Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Alerts][License] Define minimum license required for each alert type #84997

Conversation

YulNaumenko
Copy link
Contributor

@YulNaumenko YulNaumenko commented Dec 4, 2020

Current PR contains the first part of the alert types licensing functionality:

  1. Add a minimum license attribute to alert type definition
  2. Define a minimum license requirement in each alert type
  3. Only '.geo-containment' and '.geo-threshold' is under the gold+ license. The rest of alert types was set to basic

Resolve #84954

@YulNaumenko YulNaumenko self-assigned this Dec 4, 2020
@YulNaumenko YulNaumenko force-pushed the alerting-minimum-license-required branch from ec161c2 to f426a70 Compare December 5, 2020 00:58
@YulNaumenko YulNaumenko added Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) v7.11.0 v8.0.0 release_note:skip Skip the PR/issue when compiling release notes labels Dec 5, 2020
@YulNaumenko YulNaumenko marked this pull request as ready for review December 5, 2020 01:47
@YulNaumenko YulNaumenko requested review from a team as code owners December 5, 2020 01:47
@YulNaumenko YulNaumenko requested a review from a team December 5, 2020 01:47
@YulNaumenko YulNaumenko requested a review from a team as a code owner December 5, 2020 01:47
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

@botelastic botelastic bot added Team:APM All issues that need APM UI Team support Team:Uptime - DEPRECATED Synthetics & RUM sub-team of Application Observability labels Dec 5, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/apm-ui (Team:apm)

@elasticmachine
Copy link
Contributor

Pinging @elastic/uptime (Team:uptime)

@@ -45,6 +47,7 @@ export const ALERT_TYPES_CONFIG = {
}),
actionGroups: [THRESHOLD_MET_GROUP],
defaultActionGroupId: 'threshold_met',
minimumLicenseRequired: 'basic',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs a platinum license I think, as it is based on Machine Learning. @sqren?

@@ -67,6 +67,7 @@ export function registerTransactionDurationAnomalyAlertType({
],
},
producer: 'apm',
minimumLicenseRequired: 'basic',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

Copy link
Contributor

@chrisronline chrisronline left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM for Stack Monitoring!

@arisonl
Copy link
Contributor

arisonl commented Dec 7, 2020

@YulNaumenko @dgieselaar @sqren I understand there is a question about alert type licensing. With the exception of a specific maps alert type, which had a very particular reasoning, all alert types are currently on Basic, based on the current alerting licensing strategy. ML-driven alerts need to be discussed indeed because ML is on Platinum, but this conversation needs to happen in the context of the broader strategy, not on a per individual alert type basis. In addition, if the question concerns an alert type which is already released on Basic, upgrading the required license in a subsequent release is something we generally do not do.

@sorenlouv
Copy link
Member

With the exception of a specific maps alert type, which had a very particular reasoning, all alert types are currently on Basic, based on the current alerting licensing strategy

Okay, then let's just leave the APM alerts as basic. I don't think it's super important for us that they are under platinum, other than it would align well with the ML licensing.

@arisonl
Copy link
Contributor

arisonl commented Dec 8, 2020

Thanks for the response. It is a valid discussion that we need to have. There is a "generic" ML alert on the way and it makes sense to discuss the solution-specific ML-driven alerts as well, but the conversation needs to happen in context. For example, higher licenses may mean less adoption, and there is a number of other factors to consider.

@sorenlouv
Copy link
Member

sorenlouv commented Dec 8, 2020

but the conversation needs to happen in context

Makes sense 👍

For example, higher licenses may mean less adoption

True - although in this case, even if we make the alert available under basic, it will not be usable unless the user has Platinum (there won't be any ML data to alert on).
Don't mean to start a discussion around this in this thread - just want to make sure we are okay with this behaviour

@mikecote mikecote self-requested a review December 8, 2020 13:44
@chrisronline
Copy link
Contributor

Just to add to the conversation, Stack Monitoring also has the concept of certain alerts being only available in gold/platinum; however, we are currently creating these alerts "out of the box" (since this concept doesn't exist yet, we are creating these when the user first visits the Stack Monitoring UI) and I'm worried about applying rules for alert creation for a data point that can change over time. For example, if they are on the Basic license when they first visit the Stack Monitoring UI, then upgrade to Gold and don't revisit the Stack Monitoring UI, any gold-gated alerts will not exist. This might be something to consider when implementing #59813 cc @mikecote

Copy link
Member

@pmuellr pmuellr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@mikecote mikecote left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Finished my review, looking good!

