[APM] Internal server error on APM configuration

[liza-mae]

Kibana version: 7.4.0 BC4

Elasticsearch version: 7.4.0 BC4

Server OS version: Linux

Browser version: Chrome Latest

Original install method (e.g. download page, yum, from source, etc.):
staging

Description of the problem including expected versus actual behavior:
Kibana console error message on APM configuration, not sure if it is expected or not.

Steps to reproduce:

1. Install ES/Kibana default
2. Go to APM -> Settings and see the error is thrown, I don't have any agents, but I was not sure if it should throw an internal server error and was confused by the message that that the user may not have sufficient permissions, I am logged in as super user - is the error being thrown since there are no APM agents ?

Errors in browser console (if relevant):
GET https://localhost:5601/api/apm/settings/agent-configuration 500 (Internal Server Error)
_callee6$ @ commons.bundle.js:3
tryCatch @ vendors.bundle.dll.js:471
invoke @ vendors.bundle.dll.js:471
prototype. @ vendors.bundle.dll.js:471
asyncGeneratorStep @ commons.bundle.js:3
_next @ commons.bundle.js:3
(anonymous) @ commons.bundle.js:3
(anonymous) @ commons.bundle.js:3
fetcher @ commons.bundle.js:3
Promise.then (async)
fetch @ commons.bundle.js:3
(anonymous) @ commons.bundle.js:3
Promise.then (async)
kfetch @ commons.bundle.js:3
kfetch @ commons.bundle.js:3
_callee$ @ apm.bundle.js:3
tryCatch @ vendors.bundle.dll.js:471
invoke @ vendors.bundle.dll.js:471
prototype. @ vendors.bundle.dll.js:471
asyncGeneratorStep @ apm.bundle.js:3
_next @ apm.bundle.js:3
(anonymous) @ apm.bundle.js:3
(anonymous) @ apm.bundle.js:3
callApi @ apm.bundle.js:3
callApmApi @ apm.bundle.js:3
(anonymous) @ apm.bundle.js:3
_callee$ @ apm.bundle.js:3
tryCatch @ vendors.bundle.dll.js:471
invoke @ vendors.bundle.dll.js:471
prototype. @ vendors.bundle.dll.js:471
asyncGeneratorStep @ apm.bundle.js:3
_next @ apm.bundle.js:3
(anonymous) @ apm.bundle.js:3
(anonymous) @ apm.bundle.js:3
_doFetch @ apm.bundle.js:3
doFetch @ apm.bundle.js:3
(anonymous) @ apm.bundle.js:3
th @ vendors.bundle.dll.js:200
Wh @ vendors.bundle.dll.js:200
of @ vendors.bundle.dll.js:200
ci @ vendors.bundle.dll.js:200
Di @ vendors.bundle.dll.js:200
Yh @ vendors.bundle.dll.js:200
Xh @ vendors.bundle.dll.js:200
qf @ vendors.bundle.dll.js:200
enqueueSetState @ vendors.bundle.dll.js:200
E.setState @ vendors.bundle.dll.js:192
(anonymous) @ vendors.bundle.dll.js:64
e @ vendors.bundle.dll.js:537
(anonymous) @ vendors.bundle.dll.js:537
notifyListeners @ vendors.bundle.dll.js:537
d @ vendors.bundle.dll.js:537
(anonymous) @ vendors.bundle.dll.js:537
confirmTransitionTo @ vendors.bundle.dll.js:537
(anonymous) @ vendors.bundle.dll.js:537
g @ vendors.bundle.dll.js:537
Show 24 more frames

[elasticmachine]

Pinging @elastic/apm-ui

[sorenlouv]

I am logged in as super user - is the error being thrown since there are no APM agents

This is odd. This should only happen if the user does not have read access to the .apm-agent-configuration index. And even if the user does not have access to that index we might probably shouldn't show the toast with Internal Server Error.

@ogupte do you have any idea why this is happen for a super user? Could it be because the index doesn't exist? (there was another related issue)

[ogupte]

This is the expected experience if the user doesn't have read access to .apm-agent-configuration. I feel like a super user should be able to read and write this index. Not sure why they cannot. I created a PR (elastic/elasticsearch#46765) that adds privileges to the kibana user reserved role. This should apply to the default user and prevent this error message.

[sorenlouv]

@ogupte Thanks for creating that PR! Will you also add access checks to the endpoints as per Brandon's comment in elastic/elasticsearch#46423 (comment) ?