Add alerting route to update API key #45925
Conversation
mikecote
added
review
Feature:Alerting
v8.0.0
release_note:skip
|
Pinging @elastic/kibana-stack-services |
💚 Build Succeeded |
|
|
||
| const apiKey = await this.createAPIKey(); | ||
| const username = await this.getUserName(); | ||
| await this.savedObjectsClient.update( |
There was a problem hiding this comment.
So wondering here if we also want to invalidate the API key that was there previously. Seems like we're just going to leave behind a trail of unused but still valid API keys.
There was a problem hiding this comment.
YES, we should definitely do that. Although, is there some chance an old one could be available - like cached on a different Kibana instance? Seems possible. Which would imply so check to see when using an api key if we get back a "key not found" response, and use that as a cache invaldation signal (re-read the key).
There was a problem hiding this comment.
There's a card for api key cleanup (https://github.com/elastic/kibana/projects/26#card-25354998). The problem that arises is we don't know if any scheduled actions rely on the old api key. To solve this we would need to change a few things and we were planning to do so under that card.
There was a problem hiding this comment.
This seems like it's good to go, once the questions about updating a disabled alert and deleting old keys are resolved. Adding key deletion perhaps would need another review, but a new issue to resolve it works for me. If we get rid of the constraint of not being able to update a disabled alert, I think that's just deleting some of this code.
|
@elasticmachine merge upstream |
…ibana into alerting/update-api-key-route
💔 Build Failed |
💔 Build Failed |
💔 Build Failed |
💚 Build Succeeded |
💔 Build Failed |
💚 Build Succeeded |
* Add route to update alert api key * Allow updating an API key when the alert is disabled * Fix typecheck failures * Fix broken file references
Fixes #45926.
In this PR, I'm adding an API to update an alert's API key. This API will generate a new API key in Elasticsearch that is tied to the user in context and assign it to the alert. This will make the alert use the privileges from that user afterwards.