[Fleet] Couple agent and integration policy space

[nchaulet]

Description

Related to #190727

Fleet do not support currently to have an agent policy with integration policy that are not in the same space as the agent policy, to be able to release space awareness, we should fix that.

For this:

• we should couple agent policy spaces and integration policy spaces (they should be identical).

  • when creating an integration policy we should assign the space to be the same as the agent policy.

• We should also block reusable integration policies to be used in a policy belonging to multiple space.

  • when moving a policy to different spaces
  • when assigning an integration policy to an agent policy with multiple space

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[nimarezainia]

• We should also block reusable integration policies to be used in a policy belonging to multiple space.

@nchaulet as long as the Reusable Integration is in a space that also appears in the agent policy, we should allow this I think. Does it matter if the agent policy is in multiple spaces? Sounds like we may have an issue with how the reusable integration is applied in this case.

Scenario:
Reusable integration is in space A
Agent policy is in space A, B & C

What would happen to a user in space B or C who can read/write to this Agent Policy? do we filter out the reusable integration in this instance?

[nchaulet]

@nimarezainia with the current implementation this will not work, there is a lot of internal (building the full policy we send to the agent, validations that require agent and integration policy spaces to be exactly the same), but this will work when tackle #194101 that is a another big change

[nimarezainia]

Ok thanks. So really what we are saying is that "reusable integration should only be allowed to be added to Agent Policies that exist in the same space as the integration"