[Fleet] Specify which variables should be configurable for an integration per policy

[ruflin]

With #94509 an API endpoint in Kibana was introduced to preconfigure packages and setup the stack. In the scenario that the stack is setup from an external call, it is likely that some of the variables preconfigured should not be modified. An example of this is the policy with Fleet Server in Elastic Cloud. Users should not be able to modify the host and port as it is constant and otherwise would break the setup. Same for the APM integration. At the same time, there might be second policy with APM inside where all these variables are available.

To make this possible, the preconfigure API should be extended to all to specify as part of the policy creation, which fields should be editable and which ones not.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[Zacqary]

Is there any precedent in the UI for some fields on a policy being editable and some being disabled? Wondering if there's an existing system I can hook this into, or if I'll have to build that from scratch.

[ruflin]

@jfsiii Recently worked on some parts with the managed policy which might contain something similar? @jen-huang Are you aware of anything here?

[jen-huang]

Restrictions on a managed policy is not field-specific, rather the entire policy cannot be changed which is simple from a technical standpoint. This will be more complex and we don't have an existing system to do this yet, off the top of my head I wonder if we can add a new field to the vars we save on package policies called writable: true and read that in the UI.

In my head, by default all vars in a pre-configured policy are not writable, so this flag acts as an allowlist.

[jen-huang]

@ruflin @ph I've heard that in some use cases an allowlist of fields makes more sense but in other cases a blocklist is better. Which one should we go with for implementation?

[ruflin]

I would go with writable: true by default. In general a user should be able to use all configurations by default. Only very few fields should be restricted.

[Zacqary]

In the PR I've opened I've implemented a blocklist using a field of frozen: true. I can change the name of this field to writable instead if we prefer that.

[ph]

@Zacqary @ruflin I am OK with that strategy and I do not see the need to change it.

[jen-huang]

Thanks, blocklist it is then. @Zacqary Personally I prefer writable: false but no strong opinion. Edit: checking truthy value > falsy, so nvm :)