[Profiling] Remove Security checks

x-pack/plugins/apm/server/routes/profiling/route.ts

@@ -157,7 +157,7 @@ const profilingStatusRoute = createApmServerRoute({
     if (profilingDataAccessStart) {
       try {
         const response = await profilingDataAccessStart?.services.getStatus({
-          esClient: esClient.asCurrentUser,
+          esClient,
           soClient: (await context.core).savedObjects.client,
           spaceId: (
             await plugins.spaces?.start()

x-pack/plugins/profiling/e2e/cypress/e2e/empty_state/home.cy.ts

@@ -83,4 +83,32 @@ describe('Home page with empty state', () => {
       cy.contains('Delete existing profiling data');
     });
   });
+
+  it('shows disabled button for users without privileges', () => {
+    cy.intercept('GET', '/internal/profiling/setup/es_resources', {
+      body: {
+        has_setup: false,
+        has_data: false,
+        pre_8_9_1_data: false,
+        has_required_role: false,
+      },
+    }).as('getEsResources');
+    cy.visitKibana('/app/profiling');
+    cy.wait('@getEsResources');
+    cy.contains('Set up Universal Profiling').should('be.disabled');
+  });
+
+  it('shows emabled button for users without privileges', () => {
+    cy.intercept('GET', '/internal/profiling/setup/es_resources', {
+      body: {
+        has_setup: false,
+        has_data: false,
+        pre_8_9_1_data: false,
+        has_required_role: true,
+      },
+    }).as('getEsResources');
+    cy.visitKibana('/app/profiling');
+    cy.wait('@getEsResources');
+    cy.contains('Set up Universal Profiling').should('not.be.disabled');
+  });
 });

x-pack/plugins/profiling/kibana.jsonc

@@ -9,7 +9,8 @@
     "configPath": ["xpack", "profiling"],
     "optionalPlugins": [
       "spaces", 
-      "usageCollection"
+      "usageCollection",
+      "security"
     ],
     "requiredPlugins": [
       "charts",

x-pack/plugins/profiling/public/components/check_setup.tsx

@@ -13,6 +13,7 @@ import {
   EuiLink,
   EuiLoadingSpinner,
   EuiText,
+  EuiToolTip,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
@@ -91,6 +92,7 @@ export function CheckSetup({ children }: { children: React.ReactElement }) {
     !!error;
 
   if (displaySetupScreen) {
+    const isButtonDisabled = postSetupLoading || data?.has_required_role === false;
     return (
       <ProfilingAppPageTemplate
         tabs={[]}
@@ -152,44 +154,54 @@ export function CheckSetup({ children }: { children: React.ReactElement }) {
                 event.preventDefault();
               },
               button: (
-                <EuiButton
-                  data-test-subj="profilingCheckSetupButton"
-                  disabled={postSetupLoading}
-                  onClick={(event) => {
-                    event.preventDefault();
-
-                    setPostSetupLoading(true);
-
-                    postSetupResources({ http })
-                      .then(() => refresh())
-                      .catch((err) => {
-                        const message = err?.body?.message ?? err.message ?? String(err);
-
-                        notifications.toasts.addError(err, {
-                          title: i18n.translate(
-                            'xpack.profiling.checkSetup.setupFailureToastTitle',
-                            {
-                              defaultMessage: 'Failed to complete setup',
-                            }
-                          ),
-                          toastMessage: message,
-                        });
-                      })
-                      .finally(() => {
-                        setPostSetupLoading(false);
-                      });
-                  }}
-                  fill
-                  isLoading={postSetupLoading}
+                <EuiToolTip
+                  content={
+                    data?.has_required_role === false
+                      ? i18n.translate('xpack.profiling.checkSetup.tooltip', {
+                          defaultMessage: 'You must be logged in as a superuser',
+                        })
+                      : ''
+                  }
                 >
-                  {!postSetupLoading
-                    ? i18n.translate('xpack.profiling.noDataConfig.action.buttonLabel', {
-                        defaultMessage: 'Set up Universal Profiling',
-                      })
-                    : i18n.translate('xpack.profiling.noDataConfig.action.buttonLoadingLabel', {
-                        defaultMessage: 'Setting up Universal Profiling...',
-                      })}
-                </EuiButton>
+                  <EuiButton
+                    data-test-subj="profilingCheckSetupButton"
+                    disabled={isButtonDisabled}
+                    onClick={(event) => {
+                      event.preventDefault();
+
+                      setPostSetupLoading(true);
+
+                      postSetupResources({ http })
+                        .then(() => refresh())
+                        .catch((err) => {
+                          const message = err?.body?.message ?? err.message ?? String(err);
+
+                          notifications.toasts.addError(err, {
+                            title: i18n.translate(
+                              'xpack.profiling.checkSetup.setupFailureToastTitle',
+                              {
+                                defaultMessage: 'Failed to complete setup',
+                              }
+                            ),
+                            toastMessage: message,
+                          });
+                        })
+                        .finally(() => {
+                          setPostSetupLoading(false);
+                        });
+                    }}
+                    fill
+                    isLoading={postSetupLoading}
+                  >
+                    {!postSetupLoading
+                      ? i18n.translate('xpack.profiling.noDataConfig.action.buttonLabel', {
+                          defaultMessage: 'Set up Universal Profiling',
+                        })
+                      : i18n.translate('xpack.profiling.noDataConfig.action.buttonLoadingLabel', {
+                          defaultMessage: 'Setting up Universal Profiling...',
+                        })}
+                  </EuiButton>
+                </EuiToolTip>
               ),
             },
           },

x-pack/plugins/profiling/public/services.ts

@@ -26,6 +26,7 @@ export interface ProfilingSetupStatus {
   has_setup: boolean;
   has_data: boolean;
   pre_8_9_1_data: boolean;
+  has_required_role: boolean;
   unauthorized?: boolean;
 }
 

x-pack/plugins/profiling/server/lib/setup/get_has_setup_privileges.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { KibanaRequest } from '@kbn/core/server';
+import { INTEGRATIONS_PLUGIN_ID, PLUGIN_ID as FLEET_PLUGIN_ID } from '@kbn/fleet-plugin/common';
+import { ProfilingPluginStartDeps } from '../../types';
+
+export async function getHasSetupPrivileges({
+  securityPluginStart,
+  request,
+}: {
+  securityPluginStart: NonNullable<ProfilingPluginStartDeps['security']>;
+  request: KibanaRequest;
+}) {
+  // If we have a license which doesn't enable security, or we're a legacy user we shouldn't disable any ui capabilities
+  if (!securityPluginStart.authz.mode.useRbacForRequest(request)) {
+    return true;
+  }
+
+  const { hasAllRequested } = await securityPluginStart.authz
+    .checkPrivilegesWithRequest(request)
+    .globally({
+      elasticsearch: {
+        cluster: ['manage', 'monitor'],
+        index: {
+          'profiling-*': ['read'],
+        },
+      },
+      kibana: [
+        securityPluginStart.authz.actions.api.get(`${FLEET_PLUGIN_ID}-all`),
+        securityPluginStart.authz.actions.api.get(`${INTEGRATIONS_PLUGIN_ID}-all`),
+      ],
+    });
+  return hasAllRequested;
+}

x-pack/plugins/profiling/server/routes/setup.ts

@@ -14,8 +14,8 @@ import {
   createSymbolizerPackagePolicy,
   removeProfilingFromApmPackagePolicy,
 } from '../lib/setup/fleet_policies';
+import { getHasSetupPrivileges } from '../lib/setup/get_has_setup_privileges';
 import { getSetupInstructions } from '../lib/setup/get_setup_instructions';
-import { setSecurityRole } from '../lib/setup/security_role';
 import { handleRouteHandlerError } from '../utils/handle_route_error_handler';
 import { getClient } from './compat';
 
@@ -35,7 +35,14 @@ export function registerSetupRoute({
     },
     async (context, request, response) => {
       try {
-        const esClient = await getClient(context);
+        const hasRequiredRole = dependencies.start.security
+          ? await getHasSetupPrivileges({
+              securityPluginStart: dependencies.start.security,
+              request,
+            })
+          : true;
+
+        const esClient = (await context.core).elasticsearch.client;
         const core = await context.core;
 
         const profilingStatus = await dependencies.start.profilingDataAccess.services.getStatus({
@@ -44,7 +51,7 @@ export function registerSetupRoute({
           spaceId: dependencies.setup.spaces?.spacesService?.getSpaceId(request),
         });
 
-        return response.ok({ body: profilingStatus });
+        return response.ok({ body: { ...profilingStatus, has_required_role: hasRequiredRole } });
       } catch (error) {
         return handleRouteHandlerError({
           error,
@@ -107,7 +114,6 @@ export function registerSetupRoute({
 
         const executeAdminFunctions = [
           ...(setupState.resource_management.enabled ? [] : [enableResourceManagement]),
-          ...(setupState.permissions.configured ? [] : [setSecurityRole]),
           ...(setupState.settings.configured ? [] : [setMaximumBuckets]),
         ];
 

x-pack/plugins/profiling/server/types.ts

@@ -16,6 +16,7 @@ import {
   ProfilingDataAccessPluginSetup,
   ProfilingDataAccessPluginStart,
 } from '@kbn/profiling-data-access-plugin/server';
+import { SecurityPluginSetup, SecurityPluginStart } from '@kbn/security-plugin/server';
 
 export interface ProfilingPluginSetupDeps {
   observability: ObservabilityPluginSetup;
@@ -25,6 +26,7 @@ export interface ProfilingPluginSetupDeps {
   spaces?: SpacesPluginSetup;
   usageCollection?: UsageCollectionSetup;
   profilingDataAccess: ProfilingDataAccessPluginSetup;
+  security?: SecurityPluginSetup;
 }
 
 export interface ProfilingPluginStartDeps {
@@ -34,6 +36,7 @@ export interface ProfilingPluginStartDeps {
   fleet: FleetStartContract;
   spaces?: SpacesPluginStart;
   profilingDataAccess: ProfilingDataAccessPluginStart;
+  security?: SecurityPluginStart;
 }
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface

x-pack/plugins/profiling/tsconfig.json

@@ -50,7 +50,8 @@
     "@kbn/profiling-data-access-plugin",
     "@kbn/embeddable-plugin",
     "@kbn/profiling-utils",
-    "@kbn/advanced-settings-plugin"
+    "@kbn/advanced-settings-plugin",
+    "@kbn/security-plugin"
     // add references to other TypeScript projects the plugin depends on
 
     // requiredPlugins from ./kibana.json

x-pack/plugins/profiling_data_access/common/index.ts

@@ -7,7 +7,6 @@
 
 export { getApmPolicy, ELASTIC_CLOUD_APM_POLICY } from './get_apm_policy';
 export { MAX_BUCKETS } from './cluster_settings';
-export { METADATA_VERSION, PROFILING_READER_ROLE_NAME } from './security_role';
 export {
   getCollectorPolicy,
   getSymbolizerPolicy,