elastic / elastic/package-spec

[Change Proposal] Add `minimum`/`maximum` constraints for `type: integer` variables

Open
#1,176 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
20
Forks
93
Avg merge
15h 10m
Merged PRs (30d)
12

Description

## Problem

Several integrations have `type: integer` manifest variables (e.g. `page_size`, `batch_size`) that control API page sizes and directly affect memory consumption. While `type: integer` prevents non-numeric input, there is no way to enforce that the value falls within a valid range.

For example, the sentinel_one integration has `batch_size` variables with a documented maximum of 1000 (per the SentinelOne API), but nothing stops a user from setting it to 50000. The constraint exists only as free text in the `description` field.

The `type: duration` variable type already has `min_duration`/`max_duration` (added in [#948](https://github.com/elastic/package-spec/pull/948)). The same pattern would be useful for `type: integer`.

## Proposal

Add optional `minimum` and `maximum` properties to `type: integer` variables:

```yaml
- name: batch_size
type: integer
title: Batch Size
description: Batch size for the API response.
default: 1000
minimum: 1
maximum: 1000
```

Validation rules:
- `minimum` and `maximum` are optional. Either can be specified independently.
- When both are present: `minimum` <= `default` <= `maximum`.
- `minimum` and `maximum` can only be used when `type` is `integer`.
- Fleet should reject values outside the range at both the UI and API layer.

## Motivation

This was identified during an audit of page/batch size enforcement across integrations ([elastic/integrations#19248](https://github.com/elastic/integrations/issues/19248)). The findings:

- 46 fields across 22 integrations were declared as `type: text` when the value is always numeric — those are being fixed to `type: integer`.
- Several of those fields have documented API limits (e.g. "maximum supported page size is 1000") that exist only in description text with no enforcement.
- `type: select` with discrete options was considered but breaks existing policies on upgrade due to integer/string type mismatch in stored policy values.
- `type: duration` with `min_duration`/`max_duration` solves the analogous problem for time intervals but requires `format_version: 3.5.0` (stack 9.2+), which many packages can't adopt yet.

Integer min/max constraints would close the enforcement gap for numeric variables without requiring a type change that breaks existing policies.

## Related

- [#44](https://github.com/elastic/package-spec/issues/44) — Define input variable types (meta issue)
- [#948](https://github.com/elastic/package-spec/pull/948) — Add `duration` variable data type with `min_duration`/`max_duration`
- [elastic/integrations#19248](https://github.com/elastic/integrations/issues/19248) — Numeric page_size/batch_size manifest variables incorrectly declared as `type: text`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.