Merge branch 'main' into expandable-flyout-package-storybook

.buildkite/ftr_configs.yml

@@ -491,6 +491,8 @@ enabled:
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/exceptions/workflows/basic_license_essentials_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/trial_license_complete_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/trial_license_complete_tier/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_gaps/trial_license_complete_tier/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_gaps/trial_license_complete_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/basic_license_essentials_tier/configs/ess.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/basic_license_essentials_tier/configs/serverless.config.ts
   - x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_creation/trial_license_complete_tier/configs/ess.config.ts

.buildkite/scripts/lifecycle/pre_command.sh

@@ -22,3 +22,11 @@ if [[ "$(curl -is metadata.google.internal || true)" ]]; then
   echo "gcloud compute ssh --tunnel-through-iap --project elastic-kibana-ci --zone \"$(curl -sH Metadata-Flavor:Google http://metadata.google.internal/computeMetadata/v1/instance/zone)\" \"$(curl -sH Metadata-Flavor:Google http://metadata.google.internal/computeMetadata/v1/instance/name)\""
   echo ""
 fi
+
+if [[ "${BUILDKITE_LABEL:-}" == *"Run Dynamic Pipeline"* || "${BUILDKITE_LABEL:-}" == *"Upload Pipeline"* ]]; then
+  cat << EOF | buildkite-agent annotate --context "ctx-gobld-metrics" --style "info"
+<details>
+
+<summary>Agent information from gobld</summary>
+EOF
+fi

docs/CHANGELOG.asciidoc

@@ -10,6 +10,7 @@
 
 Review important information about the {kib} 8.x releases.
 
+* <<release-notes-8.14.1>>
 * <<release-notes-8.14.0>>
 * <<release-notes-8.13.4>>
 * <<release-notes-8.13.3>>
@@ -66,6 +67,25 @@ Review important information about the {kib} 8.x releases.
 * <<release-notes-8.0.0-alpha1>>
 
 --
+[[release-notes-8.14.1]]
+== {kib} 8.14.1
+
+The 8.14.1 release includes the following bug fixes.
+
+[float]
+[[fixes-v8.14.1]]
+=== Bug Fixes
+Data Discovery::
+* Notify the user about issues with access to the default data view ({kibana-pull}184740[#184740]).
+Discover::
+* Fixes resetting of breakdown field in a saved search ({kibana-pull}184668[#184668]).
+Elastic Security::
+For the Elastic Security 8.14.1 release information, refer to {security-guide}/release-notes.html[_Elastic Security Solution Release Notes_].
+Fleet::
+* Fixes restart upgrade disabled condition ({kibana-pull}184586[#184586]).
+Observability::
+* Fixes editing enabled state for project monitor ({kibana-pull}184775[#184775]).
+
 [[release-notes-8.14.0]]
 == {kib} 8.14.0
 

docs/developer/plugin-list.asciidoc

@@ -536,11 +536,11 @@ Plugin server-side only. Plugin has three main functions:
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/data_quality/README.md[dataQuality]
-|Page where users can see the quality of their log datasets.
+|Page where users can see the quality of their log data sets.
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/observability_solution/dataset_quality/README.md[datasetQuality]
-|In order to make ongoing maintenance of log collection easy we want to introduce the concept of dataset quality, where users can easily get an overview on the datasets they have with information such as integration, size, last activity, among others.
+|In order to make ongoing maintenance of log collection easy we want to introduce the concept of data set quality, where users can easily get an overview on the data sets they have with information such as integration, size, last activity, among others.
 
 
 |{kib-repo}blob/{branch}/x-pack/plugins/data_visualizer/README.md[dataVisualizer]

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/agent_manager.ts

@@ -60,6 +60,9 @@ export class AgentManager implements AgentFactoryProvider, AgentStatsProvider {
     this.agents = new Set();
     // Use DNS caching to avoid too many repetitive (and CPU-blocking) dns.lookup calls
     if (options.dnsCacheTtlInSeconds > 0) {
+      this.logger.info(
+        `Caching ES host DNS resolutions for up to ${options.dnsCacheTtlInSeconds}s. If this causes problems, change the setting "elasticsearch.dnsCacheTtl: ${options.dnsCacheTtlInSeconds}s".`
+      );
       this.cacheableLookup = new CacheableLookup({
         maxTtl: options.dnsCacheTtlInSeconds,
       });

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/client_config.test.ts

@@ -25,7 +25,7 @@ const createConfig = (
     sniffInterval: false,
     requestHeadersWhitelist: ['authorization'],
     hosts: ['http://localhost:80'],
-    dnsCacheTtlInSeconds: 0,
+    dnsCacheTtl: duration(0, 'seconds'),
     ...parts,
   };
 };

packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/cluster_client.test.ts

@@ -34,7 +34,7 @@ const createConfig = (
     requestHeadersWhitelist: ['authorization'],
     customHeaders: {},
     hosts: ['http://localhost'],
-    dnsCacheTtlInSeconds: 0,
+    dnsCacheTtl: duration(0, 'seconds'),
     ...parts,
   };
 };

