[Uptime] Generate api key for synthetics service #119590

shahzad31 · 2021-11-24T11:27:49Z

Summary

Basic idea is that we will call this utility function from the CRUD requests or kibana task manager, in case of task manager, it will not have access to the request object, so that part we still need to figure out. But i think in most cases i assume when the task manager will run, we will have pushed some saved object, in a sense that key will already be there so it can just reuse it.

you can test the encryption/decryption aspect by placing the following piece of code in existing uptime route , perhaps get_index_status.

const savedObjectsClient = context.core.savedObjects.getClient({
  includedHiddenTypes: [syntheticsServiceApiKey.name],
});

let apKey;

 try{ apKey = await savedObjectsClient.get(syntheticsServiceApiKey.name, syntheticsApiKeyID);}catch(){}
const apiKey = await getAPIKeyForSyntheticsService({
  request,
  savedObjectsClient,
  security: server.security,
  encryptedSavedObject: server.encryptedSavedObjects,
});
const res = await libs.requests.getIndexStatus({ uptimeEsClient });
return { ...res, apiKey, apKey };

shahzad31 · 2021-11-24T16:07:46Z

x-pack/plugins/uptime/server/lib/saved_objects/service_api_key.ts

+import { SyntheticsServiceApiKey } from '../../../common/runtime_types/synthetics_service_api_key';
+import { EncryptedSavedObjectsClient } from '../../../../encrypted_saved_objects/server';
+
+export const syntheticsApiKeyID = 'ba997842-b0cf-4429-aa9d-578d9bf0d391';


using UUID is a requirement to work with encrypted saved objects

elasticmachine · 2021-11-24T16:07:50Z

Pinging @elastic/uptime (Team:uptime)

dominiqueclarke · 2021-11-24T16:05:57Z

x-pack/plugins/uptime/server/lib/synthetics_service/get_api_key.test.ts

+            cluster: ['monitor', 'read_ilm', 'read_pipeline'],
+            index: [
+              {
+                names: ['synthetics-*', 'heartbeat-*'],


Should we be indexing to both heartbeat-* and synthetics-*? I was under the impression we should only be indexing to synthetics-*

I'm realizing that I'm commenting this on the test, but it applies to the actual implementation too. Same for the below comment.

since we are going to use data stream format, it makes sense to remove heartbeat, i will do that

dominiqueclarke · 2021-11-24T16:06:12Z

x-pack/plugins/uptime/server/lib/synthetics_service/get_api_key.test.ts

+            index: [
+              {
+                names: ['synthetics-*', 'heartbeat-*'],
+                privileges: ['view_index_metadata', 'create_doc'],


We will need auto_configure privilege as well to create the data stream

dominiqueclarke · 2021-11-24T16:07:24Z

x-pack/plugins/uptime/common/runtime_types/synthetics_service_api_key.ts

+export const SyntheticsServiceApiKeyType = t.type({
+  id: t.string,
+  name: t.string,
+  apiKey: t.string,


In practice, I've also seen the api service return an encoded key on the object, which is the encoded id and name which saves us the trouble of having to encode it ourselves.

i think we are not using the encoded part, since we only need apiKey and that will get saved in savedObjects in encrypted form. But will add it just in case for typing purpose.

we are not saving encoded part at all in the saved object

dominiqueclarke · 2021-11-24T16:15:26Z

x-pack/plugins/uptime/server/lib/saved_objects/saved_objects.ts

+
+    encryptedSavedObjects.registerType({
+      type: syntheticsServiceApiKey.name,
+      attributesToEncrypt: new Set(['apiKey']),


As I mentioned above, when I was testing this the saved object service also returned to me an encoded key, which was the pre-encoded id:apiKey combination. If that's the case, we should also encrypted that key, or only save the encoded key on the saved object and encrypted that.

dominiqueclarke · 2021-11-24T16:21:13Z

x-pack/plugins/uptime/server/lib/synthetics_service/get_api_key.ts

+    const isApiKeysEnabled = await security.authc.apiKeys?.areAPIKeysEnabled();
+
+    if (!isApiKeysEnabled) {
+      return;


I don't know a lot about the types of helpers we have with our API layer, but when we return null, what is response that is returned to the client? Status 500?

We may need to have a more specific error message here, so that we can let the user know how to remedy this situation. I don't suppose anyone wouldn't be using tls in production, which is required to use API keys, but perhaps if they are just trying to get started and testing out synthetics service, we could populate an error message to let them know to run with tls.

At any rate, this isn't necessary right now for an incremental step, but it could be good to keep in mind.

i think in the route if the key is undefined or an error, that should be passed on to the UI. i have updated this line to bit better

dominiqueclarke · 2021-11-24T16:21:28Z

x-pack/plugins/uptime/server/lib/synthetics_service/get_api_key.ts

+              names: ['synthetics-*', 'heartbeat-*'],
+              privileges: ['view_index_metadata', 'create_doc'],


See my comment on the test about these two lines.

dominiqueclarke · 2021-11-24T16:22:31Z

x-pack/plugins/uptime/server/lib/saved_objects/service_api_key.ts

+  client: SavedObjectsClientContract,
+  apiKey: SyntheticsServiceApiKey
+) => {
+  await client.create(syntheticsServiceApiKey.name, apiKey, {


Does this need an error handling? Unsure of what potential points of failure there are.

i don't think so, it will throw an error, kibana route will auto pick it up and generate a message if it needs be.

dominiqueclarke

LGTM for incremental step!

shahzad31 · 2021-11-25T11:02:01Z

@elasticmachine merge upstream

shahzad31 · 2021-11-25T11:56:27Z

@elasticmachine merge upstream

kibana-ci · 2021-11-25T13:15:31Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💔 Build #9257 failed 00891b7
💔 Build #9245 failed cc680b3
💔 Build #9098 failed da01ddd
💔 Build #9063 failed cb994e5
💔 Build #8983 failed d6cd211e91b659655242ce549ab1d09d94fda497

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

kibanamachine · 2021-11-25T13:20:09Z

The following labels were identified as gaps in your version labels and will be added automatically:

v8.1.0

If any of these should not be on your pull request, please manually remove them.

kibanamachine · 2021-11-25T13:23:09Z

💔 Backport failed

Status	Branch	Result
❌	8.0	Commit could not be cherrypicked due to conflicts

To backport manually run:
node scripts/backport --pr 119590

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

shahzad31 changed the title ~~Generate api key~~ [Uptime] Generate api key for synthetics service Nov 24, 2021

shahzad31 requested review from dominiqueclarke and awahab07 November 24, 2021 16:01

added api key generation utility

cb994e5

shahzad31 force-pushed the generate-api-key branch from 06a0d74 to cb994e5 Compare November 24, 2021 16:02

shahzad31 marked this pull request as ready for review November 24, 2021 16:02

shahzad31 requested a review from a team as a code owner November 24, 2021 16:02

shahzad31 added release_note:skip Skip the PR/issue when compiling release notes v8.0.0 labels Nov 24, 2021

shahzad31 commented Nov 24, 2021

View reviewed changes

botelastic bot added the Team:Uptime - DEPRECATED Synthetics & RUM sub-team of Application Observability label Nov 24, 2021

dominiqueclarke reviewed Nov 24, 2021

View reviewed changes

shahzad31 added 3 commits November 24, 2021 17:29

Merge branch 'main' of github.com:elastic/kibana into generate-api-key

f1228ea

Merge branch 'main' of github.com:elastic/kibana into generate-api-key

088de64

PR feedback

da01ddd

shahzad31 requested a review from dominiqueclarke November 24, 2021 17:13

dominiqueclarke approved these changes Nov 24, 2021

View reviewed changes

revert type change

76542c0

shahzad31 added the auto-backport Deprecated - use backport:version if exact versions are needed label Nov 25, 2021

Merge branch 'main' of github.com:elastic/kibana into generate-api-key

cc680b3

Merge branch 'main' into generate-api-key

00891b7

Merge branch 'main' into generate-api-key

d820dc8

shahzad31 merged commit 5e93d91 into elastic:main Nov 25, 2021

shahzad31 deleted the generate-api-key branch November 25, 2021 13:19

kibanamachine added the v8.1.0 label Nov 25, 2021

shahzad31 mentioned this pull request Nov 25, 2021

[8.0] [Uptime] Generate api key for synthetics service (#119590) #119758

Merged

shahzad31 added a commit to shahzad31/kibana that referenced this pull request Nov 25, 2021

[Uptime] Generate api key for synthetics service (elastic#119590)

68de183

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

TinLe pushed a commit to TinLe/kibana that referenced this pull request Dec 22, 2021

[Uptime] Generate api key for synthetics service (elastic#119590)

377c912

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Uptime] Generate api key for synthetics service #119590

[Uptime] Generate api key for synthetics service #119590

shahzad31 commented Nov 24, 2021 •

edited

Loading

shahzad31 Nov 24, 2021

elasticmachine commented Nov 24, 2021

dominiqueclarke Nov 24, 2021

dominiqueclarke Nov 24, 2021

shahzad31 Nov 24, 2021

shahzad31 Nov 24, 2021

dominiqueclarke Nov 24, 2021

shahzad31 Nov 24, 2021

dominiqueclarke Nov 24, 2021

shahzad31 Nov 24, 2021

shahzad31 Nov 24, 2021

dominiqueclarke Nov 24, 2021

dominiqueclarke Nov 24, 2021

shahzad31 Nov 24, 2021

dominiqueclarke Nov 24, 2021

dominiqueclarke Nov 24, 2021

shahzad31 Nov 24, 2021

dominiqueclarke left a comment

shahzad31 commented Nov 25, 2021

shahzad31 commented Nov 25, 2021

kibana-ci commented Nov 25, 2021

kibanamachine commented Nov 25, 2021

kibanamachine commented Nov 25, 2021

		names: ['synthetics-', 'heartbeat-'],
		privileges: ['view_index_metadata', 'create_doc'],

[Uptime] Generate api key for synthetics service #119590

[Uptime] Generate api key for synthetics service #119590

Conversation

shahzad31 commented Nov 24, 2021 • edited Loading

Summary

Choose a reason for hiding this comment

elasticmachine commented Nov 24, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dominiqueclarke left a comment

Choose a reason for hiding this comment

shahzad31 commented Nov 25, 2021

shahzad31 commented Nov 25, 2021

kibana-ci commented Nov 25, 2021

💚 Build Succeeded

Metrics [docs]

History

kibanamachine commented Nov 25, 2021

kibanamachine commented Nov 25, 2021

💔 Backport failed

shahzad31 commented Nov 24, 2021 •

edited

Loading