(ReservedRolesStore.isReserved(XPackUser.ROLE_NAME), is(true));
148149
assertThat(ReservedRolesStore.isReserved(LogstashSystemUser.ROLE_NAME), is(true));
149150
assertThat(ReservedRolesStore.isReserved(BeatsSystemUser.ROLE_NAME), is(true));
151+
assertThat(ReservedRolesStore.isReserved(APMSystemUser.ROLE_NAME), is(true));
150152
}
151153

152154
public void testIngestAdminRole() {
@@ -628,6 +630,30 @@ public void testBeatsSystemRole() {
628630
is(false));
629631
}
630632

633+
public void testAPMSystemRole() {
634+
final TransportRequest request = mock(TransportRequest.class);
635+
636+
RoleDescriptor roleDescriptor = new ReservedRolesStore().roleDescriptor(APMSystemUser.ROLE_NAME);
637+
assertNotNull(roleDescriptor);
638+
assertThat(roleDescriptor.getMetadata(), hasEntry("_reserved", true));
639+
640+
Role APMSystemRole = Role.builder(roleDescriptor, null).build();
641+
assertThat(APMSystemRole.cluster().check(ClusterHealthAction.NAME, request), is(true));
642+
assertThat(APMSystemRole.cluster().check(ClusterStateAction.NAME, request), is(true));
643+
assertThat(APMSystemRole.cluster().check(ClusterStatsAction.NAME, request), is(true));
644+
assertThat(APMSystemRole.cluster().check(PutIndexTemplateAction.NAME, request), is(false));
645+
assertThat(APMSystemRole.cluster().check(ClusterRerouteAction.NAME, request), is(false));
646+
assertThat(APMSystemRole.cluster().check(ClusterUpdateSettingsAction.NAME, request), is(false));
647+
assertThat(APMSystemRole.cluster().check(MonitoringBulkAction.NAME, request), is(true));
648+
649+
assertThat(APMSystemRole.runAs().check(randomAlphaOfLengthBetween(1, 30)), is(false));
650+
651+
assertThat(APMSystemRole.indices().allowedIndicesMatcher(IndexAction.NAME).test("foo"), is(false));
652+
assertThat(APMSystemRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(".reporting"), is(false));
653+
assertThat(APMSystemRole.indices().allowedIndicesMatcher("indices:foo").test(randomAlphaOfLengthBetween(8, 24)),
654+
is(false));
655+
}
656+
631657
public void testMachineLearningAdminRole() {
632658
final TransportRequest request = mock(TransportRequest.class);
633659

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ReservedRealm.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import org.elasticsearch.xpack.core.security.authc.support.Hasher;
2525
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
2626
import org.elasticsearch.xpack.core.security.support.Exceptions;
27+
import org.elasticsearch.xpack.core.security.user.APMSystemUser;
2728
import org.elasticsearch.xpack.core.security.user.AnonymousUser;
2829
import org.elasticsearch.xpack.core.security.user.BeatsSystemUser;
2930
import org.elasticsearch.xpack.core.security.user.ElasticUser;
@@ -149,6 +150,8 @@ private User getUser(String username, ReservedUserInfo userInfo) {
149150
return new LogstashSystemUser(userInfo.enabled);
150151
case BeatsSystemUser.NAME:
151152
return new BeatsSystemUser(userInfo.enabled);
153+
case APMSystemUser.NAME:
154+
return new APMSystemUser(userInfo.enabled);
152155
default:
153156
if (anonymousEnabled && anonymousUser.principal().equals(username)) {
154157
return anonymousUser;
@@ -177,6 +180,9 @@ public void users(ActionListener<Collection<User>> listener) {
177180
userInfo = reservedUserInfos.get(BeatsSystemUser.NAME);
178181
users.add(new BeatsSystemUser(userInfo == null || userInfo.enabled));
179182

183+
userInfo = reservedUserInfos.get(APMSystemUser.NAME);
184+
users.add(new APMSystemUser(userInfo == null || userInfo.enabled));
185+
180186
if (anonymousEnabled) {
181187
users.add(anonymousUser);
182188
}
@@ -228,6 +234,8 @@ private Version getDefinedVersion(String username) {
228234
switch (username) {
229235
case BeatsSystemUser.NAME:
230236
return BeatsSystemUser.DEFINED_SINCE;
237+
case APMSystemUser.NAME:
238+
return APMSystemUser.DEFINED_SINCE;
231239
default:
232240
return Version.V_6_0_0;
233241
}

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.elasticsearch.env.Environment;
2828
import org.elasticsearch.xpack.core.XPackSettings;
2929
import org.elasticsearch.xpack.core.security.support.Validation;
30+
import org.elasticsearch.xpack.core.security.user.APMSystemUser;
3031
import org.elasticsearch.xpack.core.security.user.BeatsSystemUser;
3132
import org.elasticsearch.xpack.core.security.user.ElasticUser;
3233
import org.elasticsearch.xpack.core.security.user.KibanaUser;
@@ -63,7 +64,8 @@
6364
public class SetupPasswordTool extends LoggingAwareMultiCommand {
6465

6566
private static final char[] CHARS = ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789").toCharArray();
66-
public static final List<String> USERS = asList(ElasticUser.NAME, KibanaUser.NAME, LogstashSystemUser.NAME, BeatsSystemUser.NAME);
67+
public static final List<String> USERS = asList(ElasticUser.NAME, APMSystemUser.NAME, KibanaUser.NAME, LogstashSystemUser.NAME,
68+
BeatsSystemUser.NAME);
6769

6870
private final BiFunction<Environment, Settings, CommandLineHttpClient> clientFunction;
6971
private final CheckedFunction<Environment, KeyStoreWrapper, Exception> keyStoreFunction;

0 commit comments

Comments
 (0)