[Feature controls] Allow Elasticsearch features to be hidden in individual spaces #114699
Labels
enhancement
New value added to drive a business result
Feature:Security/Feature Controls
Platform Security - Spaces & Role Mgmt feature controls
Feature:Security/Spaces
Platform Security - Spaces feature
Team:Security
Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
unified-security-painpoint
Highlights issues that are painpoints as a result of the lack of a unified security model
Summary
We manage two types of features today: Kibana Features and Elasticsearch Features.
Kibana Features are those which respect the Kibana Privilege model -- a vast majority of our features are considered Kibana Features. These features can be disabled at the space level, and access can be managed via Kibana's RBAC model.
Elasticsearch Features are those which rely on cluster and/or index privileges in order to function. Broadly speaking, most Stack Management apps fall into this category. For example,
Index Lifecycle Management
requires themanage_ilm
cluster privilege in order to function. They were introduced in #67791, which gave us the ability to hide stack management features based on cluster/index privileges.These features CANNOT be disabled at the space level. If an administrator wants to hide an Elasticsearch feature, they must either configure their roles to forbid access, or disable the plugins via
kibana.yml
.#89584 prevents us from disabling plugins by default starting in 8.0, so there is a desire to allow Elasticsearch Features to be disabled at the space level. Note that this does not impact the privilege model at all. This is merely an update to the UI-based space level controls.
Tasks
Update the Elasticsearch Feature model
The
ElasticsearchFeature
model will need to be updated to include:name
,category
, andorder
required. Otherwise they should not be specified.The associated validation schema will also need to be updated.
Update the Spaces capability switcher
The Spaces capability switcher will need to be updated to respect Elasticsearch Features that wish to be visible in the spaces management screen.
Update the Spaces management UI
The management UI will need to be updated to show Elasticsearch Features that have opted into per-space control.
cc @sebelga @cjcenizal
The text was updated successfully, but these errors were encountered: