[7.x] [Fleet] Allow package to specify cluster privileges (elastic#11…

…4945) (elastic#115416) * [Fleet] Allow package to specify cluster privileges (elastic#114945) * Fix types * Fix types Co-authored-by: Nicolas Chaulet <[email protected]>
kibanamachine · Oct 19, 2021 · 6e11540 · 6e11540
1 parent 361ba92
commit 6e11540
Show file tree

Hide file tree

Showing 9 changed files with 241 additions and 27 deletions.
diff --git a/x-pack/plugins/fleet/common/types/models/epm.ts b/x-pack/plugins/fleet/common/types/models/epm.ts
@@ -125,6 +125,11 @@ interface RegistryAdditionalProperties {
   readme?: string;
   internal?: boolean; // Registry addition[0] and EPM uses it[1] [0]: https://github.com/elastic/package-registry/blob/dd7b021893aa8d66a5a5fde963d8ff2792a9b8fa/util/package.go#L63 [1]
   data_streams?: RegistryDataStream[]; // Registry addition [0] [0]: https://github.com/elastic/package-registry/blob/dd7b021893aa8d66a5a5fde963d8ff2792a9b8fa/util/package.go#L65
+  elasticsearch?: {
+    privileges?: {
+      cluster?: string[];
+    };
+  };
 }
 interface RegistryOverridePropertyValue {
   icons?: RegistryImage[];

diff --git a/x-pack/plugins/fleet/common/types/models/package_policy.ts b/x-pack/plugins/fleet/common/types/models/package_policy.ts
@@ -65,6 +65,11 @@ export interface NewPackagePolicy {
   package?: PackagePolicyPackage;
   inputs: NewPackagePolicyInput[];
   vars?: PackagePolicyConfigRecord;
+  elasticsearch?: {
+    privileges?: {
+      cluster?: string[];
+    };
+  };
 }
 
 export interface UpdatePackagePolicy extends NewPackagePolicy {

diff --git a/x-pack/plugins/fleet/server/mocks/index.ts b/x-pack/plugins/fleet/server/mocks/index.ts
@@ -65,7 +65,7 @@ export const xpackMocks = {
 
 export const createPackagePolicyServiceMock = (): jest.Mocked<PackagePolicyServiceInterface> => {
   return {
-    compilePackagePolicyInputs: jest.fn(),
+    _compilePackagePolicyInputs: jest.fn(),
     buildPackagePolicyFromPackage: jest.fn(),
     bulkCreate: jest.fn(),
     create: jest.fn(),

diff --git a/x-pack/plugins/fleet/server/routes/package_policy/handlers.test.ts b/x-pack/plugins/fleet/server/routes/package_policy/handlers.test.ts
@@ -35,7 +35,7 @@ jest.mock(
   } => {
     return {
       packagePolicyService: {
-        compilePackagePolicyInputs: jest.fn((packageInfo, vars, dataInputs) =>
+        _compilePackagePolicyInputs: jest.fn((registryPkgInfo, packageInfo, vars, dataInputs) =>
           Promise.resolve(dataInputs)
         ),
         buildPackagePolicyFromPackage: jest.fn(),

diff --git a/x-pack/plugins/fleet/server/saved_objects/index.ts b/x-pack/plugins/fleet/server/saved_objects/index.ts
@@ -236,6 +236,16 @@ const getSavedObjectTypes = (
             version: { type: 'keyword' },
           },
         },
+        elasticsearch: {
+          enabled: false,
+          properties: {
+            privileges: {
+              properties: {
+                cluster: { type: 'keyword' },
+              },
+            },
+          },
+        },
         vars: { type: 'flattened' },
         inputs: {
           type: 'nested',

diff --git a/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.test.ts b/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.test.ts
@@ -277,6 +277,103 @@ describe('storedPackagePoliciesToAgentPermissions()', () => {
     });
   });
 
+  it('Returns the cluster privileges if there is one in the package policy', async () => {
+    getPackageInfoMock.mockResolvedValueOnce({
+      name: 'test-package',
+      version: '0.0.0',
+      latestVersion: '0.0.0',
+      release: 'experimental',
+      format_version: '1.0.0',
+      title: 'Test Package',
+      description: '',
+      icons: [],
+      owner: { github: '' },
+      status: 'not_installed',
+      assets: {
+        kibana: {
+          dashboard: [],
+          visualization: [],
+          search: [],
+          index_pattern: [],
+          map: [],
+          lens: [],
+          security_rule: [],
+          ml_module: [],
+          tag: [],
+        },
+        elasticsearch: {
+          component_template: [],
+          ingest_pipeline: [],
+          ilm_policy: [],
+          transform: [],
+          index_template: [],
+          data_stream_ilm_policy: [],
+        },
+      },
+      data_streams: [
+        {
+          type: 'logs',
+          dataset: 'some-logs',
+          title: '',
+          release: '',
+          package: 'test-package',
+          path: '',
+          ingest_pipeline: '',
+          streams: [{ input: 'test-logs', title: 'Test Logs', template_path: '' }],
+        },
+      ],
+    });
+
+    const packagePolicies: PackagePolicy[] = [
+      {
+        id: '12345',
+        name: 'test-policy',
+        namespace: 'test',
+        enabled: true,
+        package: { name: 'test-package', version: '0.0.0', title: 'Test Package' },
+        elasticsearch: {
+          privileges: {
+            cluster: ['monitor'],
+          },
+        },
+        inputs: [
+          {
+            type: 'test-logs',
+            enabled: true,
+            streams: [
+              {
+                id: 'test-logs',
+                enabled: true,
+                data_stream: { type: 'logs', dataset: 'some-logs' },
+                compiled_stream: { data_stream: { dataset: 'compiled' } },
+              },
+            ],
+          },
+        ],
+        created_at: '',
+        updated_at: '',
+        created_by: '',
+        updated_by: '',
+        revision: 1,
+        policy_id: '',
+        output_id: '',
+      },
+    ];
+
+    const permissions = await storedPackagePoliciesToAgentPermissions(soClient, packagePolicies);
+    expect(permissions).toMatchObject({
+      'test-policy': {
+        indices: [
+          {
+            names: ['logs-compiled-test'],
+            privileges: ['auto_configure', 'create_doc'],
+          },
+        ],
+        cluster: ['monitor'],
+      },
+    });
+  });
+
   it('Returns the dataset for osquery_manager package', async () => {
     getPackageInfoMock.mockResolvedValueOnce({
       format_version: '1.0.0',

diff --git a/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.ts b/x-pack/plugins/fleet/server/services/package_policies_to_agent_permissions.ts
@@ -121,12 +121,21 @@ export async function storedPackagePoliciesToAgentPermissions(
             });
       }
 
+      let clusterRoleDescriptor = {};
+      const cluster = packagePolicy?.elasticsearch?.privileges?.cluster ?? [];
+      if (cluster.length > 0) {
+        clusterRoleDescriptor = {
+          cluster,
+        };
+      }
+
       return [
         packagePolicy.name,
         {
           indices: dataStreamsForPermissions.map((ds) =>
             getDataStreamPrivileges(ds, packagePolicy.namespace)
           ),
+          ...clusterRoleDescriptor,
         },
       ];
     }

diff --git a/x-pack/plugins/fleet/server/services/package_policy.test.ts b/x-pack/plugins/fleet/server/services/package_policy.test.ts
@@ -33,6 +33,7 @@ import type {
   InputsOverride,
   NewPackagePolicy,
   NewPackagePolicyInput,
+  RegistryPackage,
 } from '../../common';
 
 import { IngestManagerError } from '../errors';
@@ -43,6 +44,7 @@ import {
   _applyIndexPrivileges,
 } from './package_policy';
 import { appContextService } from './app_context';
+import { fetchInfo } from './epm/registry';
 
 async function mockedGetAssetsData(_a: any, _b: any, dataset: string) {
   if (dataset === 'dataset1') {
@@ -88,6 +90,10 @@ hosts:
   ];
 }
 
