[Fleet] Add a preconfiguration reset API

[joshdover]

Scoped down version of #118214

Adding this API would help support in fixing issues that are coming up frequently in the 7.x release series. Having an API over manual workaround steps allows us to have a consistent remediation that is not vulnerable to human mistake.

Proposal

POST /internal/fleet/reset_preconfigured_agent_policies

This API will delete all the saved objects related to the default policies:

• Package policies
• Default agent policies
  • We should also try to force unenroll any agents here

Then we should clean all .fleet-* internal for these policies

• .fleet-enrollment-tokens - we should try to invalidate the related API key when deleting a document from here.
  • Do we have a utility for doing this combined action today? If not, it'd be nice to have a single code path for deleting enrollment tokens that also handles invalidating the API key that can be used broadly in the codebase.
• .fleet-policies

Then this should call the setup to restore the preconfigured policies (within the same API call, not a separate step that a support engineer would have to run).

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[joshdover]

I think we should make the path for this API to use the /internal/ prefix instead of /api/ to clearly message that this API is not considered stable and is subject to removal:

POST /internal/fleet/reset_preconfigured_agent_policies

[jen-huang]

@nchaulet We'd like to get this in for 7.17 to help with supportability of 7.x. Do you have capacity to work on this?

[nchaulet]

@nchaulet We'd like to get this in for 7.17 to help with supportability of 7.x. Do you have capacity to work on this?

Sure I can find some time for that before 7.17 feature freeze :)

[joshdover]

Test instructions:

• Spin up 7.17.0 deployment on Cloud staging
• Do the switch from APM standalone -> APM managed by Fleet by going to APM/Settings/Schema/Switch to Elastic Agent
• Edit the APM policy that was created (just changing the namespace would work)
• Run this API call:

   curl -XPOST https://<kibana url>/internal/fleet/reset_preconfigured_agent_policies/policy-elastic-agent-on-cloud -u elastic:<password> -H 'kbn-xsrf: xyz' -H 'content-type: application/json'
  

• Refresh APM policy and see that verify that any changes made in prior step were reverted

[amolnater-qasource]

Hi @joshdover
Thanks for the detailed steps.
We have revalidated this issue on 7.17.0 and we followed all the same steps.
After execution till step 3, we had Elastic APM integration available in Elastic cloud agent policy with namespace test.

Then we ran the API call.
After this step, we observed that Elastic APM integration is removed from Elastic cloud agent policy.

Screenshots:

Please let us know if this is the required outcome.
Thanks

[joshdover]

Looks great, thanks!