Add new role to grant ISM API permissions

[AlexRuiz7]

Related issue
#2552

Description

A new role has been added to grant ISM API permissions, required by the app to upload the ISM policy for auto-rollover. It's mapped to the kibanaserver internal user by default.

A new file has been created: action_groups.yml, used to group all permissions required by the ISM API.

Tests

Check the following:

• The manage_ism action group is created in a fresh installation or upgrade.
• The manage_ism action group can be used in other roles.
• The manage_ism role is created in a fresh installation or upgrade.
• The manage_ism role uses the manage_ism action group as cluster permissions.
• The manage_ism role is mapped to the kibanaserver internal user.
• The manage_ism role can be mapped to other users.
• Any request to the ISM API is authorized for the kibanaserver user (or any other with the manage_ism role)

curl -X GET https://<indexer_url>:9200/_plugins/_ism/explain/wazuh-alerts-* -k -u "kibanaserver:<password>"

[rauldpm]

Changes seem good to me, but it is necessary to check the package build using Jenkins, please add the following builds

• A Packages_builder build for indexer RPM
• A Packages_builder build for indexer DEB

I do not see the checks shown in the PR as marked or done, where can I find the results?

[rauldpm]

Jenkins builds 🟢

• https://ci.wazuh.info/job/Packages_builder/173504/console
  • https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/wazuh-indexer-4.8.0-wp2553.x86_64.rpm
• https://ci.wazuh.info/job/Packages_builder/173503/console
  • https://packages-dev.wazuh.com/warehouse/test/4.8/deb/wazuh-indexer_4.8.0-wp2553_amd64.deb

[AlexRuiz7]

RPM (upgrade)

• The manage_ism action group is created in a fresh installation or upgrade.
• The manage_ism action group can be used in other roles.
• The manage_ism role is created in a fresh installation or upgrade.
• The manage_ism role uses the manage_ism action group as cluster permissions.
• The manage_ism role is mapped to the kibanaserver internal user.
• The manage_ism role can be mapped to other users.
• Any request to the ISM API is authorized for the kibanaserver user (or any other with the manage_ism role)

curl -X GET "https://localhost:9200/_plugins/_ism/explain/wazuh-alerts-*?pretty" -k -u "kibanaserver:lJ*bN+3zkQ8MnMU2OyldZSKuuogq2ity"
{
  "wazuh-alerts-4.x-2023.10.31-000001" : {
    "index.plugins.index_state_management.policy_id" : "rollover_policy",
    "index.opendistro.index_state_management.policy_id" : "rollover_policy",
    "index" : "wazuh-alerts-4.x-2023.10.31-000001",
    "index_uuid" : "Tfr2hV5iRGSBDl8lKfsTIg",
    "policy_id" : "rollover_policy",
    "policy_seq_no" : -2,
    "policy_primary_term" : 0,
    "rolled_over" : false,
    "index_creation_date" : 1698775149755,
    "state" : {
      "name" : "active",
      "start_time" : 1698775563752
    },
    "action" : {
      "name" : "rollover",
      "start_time" : 1698775820540,
      "index" : 0,
      "failed" : false,
      "consumed_retries" : 0,
      "last_retry_time" : 0
    },
    "step" : {
      "name" : "attempt_rollover",
      "start_time" : 1698775820540,
      "step_status" : "condition_not_met"
    },
    "retry_info" : {
      "failed" : false,
      "consumed_retries" : 0
    },
    "info" : {
      "message" : "Pending rollover of index [index=wazuh-alerts-4.x-2023.10.31-000001]",
      "conditions" : {
        "min_primary_shard_size" : {
          "condition" : "25gb",
          "current" : "186.2kb",
          "shard" : 0
        },
        "min_index_age" : {
          "condition" : "7d",
          "current" : "5.9d",
          "creationDate" : 1698775149755
        },
        "min_doc_count" : {
          "condition" : 200000000,
          "current" : 181
        }
      }
    },
    "enabled" : true
  },
  "total_managed_indices" : 1
}

[rauldpm]

LGTM!

Please be aware that these changes may affect the DevOps deployments, please check it with @wazuh/cicd