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_config.test.ts

@@ -33,7 +33,7 @@ test('set correct defaults', () => {
       "apisToRedactInLogs": Array [],
       "compression": false,
       "customHeaders": Object {},
-      "dnsCacheTtlInSeconds": 0,
+      "dnsCacheTtl": "P0D",
       "healthCheckDelay": "PT2.5S",
       "healthCheckStartupDelay": "PT0.5S",
       "hosts": Array [

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_config.ts

@@ -186,7 +186,7 @@ export const configSchema = schema.object({
     }),
     { defaultValue: [] }
   ),
-  dnsCacheTtlInSeconds: schema.number({ defaultValue: 0, min: 0, max: Infinity }),
+  dnsCacheTtl: schema.duration({ defaultValue: 0, min: 0 }),
 });
 
 const deprecations: ConfigDeprecationProvider = () => [
@@ -429,10 +429,10 @@ export class ElasticsearchConfig implements IElasticsearchConfig {
   public readonly apisToRedactInLogs: ElasticsearchApiToRedactInLogs[];
 
   /**
-   * The maximum number of seconds to retain the DNS lookup resolutions.
+   * The maximum time to retain the DNS lookup resolutions.
    * Set to 0 to disable the cache (default Node.js behavior)
    */
-  public readonly dnsCacheTtlInSeconds: number;
+  public readonly dnsCacheTtl: Duration;
 
   constructor(rawConfig: ElasticsearchConfigType) {
     this.ignoreVersionMismatch = rawConfig.ignoreVersionMismatch;
@@ -459,7 +459,7 @@ export class ElasticsearchConfig implements IElasticsearchConfig {
     this.compression = rawConfig.compression;
     this.skipStartupConnectionCheck = rawConfig.skipStartupConnectionCheck;
     this.apisToRedactInLogs = rawConfig.apisToRedactInLogs;
-    this.dnsCacheTtlInSeconds = rawConfig.dnsCacheTtlInSeconds;
+    this.dnsCacheTtl = rawConfig.dnsCacheTtl;
 
     const { alwaysPresentCertificate, verificationMode } = rawConfig.ssl;
     const { key, keyPassphrase, certificate, certificateAuthorities } = readKeyAndCerts(rawConfig);

packages/core/elasticsearch/core-elasticsearch-server-internal/src/elasticsearch_service.ts

@@ -224,9 +224,11 @@ export class ElasticsearchService
     });
   }
 
-  private getAgentManager({ dnsCacheTtlInSeconds }: ElasticsearchClientConfig): AgentManager {
+  private getAgentManager({ dnsCacheTtl }: ElasticsearchClientConfig): AgentManager {
     if (!this.agentManager) {
-      this.agentManager = new AgentManager(this.log.get('agent-manager'), { dnsCacheTtlInSeconds });
+      this.agentManager = new AgentManager(this.log.get('agent-manager'), {
+        dnsCacheTtlInSeconds: dnsCacheTtl?.asSeconds() ?? 0, // it should always exists, but some test shortcuts and mocks break this assumption
+      });
     }
     return this.agentManager;
   }

packages/core/elasticsearch/core-elasticsearch-server/src/client/client_config.ts

@@ -50,7 +50,7 @@ export interface ElasticsearchClientConfig {
   caFingerprint?: string;
   ssl?: ElasticsearchClientSslConfig;
   apisToRedactInLogs?: ElasticsearchApiToRedactInLogs[];
-  dnsCacheTtlInSeconds: number;
+  dnsCacheTtl: Duration;
 }
 
 /**

packages/core/elasticsearch/core-elasticsearch-server/src/elasticsearch_config.ts

@@ -151,10 +151,10 @@ export interface IElasticsearchConfig {
   readonly apisToRedactInLogs: ElasticsearchApiToRedactInLogs[];
 
   /**
-   * The maximum number of seconds to retain the DNS lookup resolutions.
+   * The maximum time to retain the DNS lookup resolutions.
    * Set to 0 to disable the cache (default Node.js behavior)
    */
-  readonly dnsCacheTtlInSeconds: number;
+  readonly dnsCacheTtl: Duration;
 }
 
 /**

packages/core/http/core-http-server/index.ts

@@ -105,6 +105,7 @@ export type {
   RouteValidatorFullConfigRequest,
   RouteValidatorFullConfigResponse,
   LazyValidator,
+  RouteAccess,
 } from './src/router';
 export {
   validBodyOutput,

packages/core/http/core-http-server/src/router/index.ts

@@ -51,6 +51,7 @@ export type {
   RouteConfigOptionsBody,
   RouteContentType,
   SafeRouteMethod,
+  RouteAccess,
 } from './route';
 export { validBodyOutput } from './route';
 export type {

packages/core/http/core-http-server/src/router/route.ts

@@ -100,6 +100,16 @@ export interface RouteConfigOptionsBody {
   parse?: boolean | 'gunzip';
 }
 