+function mockedRegistryInfo(): RegistryPackage {
+  return {} as RegistryPackage;
+}
+
 jest.mock('./epm/packages/assets', () => {
   return {
     getAssetsData: mockedGetAssetsData,
@@ -100,11 +106,7 @@ jest.mock('./epm/packages', () => {
   };
 });
 
-jest.mock('./epm/registry', () => {
-  return {
-    fetchInfo: () => ({}),
-  };
-});
+jest.mock('./epm/registry');
 
 jest.mock('./agent_policy', () => {
   return {
@@ -126,12 +128,18 @@ jest.mock('./agent_policy', () => {
   };
 });
 
+const mockedFetchInfo = fetchInfo as jest.Mock<ReturnType<typeof fetchInfo>>;
+
 type CombinedExternalCallback = PutPackagePolicyUpdateCallback | PostPackagePolicyCreateCallback;
 
 describe('Package policy service', () => {
-  describe('compilePackagePolicyInputs', () => {
+  beforeEach(() => {
+    mockedFetchInfo.mockResolvedValue({} as RegistryPackage);
+  });
+  describe('_compilePackagePolicyInputs', () => {
     it('should work with config variables from the stream', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -194,7 +202,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with a two level dataset name', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -246,7 +255,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with config variables at the input level', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -309,7 +319,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with config variables at the package level', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -377,7 +388,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with an input with a template and no streams', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [],
           policy_templates: [
@@ -419,7 +431,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with an input with a template and streams', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           data_streams: [
             {
@@ -524,7 +537,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with a package without input', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           policy_templates: [
             {
@@ -540,7 +554,8 @@ describe('Package policy service', () => {
     });
 
     it('should work with a package with a empty inputs array', async () => {
-      const inputs = await packagePolicyService.compilePackagePolicyInputs(
+      const inputs = await packagePolicyService._compilePackagePolicyInputs(
+        mockedRegistryInfo(),
         {
           policy_templates: [
             {
@@ -834,6 +849,59 @@ describe('Package policy service', () => {
       expect(modifiedStream.vars!.paths.value).toEqual(expect.arrayContaining(['north', 'south']));
       expect(modifiedStream.vars!.period.value).toEqual('12mo');
     });
+
+    it('should update elasticsearch.priviles.cluster when updating', async () => {
+      const savedObjectsClient = savedObjectsClientMock.create();
+      const mockPackagePolicy = createPackagePolicyMock();
+
+      const attributes = {
+        ...mockPackagePolicy,
+        inputs: [],
+      };
+
+      mockedFetchInfo.mockResolvedValue({
+        elasticsearch: {
+          privileges: {
+            cluster: ['monitor'],
+          },
+        },
+      } as RegistryPackage);
+
+      savedObjectsClient.get.mockResolvedValue({
+        id: 'test',
+        type: 'abcd',
+        references: [],
+        version: 'test',
+        attributes,
+      });
+
+      savedObjectsClient.update.mockImplementation(
+        async (
+          type: string,
+          id: string,
+          attrs: any
+        ): Promise<SavedObjectsUpdateResponse<PackagePolicySOAttributes>> => {
+          savedObjectsClient.get.mockResolvedValue({
+            id: 'test',
+            type: 'abcd',
+            references: [],
+            version: 'test',
+            attributes: attrs,
+          });
+          return attrs;
+        }
+      );
+      const elasticsearchClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+      const result = await packagePolicyService.update(
+        savedObjectsClient,
+        elasticsearchClient,
+        'the-package-policy-id',
+        { ...mockPackagePolicy, inputs: [] }
+      );
+
+      expect(result.elasticsearch).toMatchObject({ privileges: { cluster: ['monitor'] } });
+    });
   });
 
   describe('runDeleteExternalCallbacks', () => {