Before approving, I want to discuss the type safety with usage of as unknown) as AlertType since it is similar to using any.

@@ -3,7 +3,7 @@
"server": true,
"version": "8.0.0",
"kibanaVersion": "kibana",
"requiredPlugins": ["alerts", "features", "triggersActionsUi", "kibanaReact", "savedObjects", "data"],
"requiredPlugins": ["alerts", "features", "triggersActionsUi", "kibanaReact", "savedObjects", "data", "licensing"],
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find any usage of the licensing plugin within stack_alerts. Was this added by mistake?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I added this by mistake.

@@ -54,6 +56,7 @@ describe('register()', () => {
},
],
defaultActionGroupId: 'default',
minimumLicenseRequired: 'basic' as LicenseType,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

optional nit: Any place that requires casting to LicenseType can usually be fixed by making the alerType typed to AlertType. In this case, changing const alertType = { to const alertType: AlertType = { would do the trick.

@@ -9,6 +9,7 @@ import { ComponentType } from 'react';
import { ActionGroup, AlertActionParam } from '../../alerts/common';
import { ActionType } from '../../actions/common';
import { TypeRegistry } from './application/type_registry';
import { AlertType as AlertTypeApi } from '../../alerts/common';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

optional nit: for a clearer variable name

Suggested change
import { AlertType as AlertTypeApi } from '../../alerts/common';
import { AlertType as CommonAlertType } from '../../alerts/common';

id: string;
name: string;
actionGroups: ActionGroup[];
export interface AlertType extends Omit<AlertTypeApi, 'actionVariables'> {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: since this AlertType doesn't related directly with the common alert type, should we pick or omit attributes? Just thinking in the scenario a new property is added to the common alert type.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I think Pick will be better here

@@ -15,5 +15,5 @@ interface RegisterParams {

export function register(params: RegisterParams) {
const { logger, alerts } = params;
alerts.registerType(getAlertType(logger));
alerts.registerType((getAlertType(logger) as unknown) as AlertType);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doing as unknown) as AlertType throughout would remove the TS type safety we have for alert type. I wonder what caused this to break?

@mikecote
Copy link
Contributor

mikecote commented Dec 8, 2020

Just to add to the conversation, Stack Monitoring also has the concept of certain alerts being only available in gold/platinum; however, we are currently creating these alerts "out of the box" (since this concept doesn't exist yet, we are creating these when the user first visits the Stack Monitoring UI) and I'm worried about applying rules for alert creation for a data point that can change over time. For example, if they are on the Basic license when they first visit the Stack Monitoring UI, then upgrade to Gold and don't revisit the Stack Monitoring UI, any gold-gated alerts will not exist. This might be something to consider when implementing #59813 cc @mikecote

@chrisronline good point. I think for pre-configured alerts, we should bypass the license check for those and handle it differently (ex: execution time). There's ongoing discussion about how we should handle expired licenses and the existing alerts. It seemed disabling the alert was the best option, but maybe not? thinking about your use case where you'd just want the alerts to "resume". This may be the same expectation with other alerts. cc @YulNaumenko

Copy link
Contributor

@kindsun kindsun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Edit: This is resolved and will be addressed in a later PR

I'm still seeing the geo alerts at the basic license level. Is this intentional?

image

Copy link
Contributor

@kindsun kindsun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Geo alert changes lgtm!

  • code review
  • tested locally in chrome

Copy link
Contributor

@mikecote mikecote left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes LGTM! Looks like one .orig file slipped and should be deleted.

@@ -0,0 +1,452 @@
/*
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this file was committed by accident?

const alertType = {
id: 'test',
name: 'My test alert',
actionGroups: [{ id: 'default', name: 'Default' }, RecoveredActionGroup],
defaultActionGroupId: 'default',
minimumLicenseRequired: 'basic' as LicenseType,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: casting to LicenseType instead of defining the alert type as : AlertType.

@kibanamachine
Copy link
Contributor

💛 Build succeeded, but was flaky


Test Failures

"before each" hook for "Deletes one rule".Custom detection rules deletion and edition Deletion "before each" hook for "Deletes one rule"

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has failed 21 times on tracked branches: https://github.com/elastic/kibana/issues/83772

CypressError: `cy.exec('node ../../../scripts/es_archiver load custom_rules --dir ../../test/security_solution_cypress/es_archives --config ../../../test/functional/config.js --es-url http://elastic:changeme@localhost:6112 --kibana-url http://elastic:changeme@localhost:6111')` failed because the command exited with a non-zero code.

Pass `{failOnNonZeroExit: false}` to ignore exit code failures.

Information about the failure:
Code: 1

Stdout:
[34minfo[39m [custom_rules] Loading "mappings.json"
 [34minfo[39m [custom_rules] Loading "data.json.gz"
 [34minfo[39m [custom_rules] Deleted existing index [".kibana_1"]
 [34minfo[39m [cust...

https://on.cypress.io/exec

Because this error occurred during a `before each` hook we are skipping the remaining tests in the current suite: `Custom detection rules dele...`
    at http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:156220:26
    at tryCatcher (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:10584:23)
    at Promise._settlePromiseFromHandler (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8519:31)
    at Promise._settlePromise (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8576:18)
    at Promise._settlePromise0 (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8621:10)
    at Promise._settlePromises (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8701:18)
    at _drainQueueStep (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5291:12)
    at _drainQueue (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5284:9)
    at Async.../../node_modules/bluebird/js/release/async.js.Async._drainQueues (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5300:5)
    at Async.drainQueues (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5170:14)
From Your Spec Code:
    at Object.esArchiverLoad (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_custom.spec.ts:21850:8)
    at Context.eval (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_custom.spec.ts:20415:23)

Creates and activates a new ml rule.Detection rules, machine learning Creates and activates a new ml rule

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has failed 6 times on tracked branches: https://github.com/elastic/kibana/issues/80569

CypressError: `cy.request()` failed on:

http://elastic:changeme@localhost:6111/api/detection_engine/index

The response we received from your web server was:

  > 500: Internal Server Error

This was considered a failure because the status code was not `2xx` or `3xx`.

If you do not want status codes to cause failures pass the option: `failOnStatusCode: false`

-----------------------------------------------------------

The request we sent was:

Method: GET
URL: http://elastic:changeme@localhost:6111/api/detection_engine/index
Headers: {
  "Connection": "keep-alive",
  "user-agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/87.0.4280.88 Safari/537.36",
  "accept": "*/*",
  "cookie": "sid=Fe26.2**e897e810d874e57070756d43906a9de4c5e23b38712122419e359aa6a7155833*ySs-xpuYxG5l5Z-d6Ev3CA*zbGZ445zGFzdgDi04ly5fl0hZ58mLHq6oyvZG1vtPlsafyna8fdewd8xQU0vBkiMF9BXfMy2ouzA3jRbo1MCdOiIkX8lbH3Mgst3l8KSYIWkb-wemLOIiHr6y-T9mphpsJf1pXnfe2RXrrwTYzMdmLPkSkSGYpX-1siAm0cUmYYHL6jAyTHphzXr8X5txYdmNOZurgn8rtI55XcKhnxgFvZk1EgLiTacmZO6XCIcffs**584ccaeaf9b78852f9ac4fbdd7917b15a3462ec6ab0e4961274058a202ecec8e*oEjNmMSJ2LCca9kV2TCF8DcgK2D0cUzORl5NuavR_9Y",
  "accept-encoding": "gzip, deflate",
  "authorization": "Basic ZWxhc3RpYzpjaGFuZ2VtZQ=="
}

-----------------------------------------------------------

The response we got was:

