[RAC] Update RBAC mapping of features to index names to comply with the index naming scheme #108872

banderror · 2021-08-17T11:38:19Z

Addresses: #102089

🚨 This PR is critical for Observability 7.15 🚨

Summary

This PR changes the mapConsumerToIndexName used by RAC RBAC and tests containing references to those indices.

observability-apm renamed to observability.apm
.alerts suffix was added, e.g. .alerts-observability.apm.alerts and .alerts-observability.metrics.alerts
observability: '.alerts-observability' is not changed, does it make sense to make it observability: '.alerts-observability.*.alerts'?

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2021-08-17T11:38:22Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2021-08-17T11:40:01Z

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

banderror · 2021-08-17T11:41:40Z

packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts

-  infrastructure: '.alerts-observability.metrics',
+  apm: '.alerts-observability.apm.alerts',
+  logs: '.alerts-observability.logs.alerts',
+  infrastructure: '.alerts-observability.metrics.alerts',
  observability: '.alerts-observability',


Does it make sense to change it to .alerts-observability.*.alerts?

This object should be updated to append the space id in the index name as well as reading from the kibana config for observability's usage of custom prefixes. Not sure if these are still happening @peluja1012 ?

@banderror It would be ideal to implement this data structure as a saved object, this way we provide the customer with some way to mutate the index names without having to push out a new release of kibana.

The custom index prefix setting has been removed.

Do we need this data-structure at all at this point? Can't we use the registration context as a further (non-security-relevant) filter? (not for this PR, but in future iterations)

As long as we don't index evaluation docs the result would be the same, but the change also couldn't hurt while we're at it.

dhurley14

Pretty straightforward change.. Looks good. If you have the time I think it is worth it to consider moving this into a saved object. Better to store data in Elasticsearch than in kibana..

dhurley14 · 2021-08-17T13:36:36Z

packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts

-  infrastructure: '.alerts-observability.metrics',
+  apm: '.alerts-observability.apm.alerts',
+  logs: '.alerts-observability.logs.alerts',
+  infrastructure: '.alerts-observability.metrics.alerts',
  observability: '.alerts-observability',


This object should be updated to append the space id in the index name as well as reading from the kibana config for observability's usage of custom prefixes. Not sure if these are still happening @peluja1012 ?

@banderror It would be ideal to implement this data structure as a saved object, this way we provide the customer with some way to mutate the index names without having to push out a new release of kibana.

weltenwort

Agreed, looks simple enough. Thank you!

Ideally we wouldn't need that mapping at all in the future. 🤔

weltenwort · 2021-08-18T10:01:09Z

packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts

-  infrastructure: '.alerts-observability.metrics',
+  apm: '.alerts-observability.apm.alerts',
+  logs: '.alerts-observability.logs.alerts',
+  infrastructure: '.alerts-observability.metrics.alerts',
  observability: '.alerts-observability',


The custom index prefix setting has been removed.

Do we need this data-structure at all at this point? Can't we use the registration context as a further (non-security-relevant) filter? (not for this PR, but in future iterations)

smith

LGTM. Looks like Jest snapshots need to be updated.

weltenwort

Don't we either have to specify the namespace suffix in the mapConsumerToIndexName mapping or dynamically add it in the code paths that access the alerts? I think that's not happening right now and causes the alerts table query to target the wrong indices.

@yctercero are there any pending PRs that add the namespace suffix during data access?

weltenwort

Thanks for adding the -* on short notice. It doesn't fix everything (such as the alerts table field selector) but it unblock some other development work. 🙇

kibanamachine · 2021-08-20T15:11:14Z

⏳ Build in-progress, with failures

continuous-integration/kibana-ci/pull-request
Commit: f2b0a22
Storybooks Preview
This comment will update when the build is complete

Failed CI Steps

Execute xpack-kibana-ciGroup5

History

💔 Build #147003 failed f52637847ffdef77534c1a0067bf6ad2fdf320f9
💔 Build #146862 failed 070a7d67b80c4455b84b1fc99848a56b1650a5af
💔 Build #146806 failed b7b0a0d11d552cbcc7247d732bf1e866800350c3
💔 Build #146109 failed bb23f87dac490472c43799341fc4ddde25f63dc9

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @banderror

banderror · 2021-08-21T01:45:20Z

This PR is going to be replaced by #109567 and closed.

dominiqueclarke

Uptime changes LGTM

banderror · 2021-08-24T21:20:29Z

I'm closing this one, the same goal (updating index names that RAC RBAC uses - in order to comply with the index naming scheme) is addressed in #109567 in a better way.

…atures to index names (#109567) **Ticket:** #102089 🚨 **This PR is critical for Observability 7.15** 🚨 ## Summary This PR introduces changes that fix the usage of alerts-as-data index naming in RBAC. It builds on top of #109346 and replaces #108872. TODO: - [x] Address #109346 (review) - [x] Make changes to `AlertsClient.getAuthorizedAlertsIndices()` so it starts using `RuleDataService` to get index names by feature ids. - [x] Delete the hardcoded `mapConsumerToIndexName` where we had incorrect index names. - [x] Close #108872 ### Checklist Delete any items that are not applicable to this PR. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…atures to index names (elastic#109567) **Ticket:** elastic#102089 🚨 **This PR is critical for Observability 7.15** 🚨 ## Summary This PR introduces changes that fix the usage of alerts-as-data index naming in RBAC. It builds on top of elastic#109346 and replaces elastic#108872. TODO: - [x] Address elastic#109346 (review) - [x] Make changes to `AlertsClient.getAuthorizedAlertsIndices()` so it starts using `RuleDataService` to get index names by feature ids. - [x] Delete the hardcoded `mapConsumerToIndexName` where we had incorrect index names. - [x] Close elastic#108872 ### Checklist Delete any items that are not applicable to this PR. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…atures to index names (#109567) (#110068) **Ticket:** #102089 🚨 **This PR is critical for Observability 7.15** 🚨 ## Summary This PR introduces changes that fix the usage of alerts-as-data index naming in RBAC. It builds on top of #109346 and replaces #108872. TODO: - [x] Address #109346 (review) - [x] Make changes to `AlertsClient.getAuthorizedAlertsIndices()` so it starts using `RuleDataService` to get index names by feature ids. - [x] Delete the hardcoded `mapConsumerToIndexName` where we had incorrect index names. - [x] Close #108872 ### Checklist Delete any items that are not applicable to this PR. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Co-authored-by: Georgii Gorbachev <[email protected]>

