Make tag saved objects shareable ('multiple-isolated' -> 'multiple')

[hop-dev]

Describe the feature: Make it so that tags can be shared across spaces. And a tag can be created, or updated with multiple namespaces.

Describe a specific use case for the feature: In Fleet, when an integration e.g Apache is installed with assets, e.g a dashboard, we tag the dashboard saved object with "Managed" and "Apache".

Because installs can happen concurrently and we only want to have one instance of the "Managed" and "Apache" tags, we override the IDs of the tag saved objects meaning there will never be a race condition where multiple are created.

We have found an issue where the hardcoded IDs now prevent a user from installing packages in multiple spaces #143388. This is because the hardcoded ID causes a conflict. If we could make tags shareable then we could use the same "Managed" tag in every space and not have this issue. (Note: looked into migrating the SO to include the space in the ID but this has been ruled out, see issue for more info)

Issues/Concerns:

• This would mean that users in different spaces can edit the name and color of the tag for each other. I think it would be good to also have the ability to prevent a tag from being edited by users but that is not essential and would be a separate issue which I will create.

Work needed:

• Change 'multiple-isolated' -> 'multiple'
• Allow initialNamespaces to be provided in TagsClient.create options
• Add TagsClient method to update tag namespaces (use updateObjectsSpaces from SO client)
• Not sure this is necessary? Add ability to specify namespace in TagsClient get getAll and delete methods
• Should we have a visual indication that a tag is shared in the tags view and edit modal?

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[rudolf]

Some general guidance for making SO's multiple space aware https://www.elastic.co/guide/en/kibana/master/sharing-saved-objects.html#sharing-saved-objects-phase-2

[pgayvallet]

Some general guidance for making SO's multiple space aware

TIL. Joe sure did some great documentation on this feature.

Now more generally on the request:

If I do think this could eventually make sense to have tags shareable, I would very much like to have a proper expression of need coming from Product for it.

To elaborate a bit, changing the whole SOT APIs and UI to support tags being shareable is some significant work. In addition to what was listed in the issue's original description, I could add a few:

• Adapt the SO tagging management section UI to support displaying / assigning tags to spaces
• Adapt the SO tagging API components (the components used by application) to support the change (e.g allowing to select spaces - or not - when creating a new tag on the fly from another SO's creation form)
• Handle all the edge cases relates to multi-spaces saved objects

So, to summarize, such enhancement represents quite a lot of work, and I'd like Product to weight in regarding whether this is something we know we'll likely want / would make sense across all SO types that currently are, or will be, tag-able.

cc @arisonl

[hop-dev]

hi @pgayvallet thanks for looking into this. I agree I underestimated the work and wider implications of this request and it wouldn't be appropriate to do all this work to fix one bug for the Fleet team :D I am going to look into other workarounds.

[hop-dev]

Closing this as I doubt there will be any demand for this in the near future, thanks again.

[TinaHeiligers]

For tracing purposes, in discussions with the security team at the time that saved objects had to change to become space-aware, we decided to migrate tag saved objects to multiple-isolated and not progress fully to making them sharable across spaces.
#143869 (comment) summarises these decisions.