Status: 500 - Internal Server Error
Headers: {
  "content-type": "application/json; charset=utf-8",
  "kbn-name": "kibana-ci-immutable-ubuntu-16-tests-xxl-1607453589780795542",
  "kbn-license-sig": "67efa447a825501e0a26ca378fc86cb585e65af21a73a9049093b93bc70841c2",
  "cache-control": "private, no-cache, no-store, must-revalidate",
  "content-length": "82",
  "date": "Tue, 08 Dec 2020 19:36:59 GMT",
  "connection": "keep-alive",
  "keep-alive": "timeout=120"
}
Body: {
  "message": "Cannot read property 'is_write_index' of undefined",
  "status_code": 500
}


https://on.cypress.io/request
    at http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:158924:21
    at tryCatcher (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:10584:23)
    at Promise._settlePromiseFromHandler (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8519:31)
    at Promise._settlePromise (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8576:18)
    at Promise._settlePromise0 (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8621:10)
    at Promise._settlePromises (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:8701:18)
    at _drainQueueStep (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5291:12)
    at _drainQueue (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5284:9)
    at Async.../../node_modules/bluebird/js/release/async.js.Async._drainQueues (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5300:5)
    at Async.drainQueues (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:5170:14)
From Your Spec Code:
    at Object.waitForAlertsIndexToBeCreated (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_ml.spec.ts:21163:8)
    at Context.eval (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_ml.spec.ts:20337:18)

"after all" hook for "Creates and activates a new ml rule".Detection rules, machine learning "after all" hook for "Creates and activates a new ml rule"

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has failed 3 times on tracked branches: https://github.com/elastic/kibana/issues/85310

CypressError: `cy.click()` failed because it requires a DOM element.

The subject received was:

  > `undefined`

The previous command that ran was:

  > `cy.get()`

Because this error occurred during a `after all` hook we are skipping the remaining tests in the current suite: `Detection rules, machine le...`

Although you have test retries enabled, we do not retry tests when `before all` or `after all` hooks fail
    at ensureElement (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:161170:24)
    at validateType (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:161007:16)
    at Object.ensureSubjectByType (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:161043:9)
    at pushSubjectAndValidate (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:169661:15)
    at Context.<anonymous> (http://elastic:changeme@localhost:6111/__cypress/runner/cypress_runner.js:169998:18)
From Your Spec Code:
    at Object.deleteRule (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_ml.spec.ts:21222:40)
    at Context.eval (http://localhost:6111/__cypress/tests?p=cypress/integration/alerts_detection_rules_ml.spec.ts:20331:34)

and 19 more failures, only showing the first 3.

Metrics [docs]

Distributable file count

id before after diff
default 46960 47720 +760

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
apm 48.8KB 48.9KB +124.0B

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@YulNaumenko YulNaumenko merged commit b20db60 into elastic:alerts/license-checks Dec 8, 2020
YulNaumenko added a commit that referenced this pull request Dec 15, 2020
* [Alerts][License] Define minimum license required for each alert type (#84997)

* Define minimum license required for each alert type

* fixed typechecks

* fixed tests

* fixed tests

* fixed due to comments

* fixed due to comments

* removed file

* removed casting to LicenseType

* [Alerts][License] Add license checks to alerts HTTP APIs and execution (#85223)

* [Alerts][License] Add license checks to alerts HTTP APIs and execution

* fixed typechecks

* resolved conflicts

* resolved conflicts

* added router tests

* fixed typechecks

* added license check support for alert task running

* fixed typechecks

* added integration tests

* fixed due to comments

* fixed due to comments

* fixed tests

* fixed typechecks

* [Alerting UI][License] Disable alert types in UI when the license doesn't support it. (#85496)

* [Alerting UI][License] Disable alert types in UI when the license doesn't support it.

* fixed typechecks

* added licensing for alert list and details page

* fixed multy select menu

* fixed due to comments

* fixed due to comments

* fixed due to comments

* fixed typechecks

* fixed license error message

* fixed license error message

* fixed typechecks

* fixed license error message

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Alerting release_note:skip Skip the PR/issue when compiling release notes Team:APM All issues that need APM UI Team support Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Team:Uptime - DEPRECATED Synthetics & RUM sub-team of Application Observability v7.11.0 v8.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Alerts][License] Define minimum license required for each alert type.