[Fleet] Added all privilege to kibana_system to logs-fleet_server.* index pattern

[juliaElastic]

• Have you signed the contributor license agreement? yes
• Have you followed the contributor guidelines? yes
• If submitting code, have you built your formula locally prior to submission with gradle check? yes
• If submitting code, is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed. yes
• If submitting code, have you checked that your submission is for an OS and architecture that we support? yes
• If you are submitting this code for a class then read our policy for that.

Giving all access, so that kibana_system can run the ILM policy to clean up the logs-fleet_server.output_health data stream defined here: elastic/integrations#8605

[elasticsearchmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[kc13greiner]

Heya @juliaElastic!

I was wondering if there was a less broad privilege that could be granted to the kibana_system user on the logs-fleet_server* index than all that would still meet the functionality needed.

In the description, ILM is mentioned. Would a privilege manage_ilm work for these purposes? or could you provide more information about why all is required?

[juliaElastic]

I was wondering if there was a less broad privilege that could be granted to the kibana_system user on the logs-fleet_server* index than all that would still meet the functionality needed.

In the description, ILM is mentioned. Would a privilege manage_ilm work for these purposes? or could you provide more information about why all is required?

Hi @kc13greiner, thanks for the review!

We had an error reported when kibana tried to run ILM to delete:

"error.message": "action [indices:admin/data_stream/delete] is unauthorized for user [kibana_system] with effective roles [kibana_system] on indices [logs-fleet_server.output_health-default], this action is granted by the index privileges [delete_index,manage,all]",

Do you think manage_ilm would be sufficient here? I'm okay to change this to a minimum privilege to run the ILM, AFAIK we don't need anything else.

[kc13greiner]

@juliaElastic

Do you think manage_ilm would be sufficient here? I'm okay to change this to a minimum privilege to run the ILM, AFAIK we don't need anything else.

I can't say for sure 😅 I'm not as knowledgable with index privileges as I'd like!

Your latest change to read, delete_index LGTM 🚀

Thanks for reducing it!

[kc13greiner]

LGTM!

kibana_system is allowed higher privileges on logs-* ( and this is specifically logs-fleet_server) even though it is a data index, as they are documented as potential collisions here

[elasticsearchmachine]

💚 Backport successful

Status	Branch	Result
✅	8.13
✅	8.12