Skip to content

Add assertion that DLM can always operate on every data stream created #143961

@dakrone

Description

@dakrone

Description

DLM uses implicit permissions so that the user doesn't have to have permission on the underlying data stream. However, it's permissions are scoped to "*" indices and a small set of allowed dot-prefixed indices:

.indices(
// System data stream for result history of fleet actions (see Fleet#fleetActionsResultsDescriptor)
".fleet-actions-results",
// System data streams for storing uploaded file data for Agent diagnostics and Endpoint response actions
".fleet-fileds*",
// System data stream for kibana workflows logs
".workflows-execution-data-stream-logs"
)

In the event a dot-prefixed data stream is created that the internal DLM user doesn't not have permissions for, we should add an assert so that ES tests will catch it (as sometimes happens with Kibana-created data streams).

Relates to #143958 and #139162

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions