Fleet integration policy becomes uneditable when stale policy_id references a deleted agent policy despite valid policy_ids
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
## Summary
A Fleet integration policy can become uneditable if its saved object retains a stale `policy_id` pointing to a deleted agent policy, even when the `policy_ids` array contains only valid active agent policy IDs. Attempts to save changes then fail with a 404 saved object error.
## Version
Observed in `8.19.3` and `9.3.4`
## Description
Attempts to update a Fleet integration policy failed with the following error:
```text
Saved object [ingest-agent-policies/00000000-11111111-2222-333333-444444444444] not found
```
Inspection of the package policy object showed:
- a valid `policy_ids` array containing active agent policy IDs
- a stale `policy_id` field still set to a deleted agent policy ID
A direct GET for that agent policy ID returned 404. The stale `policy_id` blocked saving updates to the integration policy.
## Steps to Reproduce
1. Create two agent policies, for example:
- `Test 1`
- `Test 2`
2. Create an integration policy assigned to `Test 1`.
3. Change the integration policy so it runs only on `Test 2`.
4. Delete `Test 1`.
5. Attempt to edit the integration policy.
## Actual Behavior
Editing the integration policy fails with a 404 error because the saved object still references the deleted agent policy in `policy_id`.
## Expected Behavior
When an integration policy is reassigned, all saved object references should be updated consistently. Deleting the original agent policy should not leave the integration policy in an uneditable state.
## Observed / Suspected Cause
The package policy saved object appears to maintain both:
- `policy_id` — single agent policy reference
- `policy_ids` — array of agent policy references
When an integration policy is reassigned from one agent policy to another, the `policy_ids` field updates correctly, but `policy_id` may remain unchanged. If the original agent policy is later deleted, the stale `policy_id` points to a missing saved object and causes update attempts to fail.
## Impact
- Integration policies can become stuck/uneditable in Fleet UI
- Users may be blocked from making routine policy changes
- Manual API intervention may be required to recover
## Workaround
A tested workaround is:
1. Recreate a temporary agent policy using the missing ID:
- `POST /api/fleet/agent_policies`
2. Retrieve the affected package policy ID:
- `GET /api/fleet/package_policies`
3. Update the package policy so `policy_id` is set to a valid agent policy ID already present in `policy_ids`:
- `PUT /api/fleet/package_policies/{id}`
4. Delete the temporary recreated agent policy:
- `POST /api/fleet/agent_policies/delete`
After these steps, the integration policy becomes editable again in the Fleet UI.
## Additional Notes
This appears reproducible with at least the workflow above and may affect any integration moved between agent policies where the original policy is later deleted.
Contributor guide
Assessment
This issue has not been assessed yet.