Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Roles with legacy "Fleet and Integrations" privilege are malformed #130554

Closed
jportner opened this issue Apr 19, 2022 · 6 comments · Fixed by #131902
Closed

Roles with legacy "Fleet and Integrations" privilege are malformed #130554

jportner opened this issue Apr 19, 2022 · 6 comments · Fixed by #131902
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Team:Fleet Team label for Observability Data Collection Fleet team

Comments

@jportner
Copy link
Contributor

jportner commented Apr 19, 2022

Kibana version:

8.1.0+

Describe the bug:

In older versions of Kibana, "Fleet and Integrations" was a single feature (id: fleet):

image

Starting in the 8.1.0 release, this feature was renamed to "Integrations" and a separate feature was added for "Fleet" (id: fleetv2):

image

In this release, both features add a new restriction that requires "All spaces" to be selected, as indicated by the tooltip icons in the second screenshot above.
However, that new restriction was introduced for the existing "Integrations" feature and that is a breaking change.

If an operator created a role prior to 8.1 that breaks this restriction, Kibana doesn't know how to transform the role and subsequently throws an error when viewing the page for that role:

If any users created a role prior to 8.1 that (a) granted access to an explicit list of spaces (not "All spaces") and (b) granted access to the "Fleet and Integrations" (either All or Read), then after upgrading to 8.1 the role page would show an error:

image

Steps to reproduce:

  1. Start with Kibana 8.0
  2. Create a role that gives access to the Default space and gives access to Fleet and Integrations (either All or Read)
  3. Upgrade Kibana to 8.1

Expected behavior:

This restriction should not be applied to the Integrations feature.

Any additional context:

It appears this restriction was accidentally added in #122347 😓

@jportner jportner added bug Fixes for quality problems that affect the customer experience Team:Fleet Team label for Observability Data Collection Fleet team labels Apr 19, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/fleet (Team:Fleet)

@juliaElastic juliaElastic self-assigned this May 9, 2022
@juliaElastic
Copy link
Contributor

juliaElastic commented May 9, 2022

I think the reason Integrations and Fleet were both set to requireAllSpaces is that none of Fleet entities are space aware currently (integration policies, agent policies, integration assets).
I understand that currently this is a problem with upgraded clusters, however if we remove requireAllSpaces, Integrations privilege would be allowed to be added for specific spaces, which might be misleading as the privilege will not be restricted to any space. Do we still want to go ahead with the fix? cc @joshdover

@zez3
Copy link

zez3 commented May 12, 2022

This is exactly what I needed for my users to be able to see that they have correctly installed their Agents and that the agent is online.

@zez3
Copy link

zez3 commented May 18, 2022

@joshdover
Do you perhaps know if there is already an enhancement request or feature for space aware Agents in Fleet?
I have the use case with users(tenants like) that are not admins and should not be admins to manage their own Integrations, Agents + pipelines
#74353 (comment)

@joshdover
Copy link
Contributor

@zez3 this is the closest we have: #99116. I think a dedicated issue would be best to describe your use case. This is a common use case I’ve heard about in customer discussions, would be good to start collecting feedback if you don’t mind opening an issue.

@zez3
Copy link

zez3 commented May 19, 2022

@joshdover hopefully I've described my use case the right way
#132559

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Team:Fleet Team label for Observability Data Collection Fleet team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants