Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Kibana application privileges for monitoring and ml reserved roles #40651

Merged
merged 8 commits into from
Apr 5, 2019

Conversation

kobelb
Copy link
Contributor

@kobelb kobelb commented Mar 29, 2019

To enable Feature Controls we'd like the ability to only show the Machine Learning and Monitoring applications when the user has the assigned reserved role. To do so, we're augmenting these reserved roles with the privileges which are necessary to make this determination. These roles grant access to kibana-*, so that in a multi-tenant deployment of Kibana, users will get access to these applications in the same way that they do today.

@polyfractal polyfractal added the :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC label Apr 2, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security

@kobelb kobelb marked this pull request as ready for review April 3, 2019 00:04
@kobelb kobelb requested a review from tvernum April 3, 2019 00:04
@bizybot bizybot self-requested a review April 4, 2019 22:44
Copy link
Contributor

@bizybot bizybot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other than a small suggestion, LGTM, Thank you.

@kobelb
Copy link
Contributor Author

kobelb commented Apr 5, 2019

Other than a small suggestion, LGTM, Thank you.

Sure, you got it! Thanks @bizybot

@kobelb kobelb merged commit 513950c into elastic:master Apr 5, 2019
@kobelb kobelb deleted the fc/reserved-role-apps-3 branch April 5, 2019 14:43
kobelb added a commit that referenced this pull request Apr 5, 2019
#40651)

* Add Kibana application privileges for monitoring and ml reserved roles

* Adding test for kibana-.kibana application explicitly

* Whoa there, fat fingered kibana and application...

* And I copied something from monitoring I shouldn't have...

* And actually doing what Yogesh recommended...
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Apr 6, 2019
* master: (63 commits)
  Suppress lease background sync failures if stopping (elastic#40902)
  [DOCS] Added settings page for ILM. (elastic#40880)
  [Docs] Remove extraneous text (elastic#40914)
  Move test classes to test root in Painless (elastic#40873)
  Fix date index name processor default date_formats (elastic#40915)
  Source additional files correctly in elasticsearch-cli (elastic#40890)
  Allow AVX-512 on JDK 11+ (elastic#40828)
  [Docs] Change example to show col headers (elastic#40822)
  Update apache httpclient to version 4.5.8 (elastic#40875)
  Update monitoring-kibana.json (elastic#40899)
  Introduce Delegating ActionListener Wrappers (elastic#40129)
  Deprecate old transport settings (elastic#40821)
  Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651)
  Use Writeable for TransportReplAction derivatives (elastic#40894)
  Add test for HTTP and Transport TLS on basic license (elastic#40714)
  Remove unneded cluster config from test (elastic#40856)
  Make Fuzziness reject illegal values earlier (elastic#33511)
  Remove test-only customisation from TransReplAct (elastic#40863)
  Fix dense/sparse vector limit documentation (elastic#40852)
  Make -try xlint warning disabled by default. (elastic#40833)
  ...
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Apr 6, 2019
* master: (77 commits)
  Suppress lease background sync failures if stopping (elastic#40902)
  [DOCS] Added settings page for ILM. (elastic#40880)
  [Docs] Remove extraneous text (elastic#40914)
  Move test classes to test root in Painless (elastic#40873)
  Fix date index name processor default date_formats (elastic#40915)
  Source additional files correctly in elasticsearch-cli (elastic#40890)
  Allow AVX-512 on JDK 11+ (elastic#40828)
  [Docs] Change example to show col headers (elastic#40822)
  Update apache httpclient to version 4.5.8 (elastic#40875)
  Update monitoring-kibana.json (elastic#40899)
  Introduce Delegating ActionListener Wrappers (elastic#40129)
  Deprecate old transport settings (elastic#40821)
  Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651)
  Use Writeable for TransportReplAction derivatives (elastic#40894)
  Add test for HTTP and Transport TLS on basic license (elastic#40714)
  Remove unneded cluster config from test (elastic#40856)
  Make Fuzziness reject illegal values earlier (elastic#33511)
  Remove test-only customisation from TransReplAct (elastic#40863)
  Fix dense/sparse vector limit documentation (elastic#40852)
  Make -try xlint warning disabled by default. (elastic#40833)
  ...
gurkankaymak pushed a commit to gurkankaymak/elasticsearch that referenced this pull request May 27, 2019
elastic#40651)

* Add Kibana application privileges for monitoring and ml reserved roles

* Adding test for kibana-.kibana application explicitly

* Whoa there, fat fingered kibana and application...

* And I copied something from monitoring I shouldn't have...

* And actually doing what Yogesh recommended...
droberts195 added a commit to droberts195/stack-docs that referenced this pull request May 31, 2019
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757
droberts195 added a commit to elastic/stack-docs that referenced this pull request Jun 5, 2019
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757

Co-Authored-By: Lisa Cawley <[email protected]>
droberts195 added a commit to elastic/stack-docs that referenced this pull request Jun 5, 2019
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757

Co-Authored-By: Lisa Cawley <[email protected]>
droberts195 added a commit to elastic/stack-docs that referenced this pull request Jun 5, 2019
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757

Co-Authored-By: Lisa Cawley <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants