[Fleet] Add base Fleet authz logic and API #119199

joshdover · 2021-11-19T16:15:31Z

Summary

First phase of #108252

Adds two new APIs for other plugins to read Fleet privileges:

// On client
fleetStart.authz;

// On server
fleetStart.authz.fromRequest(req)

// ... or with request context
router.get({ ... }, async (context, req, res) => {
  context.fleet.authz;
})

joshdover · 2021-11-19T16:16:08Z

x-pack/plugins/fleet/common/authz.ts

+  };
+}
+
+export const calculateAuthz = ({ fleet, integrations }: CalculateParams): FleetAuthz => ({


This function allows us to have common logic shared across client and server for enforcing access to specific features.

joshdover · 2021-11-19T16:17:07Z

x-pack/plugins/fleet/public/plugin.ts

        const startServices: FleetStartServices = {
          ...coreStartServices,
          ...startDepsServices,
          storage: this.storage,
          cloud: deps.cloud,
+          authz: fleetStart.authz,


This value is available via the useKibana hook inside our React apps

criamico · 2021-11-22T11:12:48Z

@elasticmachine merge upstream

nchaulet · 2021-11-22T18:46:50Z

@elasticmachine merge upstream

nchaulet · 2021-11-22T18:48:30Z

x-pack/plugins/fleet/public/plugin.ts

+        // Once we have a split privilege, this should be using fleetv2
+        // all: capabilities.fleetv2.all as boolean,
+        all: capabilities.fleet.all as boolean,
+        setup: false, // browser users will never have setup privileges


I am kind of confused by this as we currently call the setup from Fleet UI, should we set it to true and change that when we remove that call?

nchaulet

One small comment otherwise 🚀

kibana-ci · 2021-11-22T20:22:59Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`fleet`	536	537	+1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`fleet`	1130	1136	+6

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	105.3KB	106.0KB	+681.0B

Unknown metric groups

API count

id	before	after	diff
`fleet`	1232	1239	+7

History

💔 Build #8431 failed ed486ec
💔 Build #8365 failed ed486ec
💔 Build #8323 failed 08f8713
💔 Build #8060 failed 3f6939b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @criamico

paul-tavares

Only reviewed the change to the Endpoint mock. Looks good to me 👍

paul-tavares · 2021-11-24T16:05:47Z

x-pack/plugins/security_solution/server/endpoint/mocks.ts

@@ -153,6 +154,9 @@ export const createMockPackageService = (): jest.Mocked<PackageService> => {
 */
 export const createMockFleetStartContract = (indexPattern: string): FleetStartContract => {
  return {
+    authz: {


Thank you for the update here. At some point, we'll refactor this to actually use the Mocks out of Fleet instead of having our own.

kibanamachine · 2021-11-24T16:21:12Z

💔 Backport failed

Status	Branch	Result
❌	8.0	Commit could not be cherrypicked due to conflicts

To backport manually run:
node scripts/backport --pr 119199

juliaElastic · 2021-11-25T12:17:12Z

@criamico backport failed here

kibanamachine · 2021-11-26T16:25:00Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 119199 or prevent reminders by adding the backport:skip label.

* Add base Fleet authz logic and API * Fix linter error * Fix ts checks * Fix ts checks again Co-authored-by: criamico <[email protected]> Co-authored-by: Kibana Machine <[email protected]> # Conflicts: # x-pack/plugins/fleet/storybook/context/index.tsx

* Add base Fleet authz logic and API * Fix linter error * Fix ts checks * Fix ts checks again Co-authored-by: criamico <[email protected]> Co-authored-by: Kibana Machine <[email protected]> # Conflicts: # x-pack/plugins/fleet/storybook/context/index.tsx Co-authored-by: Josh Dover <[email protected]>

kibanamachine · 2021-11-29T16:34:59Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.

* [Fleet] Add base Fleet authz logic and API (#119199) * Add base Fleet authz logic and API * Fix linter error * Fix ts checks * Fix ts checks again Co-authored-by: criamico <[email protected]> Co-authored-by: Kibana Machine <[email protected]> # Conflicts: # x-pack/plugins/fleet/storybook/context/index.tsx * Fix missing import Co-authored-by: Josh Dover <[email protected]>

* Add base Fleet authz logic and API * Fix linter error * Fix ts checks * Fix ts checks again Co-authored-by: criamico <[email protected]> Co-authored-by: Kibana Machine <[email protected]>

Add base Fleet authz logic and API

3f6939b

joshdover added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team auto-backport Deprecated - use backport:version if exact versions are needed v8.1.0 labels Nov 19, 2021

joshdover requested review from criamico and paul-tavares November 19, 2021 16:15

joshdover requested a review from a team as a code owner November 19, 2021 16:15

joshdover commented Nov 19, 2021

View reviewed changes

joshdover mentioned this pull request Nov 19, 2021

[Fleet] Remove superuser requirement to access Fleet #108252

Closed

29 tasks

joshdover assigned criamico Nov 19, 2021

Fix linter error

a5bbfbd

kibanamachine and others added 2 commits November 22, 2021 06:12

Merge branch 'main' into rm-superuser/authz

08f8713

Fix ts checks

ed486ec

criamico removed their request for review November 22, 2021 14:53

Fix ts checks again

f638899

joshdover requested a review from a team as a code owner November 22, 2021 16:08

Merge branch 'main' into rm-superuser/authz

0202106

nchaulet reviewed Nov 22, 2021

View reviewed changes

nchaulet approved these changes Nov 22, 2021

View reviewed changes

paul-tavares approved these changes Nov 24, 2021

View reviewed changes

criamico merged commit 191aaa7 into elastic:main Nov 24, 2021

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Nov 26, 2021

mistic mentioned this pull request Nov 29, 2021

[8.0] [Fleet] Add base Fleet authz logic and API (#119199) #119835

Merged

criamico mentioned this pull request Nov 29, 2021

[8.0] [Fleet] Add base Fleet authz logic and API (#119199) #119848

Merged

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Nov 29, 2021

joshdover mentioned this pull request Dec 1, 2021

[Meta] Use kibana_system to write to .fleet-* indices #120090

Closed

16 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Fleet] Add base Fleet authz logic and API #119199

[Fleet] Add base Fleet authz logic and API #119199

joshdover commented Nov 19, 2021

joshdover Nov 19, 2021

joshdover Nov 19, 2021

criamico commented Nov 22, 2021

nchaulet commented Nov 22, 2021

nchaulet Nov 22, 2021

nchaulet left a comment

kibana-ci commented Nov 22, 2021

API count

paul-tavares left a comment

paul-tavares Nov 24, 2021

kibanamachine commented Nov 24, 2021

juliaElastic commented Nov 25, 2021

kibanamachine commented Nov 26, 2021

kibanamachine commented Nov 29, 2021

[Fleet] Add base Fleet authz logic and API #119199

[Fleet] Add base Fleet authz logic and API #119199

Conversation

joshdover commented Nov 19, 2021

Summary

joshdover Nov 19, 2021

Choose a reason for hiding this comment

joshdover Nov 19, 2021

Choose a reason for hiding this comment

criamico commented Nov 22, 2021

nchaulet commented Nov 22, 2021

nchaulet Nov 22, 2021

Choose a reason for hiding this comment

nchaulet left a comment

Choose a reason for hiding this comment

kibana-ci commented Nov 22, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Page load bundle

API count

History

paul-tavares left a comment

Choose a reason for hiding this comment

paul-tavares Nov 24, 2021

Choose a reason for hiding this comment

kibanamachine commented Nov 24, 2021

💔 Backport failed

juliaElastic commented Nov 25, 2021

kibanamachine commented Nov 26, 2021

kibanamachine commented Nov 29, 2021