elastic / elastic/fleet-server
Add mappings on `.fleet-policies` index to filter on `data.outputs` to invalidate remote API keys
- Dominant language
- Go
- Stars
- 113
- Forks
- 117
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 112
Description
Related to https://github.com/elastic/kibana/issues/104986
Follow up after https://github.com/elastic/fleet-server/pull/3051#discussion_r1402240068
Currently `data.outputs` in [.fleet-policies](https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/template-resources/src/main/resources/fleet-policies.json) is not mapped, so we can't use ES query to find a remote output config after it is removed from an agent/agent policy. We need the config to invalidate remote API keys that are not used anymore.
Currently the logic looks up the most recent policy revisions and loops though them to find the remote output. This is not efficient and might not return the output config.
To solve this:
- [ ] Add ES mapping for `data.outputs`, to be able to search on a remote output ID
- We should check if changing the mapping doesn't break existing clusters when migrating to a new version. Alternatively a new field name could be used for the new mapping.
```
"data": {
"enabled": false,
"type": "object"
},
```
- [ ] Change the [implementation](https://github.com/elastic/fleet-server/blob/760ea2f85671a7e9963fbee1659d0ce7ebca4d28/internal/pkg/dl/policies.go#L91) in fleet-server to query on output in ES.
Contributor guide
Assessment
This issue has not been assessed yet.