Merge remote-tracking branch 'upstream/main' into limit-max-assignees…

…-filter

.buildkite/scripts/steps/artifacts/docker_image.sh

@@ -83,9 +83,18 @@ echo "--- Trigger image tag update"
 if [[ "$BUILDKITE_BRANCH" == "$KIBANA_BASE_BRANCH" ]]; then
   cat << EOF | buildkite-agent pipeline upload
 steps:
+  - label: ":argo: Update kibana image tag for kibana-controller using gpctl"
+    async: true
+    branches: main
+    trigger: gpctl-promote
+    build:
+      env:
+        SERVICE_COMMIT_HASH: $GIT_ABBREV_COMMIT
+        REMOTE_SERVICE_CONFIG: https://raw.githubusercontent.com/elastic/serverless-gitops/main/gen/gpctl/kibana/config.yaml
+
   - trigger: serverless-gitops-update-stack-image-tag
     async: true
-    label: ":argo: Update image tag for Kibana"
+    label: ":argo: Update image tag for Kibana using the legacy script (used in QA/Staging)"
     branches: main
     build:
       env:

.github/workflows/auto-approve-backports.yml

@@ -4,10 +4,6 @@ on:
       - main
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: hmarr/debug-action@v2
   approve:
     name: Auto-approve backport
     runs-on: ubuntu-latest
@@ -18,5 +14,3 @@ jobs:
       pull-requests: write
     steps:
       - uses: hmarr/auto-approve-action@v3
-        with:
-          github-token: ${{ secrets.KIBANAMACHINE_TOKEN }}

docs/CHANGELOG.asciidoc

@@ -105,6 +105,26 @@ Uptime::
 
 Review the following information about the {kib} 8.8.1 release.
 
+[float]
+[[known-issues-8.8.1]]
+=== Known issues
+
+// tag::known-issue-159807[]
+[discrete]
+.Memory leak in {fleet} audit logging.
+[%collapsible]
+====
+*Details* +
+{fleet} introduced audit logging for various CRUD (create, read, update, and delete) operations in version 8.8.0.
+
+While audit logging is not enabled by default, we have identified an off-heap memory leak in the implementation of {fleet} audit logging that can result in poor {kib} performance, and in some cases {kib} instances being terminated by the OS kernel's oom-killer. This memory leak can occur even when {kib} audit logging is not explicitly enabled (regardless of whether `xpack.security.audit.enabled` is set in the `kibana.yml` settings file).
+
+*Impact* +
+The version 8.8.2 release includes in {kibana-pull}159807[a fix] for this problem. If you are using {fleet} integrations
+and {kib} audit logging in version 8.8.0 or 8.8.1, you should upgrade to 8.8.2 or above to obtain the fix.
+====
+// end::known-issue-159807[]
+
 [float]
 [[breaking-changes-8.8.1]]
 === Breaking changes
@@ -196,6 +216,20 @@ The 8.8.1 release includes in {kibana-pull}158940[a fix] for this problem. Custo
 ====
 // end::known-issue-158940[]
 
+// tag::known-issue-159807[]
+[discrete]
+.Memory leak in {fleet} audit logging.
+[%collapsible]
+====
+*Details* +
+{fleet} introduced audit logging for various CRUD (create, read, update, and delete) operations in version 8.8.0.
+While audit logging is not enabled by default, we have identified an off-heap memory leak in the implementation of {fleet} audit logging that can result in poor {kib} performance, and in some cases {kib} instances being terminated by the OS kernel's oom-killer. This memory leak can occur even when {kib} audit logging is not explicitly enabled (regardless of whether `xpack.security.audit.enabled` is set in the `kibana.yml` settings file).
+*Impact* +
+The version 8.8.2 release includes in {kibana-pull}159807[a fix] for this problem. If you are using {fleet} integrations
+and {kib} audit logging in version 8.8.0 or 8.8.1, you should upgrade to 8.8.2 or above to obtain the fix.
+====
+// end::known-issue-159807[]
+
 // tag::known-issue-155203[]
 [discrete]
 .Monitors in Synthetics may stop running

fleet_packages.json

@@ -34,7 +34,7 @@
   },
   {
     "name": "endpoint",
-    "version": "8.9.0"
+    "version": "8.9.1"
   },
   {
     "name": "fleet_server",
@@ -58,6 +58,6 @@
   },
   {
     "name": "security_detection_engine",
-    "version": "8.8.4"
+    "version": "8.8.5"
   }
 ]

packages/content-management/table_list_view/src/table_list_view.tsx

@@ -7,7 +7,7 @@
  */
 
 import { KibanaPageTemplate } from '@kbn/shared-ux-page-kibana-template';
-import React, { ReactNode, useState } from 'react';
+import React, { ReactNode, useCallback, useState } from 'react';
 import {
   TableListViewTable,
   type TableListViewTableProps,
@@ -81,6 +81,12 @@ export const TableListView = <T extends UserContentCommonSchema>({
   const [hasInitialFetchReturned, setHasInitialFetchReturned] = useState(false);
   const [pageDataTestSubject, setPageDataTestSubject] = useState<string>();
 
