elastic / elastic/fleet-server

Add mappings on `.fleet-policies` index to filter on `data.outputs` to invalidate remote API keys

Open
#3,121 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
113
Forks
117
Avg merge
1d 16h
Merged PRs (30d)
112

Description

Related to https://github.com/elastic/kibana/issues/104986
Follow up after https://github.com/elastic/fleet-server/pull/3051#discussion_r1402240068

Currently `data.outputs` in [.fleet-policies](https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/template-resources/src/main/resources/fleet-policies.json) is not mapped, so we can't use ES query to find a remote output config after it is removed from an agent/agent policy. We need the config to invalidate remote API keys that are not used anymore.

Currently the logic looks up the most recent policy revisions and loops though them to find the remote output. This is not efficient and might not return the output config.

To solve this:
- [ ] Add ES mapping for `data.outputs`, to be able to search on a remote output ID
- We should check if changing the mapping doesn't break existing clusters when migrating to a new version. Alternatively a new field name could be used for the new mapping.
```
"data": {
"enabled": false,
"type": "object"
},
```
- [ ] Change the [implementation](https://github.com/elastic/fleet-server/blob/760ea2f85671a7e9963fbee1659d0ce7ebca4d28/internal/pkg/dl/policies.go#L91) in fleet-server to query on output in ES.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.