Error with a readonly user for Fleet

[jeffatfw]

Kibana version: 8.15.0

Elasticsearch version: 8.15.0

Server OS version: Based on this docker image: docker.elastic.co/kibana/kibana:8.15.0

Browser version: Chrome Version 128.0.6613.84 (Official Build) (arm64)

Browser OS version:

Original install method (e.g. download page, yum, from source, etc.): Docker image

Describe the bug:
Setup a readonly role for Fleet and it results in a Permission Denied error screen.

Steps to reproduce:

1. Create a new role called "fleet read only"
2. In Kibana for all spaces add Fleet Read and Integrations Read
3. Create a new user fleetreadonly and assign to the roles: viewer and "fleet read only"
4. In browser login and go to: https://localhost:5601/app/fleet/
5. See in logs of Kibana: [plugins.fleet.fleet_authz_router] User does not have required fleet authz to access path: /api/fleet/agents/setup
6. See this error in browser: Permission denied
   You are not authorized to access Fleet. Kibana privileges are required to access Fleet; the "Read" or "All" privilege is required to access Integrations.

Expected behavior:
See a readonly view of Fleet

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):
kibana-1 | [2024-08-29T14:50:35.515+00:00][INFO ][plugins.fleet.fleet_authz_router] User does not have required fleet authz to access path: /api/fleet/agents/setup

Any additional context:
I am seeing this in my local dev environment and in a locally hosted production installation.
The documentation on this page is out of date: https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[kpollich]

@nchaulet - Is it possible this is a regression caused by RBAC changes?

[nchaulet]

I do not think it's a regression, Fleet is and was not accessible with Read only access, until we release the new subfeature privileges.

[kpollich]

Going to close this as expected behavior then. Per https://www.elastic.co/guide/en/fleet/current/manage-agents-in-fleet.html:

https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html mentions read privileges when it probably shouldn't, but I think with the RBAC feature nearing delivery this will be clarified with the granular subfeature permissions. See #175831 for public-facing updates about the Fleet RBAC project.