+  const onFetchSuccess = useCallback(() => {
+    if (!hasInitialFetchReturned) {
+      setHasInitialFetchReturned(true);
+    }
+  }, [hasInitialFetchReturned]);
+
   return (
     <PageTemplate panelled data-test-subj={pageDataTestSubject}>
       <KibanaPageTemplate.Header
@@ -115,11 +121,7 @@ export const TableListView = <T extends UserContentCommonSchema>({
           contentEditor={contentEditor}
           titleColumnName={titleColumnName}
           withoutPageTemplateWrapper={withoutPageTemplateWrapper}
-          onFetchSuccess={() => {
-            if (!hasInitialFetchReturned) {
-              setHasInitialFetchReturned(true);
-            }
-          }}
+          onFetchSuccess={onFetchSuccess}
           setPageDataTestSubject={setPageDataTestSubject}
         />
       </KibanaPageTemplate.Section>

packages/content-management/table_list_view_table/src/table_list_view.test.tsx

@@ -1197,10 +1197,23 @@ describe('TableList', () => {
     }
   );
 
-  it('refreshes the list when the bouncer changes', async () => {
+  it('refreshes the list when "refreshListBouncer" changes', async () => {
     let testBed: TestBed;
 
-    const findItems = jest.fn().mockResolvedValue({ total: 0, hits: [] });
+    const originalHits: UserContentCommonSchema[] = [
+      {
+        id: `item`,
+        type: 'dashboard',
+        updatedAt: 'original timestamp',
+        attributes: {
+          title: `Original title`,
+        },
+        references: [],
+      },
+    ];
+    const findItems = jest
+      .fn()
+      .mockResolvedValue({ total: originalHits.length, hits: originalHits });
 
     await act(async () => {
       testBed = setup({ findItems });
@@ -1215,7 +1228,7 @@ describe('TableList', () => {
       {
         id: `item`,
         type: 'dashboard',
-        updatedAt: 'some date',
+        updatedAt: 'updated timestamp',
         attributes: {
           title: `Updated title`,
         },

packages/content-management/table_list_view_table/src/table_list_view_table.tsx

@@ -369,7 +369,7 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
   } = state;
 
   const hasQuery = searchQuery.text !== '';
-  const hasNoItems = !isFetchingItems && items.length === 0 && !hasQuery;
+  const hasNoItems = hasInitialFetchReturned && items.length === 0 && !hasQuery;
   const showFetchError = Boolean(fetchError);
   const showLimitError = !showFetchError && totalItems > listingLimit;
 
@@ -411,10 +411,6 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
     }
   }, [searchQueryParser, searchQuery.text, findItems, onFetchSuccess]);
 
-  useEffect(() => {
-    fetchItems();
-  }, [fetchItems, refreshListBouncer]);
-
   const updateQuery = useCallback(
     (query: Query) => {
       if (urlStateEnabled) {
@@ -800,7 +796,17 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
   // ------------
   // Effects
   // ------------
-  useDebounce(fetchItems, 300, [fetchItems]);
+  useDebounce(
+    () => {
+      // Do not call fetchItems on dependency changes when initial fetch does not load any items
+      // to avoid flashing between empty table and no items view
+      if (!hasNoItems) {
+        fetchItems();
+      }
+    },
+    300,
+    [fetchItems, refreshListBouncer]
+  );
 