+/**
+ * Route access level.
+ *
+ * Public routes are stable and intended for external access and are subject to
+ * stricter change management and have long term maintenance windows.
+ *
+ * @remark On serverless access to internal routes is restricted.
+ */
+export type RouteAccess = 'public' | 'internal';
+
 /**
  * Additional route options.
  * @public
@@ -133,7 +143,7 @@ export interface RouteConfigOptions<Method extends RouteMethod> {
    *
    * Defaults to 'internal' If not declared,
    */
-  access?: 'public' | 'internal';
+  access?: RouteAccess;
 
   /**
    * Additional metadata tag strings to attach to the route.

packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_create.ts

@@ -7,6 +7,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import type { RouteAccess } from '@kbn/core-http-server';
 import { SavedObjectConfig } from '@kbn/core-saved-objects-base-server-internal';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { Logger } from '@kbn/logging';
@@ -21,16 +22,21 @@ interface RouteDependencies {
   config: SavedObjectConfig;
   coreUsageData: InternalCoreUsageDataSetup;
   logger: Logger;
+  access: RouteAccess;
 }
 
 export const registerBulkCreateRoute = (
   router: InternalSavedObjectRouter,
-  { config, coreUsageData, logger }: RouteDependencies
+  { config, coreUsageData, logger, access }: RouteDependencies
 ) => {
   const { allowHttpApiAccess } = config;
   router.post(
     {
       path: '/_bulk_create',
+      options: {
+        access,
+        description: `Create saved objects`,
+      },
       validate: {
         query: schema.object({
           overwrite: schema.boolean({ defaultValue: false }),

packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_delete.ts

@@ -7,6 +7,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import type { RouteAccess } from '@kbn/core-http-server';
 import { SavedObjectConfig } from '@kbn/core-saved-objects-base-server-internal';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { Logger } from '@kbn/logging';
@@ -21,16 +22,21 @@ interface RouteDependencies {
   config: SavedObjectConfig;
   coreUsageData: InternalCoreUsageDataSetup;
   logger: Logger;
+  access: RouteAccess;
 }
 
 export const registerBulkDeleteRoute = (
   router: InternalSavedObjectRouter,
-  { config, coreUsageData, logger }: RouteDependencies
+  { config, coreUsageData, logger, access }: RouteDependencies
 ) => {
   const { allowHttpApiAccess } = config;
   router.post(
     {
       path: '/_bulk_delete',
+      options: {
+        access,
+        description: `Remove saved objects`,
+      },
       validate: {
         body: schema.arrayOf(
           schema.object({

packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_get.ts

@@ -7,6 +7,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import type { RouteAccess } from '@kbn/core-http-server';
 import { SavedObjectConfig } from '@kbn/core-saved-objects-base-server-internal';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { Logger } from '@kbn/logging';
@@ -21,16 +22,21 @@ interface RouteDependencies {
   config: SavedObjectConfig;
   coreUsageData: InternalCoreUsageDataSetup;
   logger: Logger;
+  access: RouteAccess;
 }
 
 export const registerBulkGetRoute = (
   router: InternalSavedObjectRouter,
-  { config, coreUsageData, logger }: RouteDependencies
+  { config, coreUsageData, logger, access }: RouteDependencies
 ) => {
   const { allowHttpApiAccess } = config;
   router.post(
     {
       path: '/_bulk_get',
+      options: {
+        access,
+        description: `Get saved objects`,
+      },
       validate: {
         body: schema.arrayOf(
           schema.object({

packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_resolve.ts

@@ -7,6 +7,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import type { RouteAccess } from '@kbn/core-http-server';
 import { SavedObjectConfig } from '@kbn/core-saved-objects-base-server-internal';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { Logger } from '@kbn/logging';
@@ -21,16 +22,21 @@ interface RouteDependencies {
   config: SavedObjectConfig;
   coreUsageData: InternalCoreUsageDataSetup;
   logger: Logger;
+  access: RouteAccess;
 }
 
 export const registerBulkResolveRoute = (
   router: InternalSavedObjectRouter,
-  { config, coreUsageData, logger }: RouteDependencies
+  { config, coreUsageData, logger, access }: RouteDependencies
 ) => {
   const { allowHttpApiAccess } = config;
   router.post(
     {
       path: '/_bulk_resolve',
+      options: {
+        access,
+        description: `Resolve saved objects`,
+      },
       validate: {
         body: schema.arrayOf(
           schema.object({

packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_update.ts

@@ -7,6 +7,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import type { RouteAccess } from '@kbn/core-http-server';
 import { SavedObjectConfig } from '@kbn/core-saved-objects-base-server-internal';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { Logger } from '@kbn/logging';
@@ -21,16 +22,21 @@ interface RouteDependencies {
   config: SavedObjectConfig;
   coreUsageData: InternalCoreUsageDataSetup;
   logger: Logger;
+  access: RouteAccess;
 }
 
 export const registerBulkUpdateRoute = (
   router: InternalSavedObjectRouter,
-  { config, coreUsageData, logger }: RouteDependencies
+  { config, coreUsageData, logger, access }: RouteDependencies
 ) => {
   const { allowHttpApiAccess } = config;
   router.put(
     {
       path: '/_bulk_update',
+      options: {
+        access,
+        description: `Update saved objects`,
+      },
       validate: {
         body: schema.arrayOf(
           schema.object({