From 2c2d50c154e39de36ff055bbef9875445ea60c4a Mon Sep 17 00:00:00 2001 From: David Roberts Date: Thu, 10 Nov 2022 10:26:18 +0000 Subject: [PATCH 1/2] Extra kibana_system privileges for Fleet transform upgrades These changes go with those of elastic/kibana#142920. As we formalize the process by which the Fleet package installer will upgrade transforms more operations are required for managing the transforms and the related destination index: 1. Need to be able to add an alias on the transform destination index and adjust which indices it points to when upgrading the transform. 2. Need to be able to remove a default ingest pipeline from the settings of an old transform destination index during an upgrade that deletes the ingest pipeline. --- .../authz/store/ReservedRolesStore.java | 14 +++++++++++--- .../authz/store/ReservedRolesStoreTests.java | 18 +++++++++++++----- 2 files changed, 24 insertions(+), 8 deletions(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java index bbeab238dc0c7..399639f70afb0 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java @@ -811,12 +811,20 @@ public static RoleDescriptor kibanaSystemRoleDescriptor(String name) { ".metrics-endpoint.metadata_current_default", ".metrics-endpoint.metadata_united_default" ) - .privileges("create_index", "delete_index", "read", "index") + .privileges("create_index", "delete_index", "read", "index", IndicesAliasesAction.NAME, UpdateSettingsAction.NAME) .build(), // For src/dest indices of the example transform package RoleDescriptor.IndicesPrivileges.builder() .indices("kibana_sample_data_*") - .privileges("create_index", "delete_index", "read", "index", "view_index_metadata") + .privileges( + "create_index", + "delete_index", + "read", + "index", + "view_index_metadata", + IndicesAliasesAction.NAME, + UpdateSettingsAction.NAME + ) .build(), // For src/dest indices of the Cloud Security Posture packages that ships a transform RoleDescriptor.IndicesPrivileges.builder() @@ -825,7 +833,7 @@ public static RoleDescriptor kibanaSystemRoleDescriptor(String name) { .build(), RoleDescriptor.IndicesPrivileges.builder() .indices("logs-cloud_security_posture.findings_latest-default", "logs-cloud_security_posture.scores-default") - .privileges("create_index", "read", "index", "delete") + .privileges("create_index", "read", "index", "delete", IndicesAliasesAction.NAME, UpdateSettingsAction.NAME) .build() }, null, new ConfigurableClusterPrivilege[] { diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 8c562e267a62c..728ddbadf1384 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -993,12 +993,15 @@ public void testKibanaSystemRole() { assertThat(kibanaRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(BulkAction.NAME).test(indexAbstraction), is(true)); - // Allow create and delete index + // Allow create and delete index, modifying aliases, and updating index settings assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(AutoCreateAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateDataStreamAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(DeleteDataStreamAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(GetAliasesAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(IndicesAliasesAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(indexAbstraction), is(true)); // Implied by the overall view_index_metadata and monitor privilege assertViewIndexMetadata(kibanaRole, indexName); @@ -1013,9 +1016,8 @@ public void testKibanaSystemRole() { is(indexAbstraction.getType() != IndexAbstraction.Type.DATA_STREAM) ); - // Deny deleting documents and modifying the index settings + // Deny deleting documents and rollover assertThat(kibanaRole.indices().allowedIndicesMatcher(DeleteAction.NAME).test(indexAbstraction), is(false)); - assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(indexAbstraction), is(false)); assertThat(kibanaRole.indices().allowedIndicesMatcher(RolloverAction.NAME).test(indexAbstraction), is(false)); }); @@ -1073,10 +1075,13 @@ public void testKibanaSystemRole() { assertThat(kibanaRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(BulkAction.NAME).test(indexAbstraction), is(true)); - // Allow create and delete index + // Allow create and delete index, modifying aliases, and updating index settings assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(AutoCreateAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateDataStreamAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(GetAliasesAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(IndicesAliasesAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(indexAbstraction), is(true)); // Implied by the overall view_index_metadata and monitor privilege assertViewIndexMetadata(kibanaRole, indexName); @@ -1121,9 +1126,12 @@ public void testKibanaSystemRole() { assertThat(kibanaRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(BulkAction.NAME).test(indexAbstraction), is(true)); - // Allow create and delete index + // Allow create and delete index, modifying aliases, and updating index settings assertThat(kibanaRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(indexAbstraction), is(true)); assertThat(kibanaRole.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(GetAliasesAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(IndicesAliasesAction.NAME).test(indexAbstraction), is(true)); + assertThat(kibanaRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(indexAbstraction), is(true)); // Implied by the overall view_index_metadata and monitor privilege assertViewIndexMetadata(kibanaRole, indexName); From 9f723e600966a54bf400d31b1e984d6d72e4f086 Mon Sep 17 00:00:00 2001 From: David Roberts Date: Mon, 21 Nov 2022 09:23:52 +0000 Subject: [PATCH 2/2] Update docs/changelog/91499.yaml --- docs/changelog/91499.yaml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 docs/changelog/91499.yaml diff --git a/docs/changelog/91499.yaml b/docs/changelog/91499.yaml new file mode 100644 index 0000000000000..600c0f27cedd7 --- /dev/null +++ b/docs/changelog/91499.yaml @@ -0,0 +1,5 @@ +pr: 91499 +summary: Extra `kibana_system` privileges for Fleet transform upgrades +area: Authorization +type: enhancement +issues: []