…atures to index names (#109567) (#110067) **Ticket:** #102089 🚨 **This PR is critical for Observability 7.15** 🚨 ## Summary This PR introduces changes that fix the usage of alerts-as-data index naming in RBAC. It builds on top of #109346 and replaces #108872. TODO: - [x] Address #109346 (review) - [x] Make changes to `AlertsClient.getAuthorizedAlertsIndices()` so it starts using `RuleDataService` to get index names by feature ids. - [x] Delete the hardcoded `mapConsumerToIndexName` where we had incorrect index names. - [x] Close #108872 ### Checklist Delete any items that are not applicable to this PR. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Co-authored-by: Georgii Gorbachev <[email protected]>

banderror self-assigned this Aug 17, 2021

banderror requested a review from a team as a code owner August 17, 2021 11:38

banderror requested review from a team August 17, 2021 11:38

banderror added the Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services label Aug 17, 2021

banderror requested review from weltenwort, yctercero and dhurley14 August 17, 2021 11:40

banderror commented Aug 17, 2021

View reviewed changes

banderror mentioned this pull request Aug 17, 2021

[RAC] Make sure index names comply with design architecture #102089

Closed

dhurley14 reviewed Aug 17, 2021

View reviewed changes

weltenwort approved these changes Aug 18, 2021

View reviewed changes

weltenwort requested review from a team and dominiqueclarke August 18, 2021 15:41

mistic added v7.16.0 and removed v7.15.0 labels Aug 18, 2021

smith approved these changes Aug 18, 2021

View reviewed changes

banderror force-pushed the rule-registry-index-names-compliance-with-design branch 2 times, most recently from b7b0a0d to 070a7d6 Compare August 19, 2021 10:22

weltenwort requested changes Aug 19, 2021

View reviewed changes

banderror force-pushed the rule-registry-index-names-compliance-with-design branch from 070a7d6 to f526378 Compare August 19, 2021 17:21

weltenwort approved these changes Aug 19, 2021

View reviewed changes

banderror added 5 commits August 20, 2021 13:40

observability.apm

ab0cba3

observability.apm.alerts

8f6dc4e

observability.*.alerts

6e103be

Update Jest snapshots

50cc981

Add -*

f2b0a22

banderror force-pushed the rule-registry-index-names-compliance-with-design branch from f526378 to f2b0a22 Compare August 20, 2021 11:40

banderror mentioned this pull request Aug 21, 2021

[RAC] Fix index names used by RBAC, delete hardcoded map of Kibana features to index names #109567

Merged

5 tasks

dominiqueclarke approved these changes Aug 24, 2021

View reviewed changes

banderror closed this Aug 24, 2021

banderror deleted the rule-registry-index-names-compliance-with-design branch August 24, 2021 21:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RAC] Update RBAC mapping of features to index names to comply with the index naming scheme #108872

[RAC] Update RBAC mapping of features to index names to comply with the index naming scheme #108872

banderror commented Aug 17, 2021 •

edited

Loading

elasticmachine commented Aug 17, 2021

elasticmachine commented Aug 17, 2021

banderror Aug 17, 2021

dhurley14 Aug 17, 2021

weltenwort Aug 18, 2021

weltenwort Aug 18, 2021

dhurley14 left a comment •

edited

Loading

dhurley14 Aug 17, 2021

weltenwort left a comment

weltenwort Aug 18, 2021

smith left a comment

weltenwort left a comment

weltenwort left a comment

kibanamachine commented Aug 20, 2021

banderror commented Aug 21, 2021

dominiqueclarke left a comment

banderror commented Aug 24, 2021

[RAC] Update RBAC mapping of features to index names to comply with the index naming scheme #108872

[RAC] Update RBAC mapping of features to index names to comply with the index naming scheme #108872

Conversation

banderror commented Aug 17, 2021 • edited Loading

Summary

Checklist

elasticmachine commented Aug 17, 2021

elasticmachine commented Aug 17, 2021

banderror Aug 17, 2021

Choose a reason for hiding this comment

dhurley14 Aug 17, 2021

Choose a reason for hiding this comment

weltenwort Aug 18, 2021

Choose a reason for hiding this comment

weltenwort Aug 18, 2021

Choose a reason for hiding this comment

dhurley14 left a comment • edited Loading

Choose a reason for hiding this comment

dhurley14 Aug 17, 2021

Choose a reason for hiding this comment

weltenwort left a comment

Choose a reason for hiding this comment

weltenwort Aug 18, 2021

Choose a reason for hiding this comment

smith left a comment

Choose a reason for hiding this comment

weltenwort left a comment

Choose a reason for hiding this comment

weltenwort left a comment

Choose a reason for hiding this comment

kibanamachine commented Aug 20, 2021

⏳ Build in-progress, with failures

Failed CI Steps

History

banderror commented Aug 21, 2021

dominiqueclarke left a comment

Choose a reason for hiding this comment

banderror commented Aug 24, 2021

banderror commented Aug 17, 2021 •

edited

Loading

dhurley14 left a comment •

edited

Loading