   useEffect(() => {
     if (!urlStateEnabled) {

packages/kbn-apm-synthtrace-client/index.ts

@@ -19,15 +19,17 @@ export type {
   OSInfo,
 } from './src/lib/apm/mobile_device';
 export { httpExitSpan } from './src/lib/apm/span';
+export { type AssetDocument } from './src/lib/assets';
 export { DistributedTrace } from './src/lib/dsl/distributed_trace_client';
 export { serviceMap } from './src/lib/dsl/service_map';
 export type { Fields } from './src/lib/entity';
+export { infra, type InfraDocument } from './src/lib/infra';
+export { parseInterval } from './src/lib/interval';
+export { monitoring, type MonitoringDocument } from './src/lib/monitoring';
 export type { Serializable } from './src/lib/serializable';
 export { timerange } from './src/lib/timerange';
 export type { Timerange } from './src/lib/timerange';
+export { dedot } from './src/lib/utils/dedot';
 export { generateLongId, generateShortId } from './src/lib/utils/generate_id';
 export { appendHash, hashKeysOf } from './src/lib/utils/hash';
-export { dedot } from './src/lib/utils/dedot';
 export type { ESDocumentWithOperation, SynthtraceESAction, SynthtraceGenerator } from './src/types';
-
-export { parseInterval } from './src/lib/interval';

packages/kbn-apm-synthtrace-client/src/lib/apm/service.ts

@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+import { ServiceAsset } from '../assets';
 import { Entity } from '../entity';
 import { ApmFields } from './apm_fields';
 import { Instance } from './instance';
@@ -18,6 +19,15 @@ export class Service extends Entity<ApmFields> {
       'host.name': instanceName,
     });
   }
+
+  asset() {
+    return new ServiceAsset({
+      'asset.kind': 'service',
+      'asset.id': this.fields['service.name']!,
+      'asset.name': this.fields['service.name'],
+      'asset.ean': `service:${this.fields['service.name']}`,
+    });
+  }
 }
 
 export function service(name: string, environment: string, agentName: string): Service;

packages/kbn-apm-synthtrace-client/src/lib/assets/index.ts

@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+// eslint-disable-next-line max-classes-per-file
+import { Fields } from '../entity';
+import { Serializable } from '../serializable';
+
+// Can I pull in types from asset-manager here?
+type AssetKind = 'host' | 'pod' | 'container' | 'service';
+
+export interface AssetKindDocument<T extends AssetKind> extends Fields {
+  'asset.kind': T;
+  'asset.ean': string;
+  'asset.id': string;
+  'asset.name'?: string;
+  'asset.parents'?: string[];
+  'asset.children'?: string[];
+  'asset.references'?: string[];
+}
+
+// What is the best way to tie up relationships?
+// With these setters we can go both ways but the entities might be able to produce
+// pre-linked assets as well
+class Asset<T extends AssetKind> extends Serializable<AssetKindDocument<T>> {
+  parents(parents: string[]) {
+    this.fields['asset.parents'] = parents;
+  }
+
+  children(children: string[]) {
+    this.fields['asset.children'] = children;
+  }
+
+  references(references: string[]) {
+    this.fields['asset.references'] = references;
+  }
+}
+
+export class HostAsset extends Asset<'host'> {}
+
+export class PodAsset extends Asset<'pod'> {}
+
+export class ContainerAsset extends Asset<'container'> {}
+
+export class ServiceAsset extends Asset<'service'> {}
+
+export type AssetDocument =
+  | AssetKindDocument<'host'>
+  | AssetKindDocument<'pod'>
+  | AssetKindDocument<'container'>
+  | AssetKindDocument<'service'>;

packages/kbn-apm-synthtrace-client/src/lib/infra/container.ts

@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/* eslint-disable max-classes-per-file */
+import { ContainerAsset } from '../assets';
+import { Entity, Fields } from '../entity';
+import { Serializable } from '../serializable';
+
+interface ContainerDocument extends Fields {
+  'container.id': string;
+  'kubernetes.pod.uid': string;
+  'kubernetes.node.name': string;
+}
+
+export class Container extends Entity<ContainerDocument> {
+  metrics() {
+    return new ContainerMetrics({
+      ...this.fields,
+      'kubernetes.container.cpu.usage.limit.pct': 46,
+    });
+  }
+
+  asset() {
+    return new ContainerAsset({
+      'asset.kind': 'container',
+      'asset.id': this.fields['container.id'],
+      'asset.name': this.fields['container.id'],
+      'asset.ean': `container:${this.fields['container.id']}`,
+    });
+  }
+}
+
+export interface ContainerMetricsDocument extends ContainerDocument {
+  'kubernetes.container.cpu.usage.limit.pct': number;
+}
+
+class ContainerMetrics extends Serializable<ContainerMetricsDocument> {}
+
+export function container(id: string, uid: string, nodeName: string) {
+  return new Container({
+    'container.id': id,
+    'kubernetes.pod.uid': uid,
+    'kubernetes.node.name': nodeName,
+  });
+}